5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
60.4%
CentOS Errata and Security Advisory CESA-2018:2001
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation that includes support for guests running on hosts with AMD processors.
Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-July/085119.html
Affected packages:
qemu-img
qemu-kvm
qemu-kvm-common
qemu-kvm-tools
Upstream details at:
https://access.redhat.com/errata/RHSA-2018:2001
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 7 | x86_64 | qemu-img | < 1.5.3-156.el7_5.3 | qemu-img-1.5.3-156.el7_5.3.x86_64.rpm |
CentOS | 7 | x86_64 | qemu-kvm | < 1.5.3-156.el7_5.3 | qemu-kvm-1.5.3-156.el7_5.3.x86_64.rpm |
CentOS | 7 | x86_64 | qemu-kvm-common | < 1.5.3-156.el7_5.3 | qemu-kvm-common-1.5.3-156.el7_5.3.x86_64.rpm |
CentOS | 7 | x86_64 | qemu-kvm-tools | < 1.5.3-156.el7_5.3 | qemu-kvm-tools-1.5.3-156.el7_5.3.x86_64.rpm |
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
60.4%