Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Red Hat: RHSA-2023:2162-01 moderate: qemu-kvm Security Issue

red hat
Calendar Grey May 9, 2023
Dist Redhat Esm H88
A new qemu-kvm update has been released for Red Hat Enterprise Linux 9, categorized as Moderate risk, which resolves important security vulnerabilities.
An update for qemu-kvm is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Summary

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
The following packages have been upgraded to a later upstream version: qemu-kvm (7.2.0). (BZ#2111769, BZ#2135806)
Security Fix(es):
* QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)
* QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record (CVE-2022-4172)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory security issue Red Hat bug fix moderate impact virtualization qemu-kvm

References

https://access.redhat.com/security/cve/CVE-2022-3165 https://access.redhat.com/security/cve/CVE-2022-4172 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: qemu-kvm-7.2.0-14.el9_2.src.rpm
aarch64: qemu-guest-agent-7.2.0-14.el9_2.aarch64.rpm qemu-guest-agent-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-img-7.2.0-14.el9_2.aarch64.rpm qemu-img-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-audio-pa-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-audio-pa-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-block-curl-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-block-curl-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-block-rbd-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-block-rbd-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-common-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-common-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-core-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-core-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-debugsource-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-display-virtio-gpu-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-display-virtio-gpu-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-debuginfo-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-usb-host-7.2.0-14.el9_2.aarch64.rpm qemu-kvm-device-usb-host-debuginfo-7.2.0-14.el9_2.aarch64.rpm

Read the Full Advisory


Advisory ID: RHSA-2023:2162-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2162
Issue date: 2023-05-09

Topic

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue Red Hat bug fix moderate impact virtualization qemu-kvm

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

1860292 - RFE: add extent_size_hint information to qemu-img info

1905805 - support config interrupt in vhost-vdpa qemu

1963845 - QEMU quit if set nvdimm memory backend option readonly=on

1979276 - SVM: non atomic memslot updates cause boot failure with seabios and cpu-pm=on

1983208 - i386/pc: Fix creation of >= 1Tb guests on AMD systems with IOMMU

1983493 - Qemu should prompt fatal error and quit with an unsupported audiodev

1986665 - [Fwcfg64] dump-guest-memory -w command report error "win-dump: failed to read CPU #2 ContextFrame location" on Windows desktop

2074000 - Make memory preallocation threads NUMA aware

2077376 - [RFE] Add support for 32-bit guest Windows dump with vmcoreinfo (fwcfg) via 'dump-guest-memory -w'

2086980 - Please Update The Error Info More Clearly When Creating Images Over RBD with The Namespace Not Existing

2087155 - Guest will get stuck at "Reached target Basic System" if insert the virtio-iommu device in pcie-root-port

2091166 - Q35: dmidecode doesn't display number of cpus (>255) correctly

2108531 - Windows guest reboot after migration with wsl2 installed inside

2108923 - [RHEL.9.2] Display a deprecation message in '-cpu help' for deprecated CPU models

2111769 - Rebase to QEMU 7.1.0

2113840 - [RHEL9.2] Memory mapping optimization for virt machine

2116496 - Can't run when memory backing with hugepages and backend type memfd

2120480 - guest with tpm crashed when executing memory dump to kdump-zlib_format

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here