Test ID:	1.3.6.1.4.1.25623.1.0.871324
Category:	Red Hat Local Security Checks
Title:	RedHat Update for qemu-kvm RHSA-2015:0349-01
Summary:	The remote host is missing an update for the 'qemu-kvm'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'qemu-kvm' package(s) announced via the referenced advisory. Vulnerability Insight: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM. It was found that the Cirrus blit region checks were insufficient. A privileged guest user could use this flaw to write outside of VRAM-allocated buffer boundaries in the host's QEMU process address space with attacker-provided data. (CVE-2014-8106) An uninitialized data structure use flaw was found in the way the set_pixel_format() function sanitized the value of bits_per_pixel. An attacker able to access a guest's VNC console could use this flaw to crash the guest. (CVE-2014-7815) It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2014-7840) A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use. A local guest user could use this flaw to crash the guest. (CVE-2014-3640) Red Hat would like to thank James Spadaro of Cisco for reporting CVE-2014-7815, and Xavier Mehrenberger and Stephane Duverger of Airbus for reporting CVE-2014-3640. The CVE-2014-8106 issue was found by Paolo Bonzini of Red Hat, and the CVE-2014-7840 issue was discovered by Michael S. Tsirkin of Red Hat. Bug fixes: * The KVM utility executed demanding routing update system calls every time it performed an MSI vector mask/unmask operation. Consequently, guests running legacy systems such as Red Hat Enterprise Linux 5 could, under certain circumstances, experience significant slowdown. Now, the routing system calls during mask/unmask operations are skipped, and the performance of legacy guests is now more consistent. (BZ#1098976) * Due to a bug in the Internet Small Computer System Interface (iSCSI) driver, a qemu-kvm process terminated unexpectedly with a segmentation fault when the 'write same' command was executed in guest mode under the iSCSI protocol. This update fixes the bug, and the 'write same' command now functions in guest mode under iSCSI as intended. (BZ#1083413) * The QEMU command interface did not properly handle resizing of cache memory during guest migration, causing QEMU to terminate unexpectedly with a segmentation fault. This update ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: qemu-kvm on Red Hat Enterprise Linux Server (v. 7) Solution: Please Install the Updated Packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-3640 DSA-3044 http://www.debian.org/security/2014/dsa-3044 DSA-3045 http://www.debian.org/security/2014/dsa-3045 RHSA-2015:0349 http://rhn.redhat.com/errata/RHSA-2015-0349.html RHSA-2015:0624 http://rhn.redhat.com/errata/RHSA-2015-0624.html USN-2409-1 http://www.ubuntu.com/usn/USN-2409-1 [Qemu-devel] 20140918 [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg03543.html [Qemu-devel] 20140923 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04598.html [Qemu-devel] 20140924 Re: [PATCH v2] slirp: udp: fix NULL pointer dereference because of uninitialized socket http://lists.nongnu.org/archive/html/qemu-devel/2014-09/msg04707.html https://bugzilla.redhat.com/show_bug.cgi?id=1144818 Common Vulnerability Exposure (CVE) ID: CVE-2014-7815 61484 http://secunia.com/advisories/61484 62143 http://secunia.com/advisories/62143 62144 http://secunia.com/advisories/62144 DSA-3066 http://www.debian.org/security/2014/dsa-3066 DSA-3067 http://www.debian.org/security/2014/dsa-3067 SUSE-SU-2015:1782 http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e6908bfe8e07f2b452e78e677da1b45b1c0f6829 http://support.citrix.com/article/CTX200892 https://bugzilla.redhat.com/show_bug.cgi?id=1157641 Common Vulnerability Exposure (CVE) ID: CVE-2014-7840 [qemu-devel] 20141112 [PATCH 0/4] migration: fix CVE-2014-7840 http://thread.gmane.org/gmane.comp.emulators.qemu/306117 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08 https://bugzilla.redhat.com/show_bug.cgi?id=1163075 qemu-cve20147840-code-exec(99194) https://exchange.xforce.ibmcloud.com/vulnerabilities/99194 Common Vulnerability Exposure (CVE) ID: CVE-2014-8106 60364 http://secunia.com/advisories/60364 71477 http://www.securityfocus.com/bid/71477 DSA-3087 http://www.debian.org/security/2014/dsa-3087 DSA-3088 http://www.debian.org/security/2014/dsa-3088 FEDORA-2015-5482 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154656.html RHSA-2015:0643 http://rhn.redhat.com/errata/RHSA-2015-0643.html RHSA-2015:0795 http://rhn.redhat.com/errata/RHSA-2015-0795.html RHSA-2015:0867 http://rhn.redhat.com/errata/RHSA-2015-0867.html RHSA-2015:0868 http://rhn.redhat.com/errata/RHSA-2015-0868.html RHSA-2015:0891 http://rhn.redhat.com/errata/RHSA-2015-0891.html [Qemu-devel] 20141204 [PULL for-2.2 0/2] cirrus: fix blit region check (cve-2014-8106) http://lists.gnu.org/archive/html/qemu-devel/2014-12/msg00508.html [oss-security] 20141204 CVE-2014-8106 qemu: cirrus: insufficient blit region checks http://www.openwall.com/lists/oss-security/2014/12/04/8 http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bf25983345ca44aec3dd92c57142be45452bd38a http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d3532a0db02296e687711b8cdc7791924efccea0 qemu-cve20148106-sec-bypass(99126) https://exchange.xforce.ibmcloud.com/vulnerabilities/99126
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.