Stay Secure with the Latest Linux Advisories

security advisorysecurity fiximportant security update

Red Hat OpenStack 13 RHSA-2018:2228-01 Important QEMU-KVM-RHEV Security Fix

An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: qemu-kvm-rhev security update Advisory ID: RHSA-2018:2228-01 Product: Red Hat Enterprise Linux OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:2228 Issue date: 2018-07-19 CVE Names: CVE-2018-3639 ==================================================================== 1. Summary: An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 13. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 13.0 - ppc64le, x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit(retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue. Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation that includes support for guests running on hosts with AMD processors. For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6. Package List: Red Hat OpenStack Platform 13.0: Source: qemu-kvm-rhev-2.10.0-21.el7_5.4.src.rpm ppc64le: qemu-img-rhev-2.10.0-21.el7_5.4.ppc64le.rpm qemu-kvm-common-rhev-2.10.0-21.el7_5.4.ppc64le.rpm qemu-kvm-rhev-2.10.0-21.el7_5.4.ppc64le.rpm qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.4.ppc64le.rpm qemu-kvm-tools-rhev-2.10.0-21.el7_5.4.ppc64le.rpm x86_64: qemu-img-rhev-2.10.0-21.el7_5.4.x86_64.rpm qemu-kvm-common-rhev-2.10.0-21.el7_5.4.x86_64.rpm qemu-kvm-rhev-2.10.0-21.el7_5.4.x86_64.rpm qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.4.x86_64.rpm qemu-kvm-tools-rhev-2.10.0-21.el7_5.4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-3639 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/ssbd 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version:GnuPG v1 iQIVAwUBW1CXw9zjgjWX9erEAQjj5RAAjFfXwBm8XnkADwiFPeQWoM3mP0v6lfsy JAYqiefKwekzv1TY+yXw64sE0wjRNNLNVBeH94495s4+VtIr/RLRkf/r5L5R4jvp pvDdDZaXumJif6bE0hJ6WLKN5vs0qACGg6eM2zh1fCXH4YuE2cpzZm2NASMiytrx cd87IgZUtvQtzC3DRNYSLytDbwLo6sA8BBeuvvF+8M0fd+wpY0OqpTVc8/RsyEkx cbRYXY643tDDnudxKXr+t1D6I30MB4oYmyrIl/ssGUnVO3tUKUOl1G1dcgS+WwOr MaCcF0tc0hD6vOthyReaw+ciyjsoseEb7rrN/t4I1xUuVwyZ3TcvMOAqgeD9z8gk QZDJr7wHvJDbRBTcvhjPhWw44nxePpExe4PLjTadLxuarHxMC9vAE2jQREAy0EZb IjF8Qi8d0fhmsPCVCN1u06E77x34FVwNaza6WE0Sc3OtRMHnd2h3LQjC0XXlebeL ffS9Q36DoFDzSGZQMmXKUx0FVlQ8IcSZWjXCMcrYG71Eh7hTx4eAzeh32ULW14iV Den3t50ixeGjnVxkB27tRC7PgkGWtXEyU/T8EQIMsXl0ljhHhg2ZLFw8mMN1we90 bzYdALUlQnDerfHNKb+i/J/9RwMqwyLXFiW/GR8OLH1hvM0OGm2hwWlt/suPq9ud 8UMfra8FvJA=kVcy -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical security bulletin issues imperative qemu-kvm-rhev patch for Red Hat OpenStack. Learn about crucial resolutions and information today.. Red Hat OpenStack Security,qemu-kvm-rhev Update,Important Security Update,OpenStack Advisory,Cache Side-Channel. . Severity: Important. LinuxSecurity.com Team

Jul 19, 2018 •Important Red Hat