(RHSA-2016:2706) Moderate: qemu-kvm-rhev security, bug fix, and enhancement update

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM in environments managed by Red Hat Enterprise Virtualization Manager.

The following packages have been upgraded to a newer upstream version: qemu-kvm-rhev (2.6.0). (BZ#1386377)

Security Fix(es):

• An out-of-bounds flaw was found in the QEMU emulator built using ‘address_space_translate’ to map an address to a MemoryRegionSection. The flaw could occur while doing pci_dma_read/write calls, resulting in an out-of-bounds read-write access error. A privileged user inside a guest could use this flaw to crash the guest instance (denial of service). (CVE-2015-8817, CVE-2015-8818)

Red Hat would like to thank Donghai Zdh of Alibaba Inc. for reporting this issue.