Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Red Hat Enterprise Linux 9: RHSA-2023-5094 Important Remote DoS in Qemu-Kvm

red hat
Calendar Grey September 12, 2023
Dist Redhat Esm H88
This release brings essential improvements in security along with bug resolutions for qemu-kvm within Red Hat Enterprise Linux 9.
An update for qemu-kvm is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Summary

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service (CVE-2023-3354)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* [qemu-kvm] rhel guest failed boot with multi disks on error Failed to start udev Wait for Complete Device Initialization (BZ#2211923)
* [rhel9.2] hotplug/hotunplug mlx vdpa device to the occupied addr port, then qemu core dump occurs after shutdown guest (BZ#2227721)

Topics%20covered

Topics Covered

security advisory denial of service security fix Red Hat Enterprise Linux important qemu-kvm

References

https://access.redhat.com/security/cve/CVE-2023-3354 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: qemu-kvm-7.2.0-14.el9_2.5.src.rpm
aarch64: qemu-guest-agent-7.2.0-14.el9_2.5.aarch64.rpm qemu-guest-agent-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-img-7.2.0-14.el9_2.5.aarch64.rpm qemu-img-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-audio-pa-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-audio-pa-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-block-curl-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-block-curl-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-block-rbd-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-block-rbd-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-common-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-common-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-core-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-core-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-debugsource-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-device-display-virtio-gpu-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-device-display-virtio-gpu-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-device-display-virtio-gpu-pci-debuginfo-7.2.0-14.el9_2.5.aarch64.rpm qemu-kvm-device-usb-host-7.2.0-14.el9_2.5.aarch64.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2023:5094-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:5094
Issue date: 2023-09-12

Topic

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory denial of service security fix Red Hat Enterprise Linux important qemu-kvm

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2211923 - [qemu-kvm] rhel guest failed boot with multi disks on error Failed to start udev Wait for Complete Device Initialization [rhel-9.2.0.z]

2216478 - CVE-2023-3354 QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote unauthenticated denial of service

2227721 - [rhel9.2] hotplug/hotunplug mlx vdpa device to the occupied addr port, then qemu core dump occurs after shutdown guest [rhel-9.2.0.z]

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here