RedHatRHSA-2016:2585(RHSA-2016:2585) Moderate: qemu-kvm security, bug fix, and enhancement update
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.8%
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm packages provide the user-space component for running virtual machines using KVM.
Security Fix(es):
-
An integer overflow flaw and an out-of-bounds read flaw were found in the way QEMU’s VGA emulator set certain VGA registers while in VBE mode. A privileged guest user could use this flaw to crash the QEMU process instance. (CVE-2016-3712)
-
An infinite loop flaw was found in the way QEMU’s e1000 NIC emulation implementation processed data using transmit or receive descriptors under certain conditions. A privileged user inside a guest could use this flaw to crash the QEMU instance. (CVE-2016-1981)
Red Hat would like to thank Zuozhi Fzz (Alibaba Inc.) for reporting CVE-2016-3712.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| RedHat | 7 | ppc64le | qemu-img | < 1.5.3-126.el7 | qemu-img-1.5.3-126.el7.ppc64le.rpm |
| RedHat | 7 | x86_64 | qemu-img | < 1.5.3-126.el7 | qemu-img-1.5.3-126.el7.x86_64.rpm |
| RedHat | 7 | x86_64 | qemu-kvm-debuginfo | < 1.5.3-126.el7 | qemu-kvm-debuginfo-1.5.3-126.el7.x86_64.rpm |
| RedHat | 7 | x86_64 | qemu-kvm-common | < 1.5.3-126.el7 | qemu-kvm-common-1.5.3-126.el7.x86_64.rpm |
| RedHat | 7 | x86_64 | qemu-kvm-tools | < 1.5.3-126.el7 | qemu-kvm-tools-1.5.3-126.el7.x86_64.rpm |
| RedHat | 7 | ppc64le | qemu-kvm-debuginfo | < 1.5.3-126.el7 | qemu-kvm-debuginfo-1.5.3-126.el7.ppc64le.rpm |
| RedHat | 7 | ppc64 | qemu-img | < 1.5.3-126.el7 | qemu-img-1.5.3-126.el7.ppc64.rpm |
| RedHat | 7 | ppc64 | qemu-kvm-debuginfo | < 1.5.3-126.el7 | qemu-kvm-debuginfo-1.5.3-126.el7.ppc64.rpm |
| RedHat | 7 | x86_64 | qemu-kvm | < 1.5.3-126.el7 | qemu-kvm-1.5.3-126.el7.x86_64.rpm |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
24.8%