Amazon Linux AMI : kernel (ALAS-2019-1293)

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last' value could be supplied by a host user-space...

qemu security update

CentOS Errata and Security Advisory CESA-2019:2892 An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Amazon Linux 2 : kernel (ALAS-2019-1293)

An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last' value could be supplied by a host user-space...

Debian DLA-1930-1 : linux security update

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2016-10905 A race condition was discovered in the GFS2 file-system implementation, which could lead to a use-after-free. On a system using GFS2, a...

OracleVM 3.4 : qemu-kvm (OVMSA-2019-0045)

The remote OracleVM system is missing necessary patches to address critical security updates : - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot .patch - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t .patch - kvm-slirp-don-t-manipulate-sorcv-in-tcpemu.patch bz1669066 -...

Important: kernel

Issue Overview: An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last' value could be supplied by a host...

Oracle Linux 6 : qemu-kvm (ELSA-2019-2892)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2892 advisory. - Resolves: bz1586251 CVE-2018-11806 qemu-kvm: QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams rhel-6.10.z - Resolves:...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20190924)

Security Fixes : - QEMU: slirp: heap buffer overflow while reassembling fragmented datagrams CVE-2018-11806 - QEMU: slirp: heap buffer overflow in tcpemu CVE-2019-6778 - QEMU: ne2000: integer overflow leads to buffer overflow issue CVE-2018-10839 - QEMU: pcnet: integer overflow leads to buffer...

RHEL 6 : qemu-kvm (RHSA-2019:2892)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2892 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide th...

Important: kernel

Issue Overview: An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvmcoalescedmmio' object, wherein write indices 'ring-first' and 'ring-last' value could be supplied by a host...

Important: Red Hat Security Advisory: qemu-kvm security update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

qemu-kvm security update

0.12.1.2-2.506.el610.5 - kvm-slirp-fix-big-little-endian-conversion-in-ident-prot.patch bz1669066 - kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t.patch bz1669066 - kvm-slirp-don-t-manipulate-sorcv-in-tcpemu.patch bz1669066 - kvm-qxl-check-release-info-object.patch bz1712728 -...

EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-1988)

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Buffer overflow in the pxa2xxsspload function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or...

EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2019-1999)

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Buffer overflow in the pxa2xxsspload function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or...

kernel: vhost-net: guest to host kernel escape during migration

A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this fla...

SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:2414-1)

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new features were implemented : jscSLE-4875: CML New device IDs for CML jscSLE-7294: Add cpufreq driver for Raspberry Pi fate321840: Reduce memory required to boot capture kernel while using...

Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4799)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-4799 advisory. 4.14.35-1902.5.2.2 - KVM: coalescedmmio: add bounds checking Matt Delco Orabug: 30318013 CVE-2019-14821 CVE-2019-14821 Tenable has extracted the preceding...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0044)

The remote OracleVM system is missing necessary patches to address critical security updates : - KVM: coalescedmmio: add bounds checking Matt Delco Orabug: 30318042 CVE-2019-14821 CVE-2019-14821 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Securi...

SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:2412-1)

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes. The following new features were implemented : jscSLE-4875: CML New device IDs for CML jscSLE-7294: Add cpufreq driver for Raspberry Pi fate322438: Integrate P9 XIVE support on PowerVM only fate322447: Ad...

Debian DLA-1927-1 : qemu security update

Several vulnerabilities were found in QEMU, a fast processor emulator notably used in KVM and Xen HVM virtualization. CVE-2016-5126 Heap-based buffer overflow in the iscsiaioioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service QEMU process crash or...