kmod, kvm security update

2014-02-12T19:33:17
ID CESA-2014:0163
Type centos
Reporter CentOS Project
Modified 2014-02-12T19:33:17

Description

CentOS Errata and Security Advisory CESA-2014:0163

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel.

A divide-by-zero flaw was found in the apic_get_tmcct() function in KVM's Local Advanced Programmable Interrupt Controller (LAPIC) implementation. A privileged guest user could use this flaw to crash the host. (CVE-2013-6367)

A memory corruption flaw was discovered in the way KVM handled virtual APIC accesses that crossed a page boundary. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2013-6368)

Red Hat would like to thank Andrew Honig of Google for reporting these issues.

All kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Note: the procedure in the Solution section must be performed before this update will take effect.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2014-February/020154.html

Affected packages: kmod-kvm kmod-kvm-debug kvm kvm-qemu-img kvm-tools

Upstream details at: https://rhn.redhat.com/errata/RHSA-2014-0163.html