RHSA-2024:2135 - Security Advisory

Topic

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

• QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)
• QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)
• QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)
• QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)
• QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.4 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

• BZ - 2218486 - CVE-2023-3255 QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service
• BZ - 2222351 - CVE-2023-3019 QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
• BZ - 2238291 - CVE-2023-42467 QEMU: am53c974: denial of service due to division by zero
• BZ - 2247283 - CVE-2023-5088 QEMU: improper IDE controller reset can lead to MBR overwrite
• BZ - 2254825 - CVE-2023-6683 QEMU: VNC: NULL pointer dereference in qemu_clipboard_request()
• RHEL-1676 - Enable virtio-multitouch-device / virtio-multitouch-pci in qemu-kvm 8.1
• RHEL-832 - qemu-kvm crashed when migrating guest with failover vf
• RHEL-11219 - migration tests failing for RHEL 9.4 sometimes
• RHEL-7360 - Qemu Core Dumped When Writing Larger Size Than The Size of A Data Disk
• RHEL-12991 - qemu-kvm fails to build on s390x with clang-17
• RHEL-7561 - Missing the rpm package qemu-kvm-device-usb-redirect on Arm64 platform
• RHEL-14111 - Rebase qemu-kvm to QEMU 8.2.0
• RHEL-16581 - [nested][emulated igb] Cannot reset device , depends on group which is not owned.
• RHEL-16686 - [vfio migration][8.2]Disable postcopy for VM with migratable vfio device
• RHEL-17068 - Check/fix machine type compatibility for qemu-kvm 8.2.0 [x86_64]
• RHEL-1708 - [QSD]Qemu coredump when creating target node in qsd
• RHEL-17209 - [emulated igb]/hw/pci/pcie_sriov.c:181: void register_vfs(PCIDevice *): Assertion `dev->exp.sriov_pf.vf' failed.
• RHEL-1761 - [kvm-qemu] Qemu hang when do block jobs on multiple disks(all bind to the same iothread)
• RHEL-19010 - no response with QMP blockdev-change-medium
• RHEL-3922 - qemu crash with qemu_mutex_unlock_impl: Operation not permitted after executing blockdev-change-medium
• RHEL-7098 - [vfio migration] The Q35 + OVMF VM with a mlx5_vfio_pci VF can not be migrated
• RHEL-7115 - Recovering postcopy before network issue is resolved leads to wrong qemu migration status
• RHEL-7135 - [s390x] virtio-gpu blob option not functional
• RHEL-7414 - [Qemu] Support 64-bit block status and bulk zero over NBD in qemu
• RHEL-7478 - Vnc show Guest has not initialized the display (yet) after ramfb VM migration
• RHEL-7526 - SMBIOS 2.1 table limits error when booting guest with 710 vcpus and 250G memory
• RHEL-7527 - Q35: Use SMBIOS 3.0 Entry Point Type automatically
• RHEL-7565 - qemu crashed when migrate guest with blob resources enabled
• RHEL-17067 - Check/fix machine type compatibility for qemu-kvm 8.2.0 [s390x]
• RHEL-17168 - Introduce virt-rhel9.4.0 arm-virt machine type [aarch64]
• RHEL-19119 - Introduce -rhel9.4.0 qemu-kvm machine type [s390x]
• RHEL-19117 - Introduce -rhel9.4.0 qemu-kvm machine type [x86_64]
• RHEL-15965 - [qemu-kvm] Remove AioContext lock (no response with QMP command block_resize)
• RHEL-18212 - [RHEL9][Secure-execution][s390x] The error message is not clear when boot up a SE guest with wrong encryption
• RHEL-19738 - Enable properties allowing to disable high memory regions
• RHEL-21057 - Request backport of 9353b6da430f90e47f352dbf6dc31120c8914da6
• RHEL-21293 - [emulated igb] Failed to set up TRIGGER eventfd signaling for interrupt INTX-0: VFIO_DEVICE_SET_IRQS failure: Invalid argument
• RHEL-21570 - Critical performance degradation for input devices in virtio vnc session
• RHEL-7361 - [qemu-kvm] Enable zstd support for qcow2 files
• RHEL-6101 - qemu: elf2dmp utility cannot process ntkrnlmp.pdb for Windows 11
• RHEL-5324 - qemu-kvm: contrib/elf2dmp: Windows Server 2022 support
• RHEL-17369 - [rt][post-copy migration] qemu-kvm: ../block/qcow2.c:5263: ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *, Error **): Assertion `false' failed.
• RHEL-20764 - [qemu-kvm] Enable qemu multiqueue block layer support
• RHEL-24045 - QEMU: default-enable dynamically using multiple memslots for virtio-mem
• RHEL-24593 - qemu crash blk_get_aio_context(BlockBackend *): Assertion `ctx == blk->ctx' when repeatedly hotplug/unplug disk
• RHEL-7356 - [qemu-kvm] no response with QMP command device_add when repeatedly hotplug/unplug virtio disks [RHEL-9]
• RHEL-15394 - virtio-blk: qemu hang on "no response on QMP query-status" when write data to disk without enough space
• RHEL-24988 - Mark virt-rhel9.{0,2}.0 machine types as deprecated
• RHEL-3934 - [qemu-kvm] Failed on repeatedly hotplug/unplug disk iothread enabled
• RHEL-26049 - When max vcpu is greater than or equal to 246, qemu unable to init event notifier
• RHEL-21705 - pc-q35-rhel9.4.0 does not provide proper computer information
• RHEL-24614 - [RHEL9][chardev] qemu hit core dump while using TLS server from host to guest

CVEs

• CVE-2023-3019
• CVE-2023-3255
• CVE-2023-5088
• CVE-2023-6683
• CVE-2023-42467

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index