RHSA-2024:9128 - Security Advisory

Topic

An update for libvirt is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

• libvirt: Crash of virtinterfaced via virConnectListInterfaces() (CVE-2024-8235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 9 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat Enterprise Linux Server - AUS 9.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 9 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat Enterprise Linux for Power, little endian 9 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat Enterprise Linux for ARM 64 9 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
• Red Hat CodeReady Linux Builder for x86_64 9 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian 9 ppc64le
• Red Hat CodeReady Linux Builder for ARM 64 9 aarch64
• Red Hat CodeReady Linux Builder for IBM z Systems 9 s390x
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 9.6 ppc64le
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x

Fixes

• BZ - 2308680 - CVE-2024-8235 libvirt: Crash of virtinterfaced via virConnectListInterfaces()
• RHEL-30622 - VM failed to save with error "Target CPU feature count 34 does not match source 105"
• RHEL-16333 - [RFE]Allow rotating TLS cert for VNC console
• RHEL-22728 - Failed to hotplug 'vhost-user-fs-ccw' device with bootorder attribute on s390x
• RHEL-23416 - live update interface to delete the boot order setting succeed but no changes in xml
• RHEL-23608 - virsh freepages does not display for 16G page size
• RHEL-25993 - Optional argument key of virt-admin daemon-timeout does not work as expected
• RHEL-26276 - deleting snapshot that had multiple branches doesn't correctly update data in non-original branches
• RHEL-29642 - Rebase libvirt in RHEL-9.5.0
• RHEL-30373 - libvirt should delete the qos set to ovs port after vm destroyed
• RHEL-32880 - live-migration with NBD TLS fails with "Certificate does not match the hostname "
• RHEL-34112 - It will report?very?long error message when start vm with big value of inbound average setting
• RHEL-35879 - Integrate support for resolvectl in virtual network startup
• RHEL-7101 - RFE: Prefer /dev/userfaultfd over userfaultfd(2) syscall
• RHEL-7343 - [RFE] [libvirt] Eliminate raw format blockdev to improve disk I/O performance
• RHEL-7461 - [RFE] Request to expose pcie-root-port's mem-reserve option
• RHEL-7489 - [aarch64] [libvirt] Support RAS for aarch64
• RHEL-33044 - Memory leak of external snapshot revert
• RHEL-33082 - non realtime VMs should set affinity to housekeeping CPUs
• RHEL-34615 - Unable to encode message payload for listDefinedInterfaces() when bind/unbind the device
• RHEL-36565 - '--help' option for virsh/virt-admin can not work
• RHEL-36721 - Save to root_squash NFS failed with "Unknown error 255"
• RHEL-39271 - Can't attach filesystem without address anymore
• RHEL-39400 - 'tc' cmds still get outputs after deleting Qos by update-device
• RHEL-23833 - Support to cold-plug iommu device
• RHEL-37542 - Update disk with diskcard_no_unref should fail with a clear error message
• RHEL-39497 - nodedev-dumpxml lists unexpected parent
• RHEL-40135 - [Libvirt] Allow virtiofsd pre-copy migration
• RHEL-40899 - Migration between hosts which lack some vmx-* features may incorrectly fail with "guest CPU doesn't match specification: missing features: vmx-*"
• RHEL-43309 - libvirtd/virtqemud crash when a live-migrated VM shuts down during migration
• RHEL-46099 - Can't dump the guest xml from VMware if missing essential config entry 'ethernet0.dvs.connectionId'
• RHEL-46868 - An addtional "PASS" when run virt-host-validate on system support sev
• RHEL-7108 - virtiofsd started by libvirtd uses the deprecated option format
• RHEL-32182 - Can't dump the guest xml from VMware if guest network has no entry 'serial0.fileName'
• RHEL-49516 - Can't run live migration from older RHEL 9 when ignored features are defined on source
• RHEL-50329 - Update none cache mode in virtiofs device to never mode
• RHEL-53560 - virsh doesn't load/save history
• RHEL-56451 - Configure model for panic device automatically on aarch64

CVEs

• CVE-2024-8235

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index