(RHSA-2015:1674) Moderate: qemu-kvm-rhev security update

2015-08-24T04:00:00
ID RHSA-2015:1674
Type redhat
Reporter RedHat
Modified 2018-03-19T16:26:59

Description

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM.

Qemu emulator built with the RTL8139 emulation support is vulnerable to an information leakage flaw, while processing network packets under RTL8139 controller's C+ mode of operation. A guest user could use this flaw to read upto 65KB of uninitialised Qemu heap memory. (CVE-2015-5165)

Red Hat would like to thank the Xen project for reporting this issue. Upstream acknowledges Donghai Zhu of Alibaba as the original reporter.

All qemu-kvm-rhev users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.