Summary
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
* QEMU: SR-IOV: improper validation of NumVFs leads to buffer overflow (CVE-2024-26327)
* QEMU: virtio: DMA reentrancy issue leads to double free vulnerability (CVE-2024-3446)
* QEMU: Denial of Service via Improper Synchronization in QEMU NBD Server During Socket Closure (CVE-2024-7409)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | qemu-guest-agent | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-img | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-audio-pa | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-block-blkio | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-block-curl | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-block-rbd | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-common | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-core | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu-ccw | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-gpu-pci | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-display-virtio-vga | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-usb-host | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-device-usb-redirect | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-docs | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-tools | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-ui-egl-headless | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-kvm-ui-opengl | 17:9.0.0-10.el9_5 |
| AlmaLinux · 9 | qemu-pr-helper | 17:9.0.0-10.el9_5 |
Vulnerabilities 3
-
High 8.2
Qemu: virtio: dma reentrancy issue leads to double free vulnerability
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to…
-
High 7.5
Qemu: denial of service via improper synchronization in qemu nbd server during socket closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
-
Medium 5.3
An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-26327
-
report
https://access.redhat.com/security/cve/CVE-2024-3446
-
report
https://access.redhat.com/security/cve/CVE-2024-7409
-
report
https://bugzilla.redhat.com/2264844
-
report
https://bugzilla.redhat.com/2274211
-
report
https://bugzilla.redhat.com/2302487
-
advisory
https://errata.almalinux.org/9/ALSA-2024-9136.html