Scientific Linux 5.x: CVE-2010-0431 Important KVM Security Update

Date: Tue, 17 Aug 2010 11:36:54 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: FASTBUGS for SL 5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

The following FASTBUGS have been uploaded to

 i386:
autofs-5.0.1-0.rc2.143.el5_5.4.i386.rpm
compat-openldap-2.3.43_2.2.29-12.el5_5.2.i386.rpm
cups-1.3.7-18.el5_5.7.i386.rpm
cups-devel-1.3.7-18.el5_5.7.i386.rpm
cups-libs-1.3.7-18.el5_5.7.i386.rpm
cups-lpd-1.3.7-18.el5_5.7.i386.rpm
dhclient-3.0.5-23.el5_5.1.i386.rpm
dhcp-3.0.5-23.el5_5.1.i386.rpm
dhcp-devel-3.0.5-23.el5_5.1.i386.rpm
gdb-7.0.1-23.el5_5.2.i386.rpm
java-1.6.0-openjdk-1.6.0.0-1.13.b16.el5.i386.rpm
java-1.6.0-openjdk-demo-1.6.0.0-1.13.b16.el5.i386.rpm
java-1.6.0-openjdk-devel-1.6.0.0-1.13.b16.el5.i386.rpm
java-1.6.0-openjdk-javadoc-1.6.0.0-1.13.b16.el5.i386.rpm
java-1.6.0-openjdk-src-1.6.0.0-1.13.b16.el5.i386.rpm
libdhcp4client-3.0.5-23.el5_5.1.i386.rpm
libdhcp4client-devel-3.0.5-23.el5_5.1.i386.rpm
libvolume_id-095-14.21.el5_5.1.i386.rpm
libvolume_id-devel-095-14.21.el5_5.1.i386.rpm
man-pages-2.39-17.el5.noarch.rpm
man-pages-ja-20060815-14.el5.noarch.rpm
nfs-utils-1.0.9-47.el5_5.i386.rpm
openais-0.80.6-16.el5_5.7.i386.rpm
openais-devel-0.80.6-16.el5_5.7.i386.rpm
openldap-2.3.43-12.el5_5.2.i386.rpm
openldap-clients-2.3.43-12.el5_5.2.i386.rpm
openldap-devel-2.3.43-12.el5_5.2.i386.rpm
openldap-servers-2.3.43-12.el5_5.2.i386.rpm
openldap-servers-overlays-2.3.43-12.el5_5.2.i386.rpm
openldap-servers-sql-2.3.43-12.el5_5.2.i386.rpm
passwd-0.73-2.i386.rpm
perl-Archive-Tar-1.39.1-1.el5_5.2.noarch.rpm
systemtap-1.1-3.el5_5.2.i386.rpm
systemtap-client-1.1-3.el5_5.2.i386.rpm
systemtap-initscript-1.1-3.el5_5.2.i386.rpm
systemtap-runtime-1.1-3.el5_5.2.i386.rpm
systemtap-sdt-devel-1.1-3.el5_5.2.i386.rpm
systemtap-server-1.1-3.el5_5.2.i386.rpm
systemtap-testsuite-1.1-3.el5_5.2.i386.rpm
tmpwatch-2.9.7-1.1.el5.5.i386.rpm
udev-095-14.21.el5_5.1.i386.rpm
xen-3.0.3-105.el5_5.5.i386.rpm
xen-devel-3.0.3-105.el5_5.5.i386.rpm
xen-libs-3.0.3-105.el5_5.5.i386.rpm

 x86_64:
autofs-5.0.1-0.rc2.143.el5_5.4.x86_64.rpm
compat-openldap-2.3.43_2.2.29-12.el5_5.2.i386.rpm
compat-openldap-2.3.43_2.2.29-12.el5_5.2.x86_64.rpm
cups-1.3.7-18.el5_5.7.x86_64.rpm
cups-devel-1.3.7-18.el5_5.7.i386.rpm
cups-devel-1.3.7-18.el5_5.7.x86_64.rpm
cups-libs-1.3.7-18.el5_5.7.i386.rpm
cups-libs-1.3.7-18.el5_5.7.x86_64.rpm
cups-lpd-1.3.7-18.el5_5.7.x86_64.rpm
dhclient-3.0.5-23.el5_5.1.x86_64.rpm
dhcp-3.0.5-23.el5_5.1.x86_64.rpm
dhcp-devel-3.0.5-23.el5_5.1.i386.rpm
dhcp-devel-3.0.5-23.el5_5.1.x86_64.rpm
gdb-7.0.1-23.el5_5.2.x86_64.rpm
java-1.6.0-openjdk-1.6.0.0-1.13.b16.el5.x86_64.rpm
java-1.6.0-openjdk-demo-1.6.0.0-1.13.b16.el5.x86_64.rpm
java-1.6.0-openjdk-devel-1.6.0.0-1.13.b16.el5.x86_64.rpm
java-1.6.0-openjdk-javadoc-1.6.0.0-1.13.b16.el5.x86_64.rpm
java-1.6.0-openjdk-src-1.6.0.0-1.13.b16.el5.x86_64.rpm
kmod-kvm-83-164.el5_5.15.x86_64.rpm
kvm-83-164.el5_5.15.x86_64.rpm
kvm-qemu-img-83-164.el5_5.15.x86_64.rpm
kvm-tools-83-164.el5_5.15.x86_64.rpm
libdhcp4client-3.0.5-23.el5_5.1.i386.rpm
libdhcp4client-3.0.5-23.el5_5.1.x86_64.rpm
libdhcp4client-devel-3.0.5-23.el5_5.1.i386.rpm
libdhcp4client-devel-3.0.5-23.el5_5.1.x86_64.rpm
libvolume_id-095-14.21.el5_5.1.i386.rpm
libvolume_id-095-14.21.el5_5.1.x86_64.rpm
libvolume_id-devel-095-14.21.el5_5.1.i386.rpm
libvolume_id-devel-095-14.21.el5_5.1.x86_64.rpm
man-pages-2.39-17.el5.noarch.rpm
man-pages-ja-20060815-14.el5.noarch.rpm
nfs-utils-1.0.9-47.el5_5.x86_64.rpm
openais-0.80.6-16.el5_5.7.x86_64.rpm
openais-devel-0.80.6-16.el5_5.7.i386.rpm
openais-devel-0.80.6-16.el5_5.7.x86_64.rpm
openldap-2.3.43-12.el5_5.2.i386.rpm
openldap-2.3.43-12.el5_5.2.x86_64.rpm
openldap-clients-2.3.43-12.el5_5.2.x86_64.rpm
openldap-devel-2.3.43-12.el5_5.2.i386.rpm
openldap-devel-2.3.43-12.el5_5.2.x86_64.rpm
openldap-servers-2.3.43-12.el5_5.2.x86_64.rpm
openldap-servers-overlays-2.3.43-12.el5_5.2.x86_64.rpm
openldap-servers-sql-2.3.43-12.el5_5.2.x86_64.rpm
passwd-0.73-2.x86_64.rpm
perl-Archive-Tar-1.39.1-1.el5_5.2.noarch.rpm
qspice-0.3.0-54.el5_5.1.x86_64.rpm
qspice-libs-0.3.0-54.el5_5.1.x86_64.rpm
qspice-libs-devel-0.3.0-54.el5_5.1.x86_64.rpm
systemtap-1.1-3.el5_5.2.x86_64.rpm
systemtap-client-1.1-3.el5_5.2.x86_64.rpm
systemtap-initscript-1.1-3.el5_5.2.x86_64.rpm
systemtap-runtime-1.1-3.el5_5.2.x86_64.rpm
systemtap-sdt-devel-1.1-3.el5_5.2.i386.rpm
systemtap-sdt-devel-1.1-3.el5_5.2.x86_64.rpm
systemtap-server-1.1-3.el5_5.2.x86_64.rpm
systemtap-testsuite-1.1-3.el5_5.2.x86_64.rpm
tmpwatch-2.9.7-1.1.el5.5.x86_64.rpm
udev-095-14.21.el5_5.1.x86_64.rpm
xen-3.0.3-105.el5_5.5.x86_64.rpm
xen-devel-3.0.3-105.el5_5.5.i386.rpm
xen-devel-3.0.3-105.el5_5.5.x86_64.rpm
xen-libs-3.0.3-105.el5_5.5.i386.rpm
xen-libs-3.0.3-105.el5_5.5.x86_64.rpm

-Connie Sieh
-Troy Dawson
Date: Fri, 20 Aug 2010 14:17:50 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Important: kvm on SL5.x x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Important: kvm security and bug fix update
Issue date:	2010-08-19
CVE Names:	CVE-2010-0431 CVE-2010-0435 CVE-2010-2784

It was found that QEMU-KVM on the host did not validate all pointersprovided from a guest system's QXL graphics card driver. A privileged
guest user could use this flaw to cause the host to dereference an
invalid pointer, causing the guest to crash (denial of service) or,
possibly, resulting in the privileged guest user escalating their
privileges on the host. (CVE-2010-0431)

A flaw was found in QEMU-KVM, allowing the guest some control over the
index used to access the callback array during sub-page MMIO
initialization. A privileged guest user could use this flaw to crash the
guest (denial of service) or, possibly, escalate their privileges on the
host. (CVE-2010-2784)

A NULL pointer dereference flaw was found when the host system had a
processor with the Intel VT-x extension enabled. A privileged guest user
could use this flaw to trick the host into emulating a certain
instruction, which could crash the host (denial of service). (CVE-2010-0435)

This update also fixes the following bugs:

* running a "qemu-img" check on a faulty virtual machine image ended
with a segmentation fault. With this update, the segmentation fault no
longer occurs when running the "qemu-img" check. (BZ#610342)

* when attempting to transfer a file between two guests that were joined
in the same virtual LAN (VLAN), the receiving guest unexpectedly quit.
With this update, the transfer completes successfully. (BZ#610343)

* installation of a system was occasionally failing in KVM. This was
caused by KVM using wrong permissions for large guest pages. With this
update, the installation completes successfully. (BZ#616796)

* previously, the migration process would fail for a virtual machine
because the virtual machine could not map all the memory. This was
caused by a conflict that was initiated when a virtual machine was
initially run and then migrated right away. With this update, the
conflict no longer occurs and the migration process no longer fails.
(BZ#618205)

* using a thinly provisioned VirtIO disk on iSCSI storage and performing
a "qemu-img" check during an "e_no_space" event returned cluster errors.
With this update, the errors no longer appear. (BZ#618206)

NOTE: The following procedure must be performed before this update will
take effect:

1) Stop all KVM guest virtual machines.

2) Either reboot the hypervisor machine or, as the root user, remove
(using "modprobe -r [module]") and reload (using "modprobe [module]")
all of the following modules which are currently running (determined
using "lsmod"): kvm, ksm, kvm-intel or kvm-amd.

3) Restart the KVM guest virtual machines.

SL 5.x

 SRPMS:
kvm-83-164.el5_5.21.src.rpm
 x86_64:
kmod-kvm-83-164.el5_5.21.x86_64.rpm
kvm-83-164.el5_5.21.x86_64.rpm
kvm-qemu-img-83-164.el5_5.21.x86_64.rpm
kvm-tools-83-164.el5_5.21.x86_64.rpm
 Dependancies for SL 50-53:
celt051-0.5.1.3-0.el5.i386.rpm
celt051-0.5.1.3-0.el5.x86_64.rpm
celt051-devel-0.5.1.3-0.el5.i386.rpm
celt051-devel-0.5.1.3-0.el5.x86_64.rpm
etherboot-pxes-5.4.4-13.el5.x86_64.rpm
etherboot-roms-5.4.4-13.el5.x86_64.rpm
etherboot-roms-kvm-5.4.4-13.el5.x86_64.rpm
etherboot-zroms-5.4.4-13.el5.x86_64.rpm
etherboot-zroms-kvm-5.4.4-13.el5.x86_64.rpm
log4cpp-1.0-9.el5.i386.rpm
log4cpp-1.0-9.el5.x86_64.rpm
log4cpp-devel-1.0-9.el5.i386.rpm
log4cpp-devel-1.0-9.el5.x86_64.rpm
log4cpp-docs-1.0-9.el5.x86_64.rpm
qcairo-1.8.7.1-3.el5.i386.rpm
qcairo-1.8.7.1-3.el5.x86_64.rpm
qcairo-devel-1.8.7.1-3.el5.i386.rpm
qcairo-devel-1.8.7.1-3.el5.x86_64.rpm
qffmpeg-devel-0.4.9-0.15.20080908.el5.i386.rpm
qffmpeg-devel-0.4.9-0.15.20080908.el5.x86_64.rpm
qffmpeg-libs-0.4.9-0.15.20080908.el5.i386.rpm
qffmpeg-libs-0.4.9-0.15.20080908.el5.x86_64.rpm
qpixman-0.13.3-4.el5.i386.rpm
qpixman-0.13.3-4.el5.x86_64.rpm
qpixman-devel-0.13.3-4.el5.i386.rpm
qpixman-devel-0.13.3-4.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson