Oval Definition:oval:com.redhat.rhsa:def:20173368
Revision Date:2017-11-30Version:636
Title:RHSA-2017:3368: qemu-kvm security update (Moderate)
Description:Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm package provides the user-space component for running virtual machines that use KVM.

Security Fix(es):

  • Quick Emulator (QEMU), compiled with the PC System Emulator with multiboot feature support, is vulnerable to an OOB r/w memory access issue. The issue could occur due to an integer overflow while loading a kernel image during a guest boot. A user or process could use this flaw to potentially achieve arbitrary code execution on a host. (CVE-2017-14167)

  • Quick emulator (QEMU), compiled with the Cirrus CLGD 54xx VGA Emulator support, is vulnerable to an OOB write access issue. The issue could occur while writing to VGA memory via mode4and5 write functions. A privileged user inside guest could use this flaw to crash the QEMU process resulting in Denial of Serivce (DoS). (CVE-2017-15289)

    Red Hat would like to thank Thomas Garnier (Google.com) for reporting CVE-2017-14167 and Guoxiang Niu (Huawei.com) for reporting CVE-2017-15289.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2017-14167
    CVE-2017-15289
    RHSA-2017:3368
    RHSA-2017:3368-00
    RHSA-2017:3368-01
    Platform(s):Red Hat Enterprise Linux 7
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 7 is installed
  • AND
  • qemu-img is earlier than 10:1.5.3-141.el7_4.4
  • AND qemu-img is signed with Red Hat redhatrelease2 key
  • qemu-kvm is earlier than 10:1.5.3-141.el7_4.4
  • AND qemu-kvm is signed with Red Hat redhatrelease2 key
  • qemu-kvm-common is earlier than 10:1.5.3-141.el7_4.4
  • AND qemu-kvm-common is signed with Red Hat redhatrelease2 key
  • qemu-kvm-tools is earlier than 10:1.5.3-141.el7_4.4
  • AND qemu-kvm-tools is signed with Red Hat redhatrelease2 key
  • BACK