Summary
[15:3.0.0-1.el7]
- net: ignore packet size greater than INT_MAX (Jason Wang) [Orabug: 28763782] {CVE-2018-17963}
- pcnet: fix possible buffer overflow (Jason Wang) [Orabug: 28763774] {CVE-2018-17962}
- rtl8139: fix possible out of bound access (Jason Wang) [Orabug: 28763765] {CVE-2018-17958}
- ne2000: fix possible out of bound access in ne2000_receive (Jason Wang) [Orabug: 28763758] {CVE-2018-10839}
- seccomp: set the seccomp filter to all threads (Marc-Andre Lureau) [Orabug: 28763748] {CVE-2018-15746}
- virtio_net: Introduce VIRTIO_NET_F_STANDBY feature bit to virtio_net (Sridhar Samudrala) [Orabug: 28763724]
- kvm: add call to qemu_add_opts() for -overcommit option (Prasad Singamsetty)
- Document various CVEs as fixed (Mark Kanda) [Orabug: 28763710] {CVE-2017-10806} {CVE-2017-11334} {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038} {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381} {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}
- qemu.spec: Initial qemu.spec (Mark Kanda)
- virtio-pci: Set subsystem vendor ID to Oracle (Mark Kanda)
- qemu_regdump.py: Initial qemu_regdump.py (Mark Kanda)
- qmp-regdump: Initial qmp-regdump (Mark Kanda)
- bridge.conf: Initial bridge.conf (Mark Kanda)
- kvm.conf: Initial kvm.conf (Mark Kanda)
- 80-kvm.rules: Initial 80-kvm.rules (Mark Kanda)
- Update version for v3.0.0 release (Peter Maydell)
- Update version for v3.0.0-rc4 release (Peter Maydell)
- virtio-gpu: fix crashes upon warm reboot with vga mode (Marc-Andre Lureau)
- slirp: Correct size check in m_inc() (Peter Maydell)
- target/xtensa/cpu: Set owner of memory region in xtensa_cpu_initfn (Thomas Huth)
- hw/intc/arm_gicv3_common: Move gicd shift bug handling to gicv3_post_load (Peter Maydell)
- hw/intc/arm_gicv3_common: Move post_load hooks to top-level VMSD (Peter Maydell)
- target/arm: Add dummy needed functions to M profile vmstate subsections (Peter Maydell)
- hw/intc/arm_gicv3_common: Combine duplicate .subsections in vmstate_gicv3_cpu (Peter Maydell)
- hw/intc/arm_gicv3_common: Give no-migration-shift-bug subsection a needed function (Peter Maydell)
- tcg/optimize: Do not skip default processing of dup_vec (Richard Henderson)
- tests/acpi: update tables after memory hotplug changes (Michael S. Tsirkin)
- pc: acpi: fix memory hotplug regression by reducing stub SRAT entry size (Igor Mammedov)
- tests/acpi-test: update ACPI tables test blobs (Dou Liyang)
- hw/acpi-build: Add a check for memory-less NUMA nodes (Dou Liyang)
- vhost: check region type before casting (Tiwei Bie)
- sam460ex: Fix PCI interrupts with multiple devices (BALATON Zoltan)
- hw/misc/macio: Fix device introspection problems in macio devices (Thomas Huth)
- Update version for v3.0.0-rc3 release (Peter Maydell)
- monitor: temporary fix for dead-lock on event recursion (Marc-Andre Lureau)
- linux-user: ppc64: dont use volatile register during safe_syscall (Shivaprasad G Bhat)
- tests: add check_invalid_maps to test-mmap (Alex Bennee)
- linux-user/mmap.c: handle invalid len maps correctly (Alex Bennee)
- s390x/sclp: fix maxram calculation (Christian Borntraeger)
- target/arm: Remove duplicate 'host' entry in '-cpu ?' output (Philippe Mathieu-Daude)
- hw/misc/tz-mpc: Zero the LUT on initialization, not just reset (Peter Maydell)
- hw/arm/iotkit: Fix IRQ number for timer1 (Peter Maydell)
- armv7m_nvic: Fix m-security subsection name (Peter Maydell)
- hw/arm/sysbus-fdt: Fix assertion in copy_properties_from_host() (Geert Uytterhoeven)
- arm/smmuv3: Fix missing VMSD terminator (Dr. David Alan Gilbert)
- qemu-iotests: Test query-blockstats with -drive and -blockdev (Kevin Wolf)
- block/qapi: Include anonymous BBs in query-blockstats (Kevin Wolf)
- block/qapi: Add 'qdev' field to query-blockstats result (Kevin Wolf)
- file-posix: Fix write_zeroes with unmap on block devices (Kevin Wolf)
- block: Fix documentation for BDRV_REQ_MAY_UNMAP (Kevin Wolf)
- iotests: Add test for 'qemu-img convert -C' compatibility (Fam Zheng)
- qemu-img: Add -C option for convert with copy offloading (Fam Zheng)
- Revert 'qemu-img: Document copy offloading implications with -S and -c' (Fam Zheng)
- iotests: Dont lock /dev/null in 226 (Fam Zheng)
- docs: Describe using images in writing iotests (Fam Zheng)
- file-posix: Handle EINTR in preallocation=full write (Fam Zheng)
- qcow2: A grammar fix in conflicting cache sizing error message (Leonid Bloch)
- qcow: fix a reference leak (KONRAD Frederic)
- backends/cryptodev: remove dead code (Jay Zhou)
- timer: remove replay clock probe in deadline calculation (Pavel Dovgalyuk)
- i386: implement MSR_SMI_COUNT for TCG (Paolo Bonzini)
- i386: do not migrate MSR_SMI_COUNT on machine types <2.12 (Paolo Bonzini)
- qstring: Move qstring_from_substr()s @end one to the right (Markus Armbruster)
- qstring: Assert size calculations dont overflow (Markus Armbruster)
- qstring: Fix qstring_from_substr() not to provoke int overflow (liujunjie)
- Update version for v3.0.0-rc2 release (Peter Maydell)
- tests: fix TLS handshake failure with TLS 1.3 (Daniel P. Berrange)
- tests: use error_abort in places expecting errors (Daniel P. Berrange)
- tests: dont silence error reporting for all tests (Daniel P. Berrange)
- tests: call qcrypto_init instead of gnutls_global_init (Daniel P. Berrange)
- migration: fix duplicate initialization for expected_downtime and cleanup_bh (Lidong Chen)
- tests: only update last_byte when at the edge (Peter Xu)
- migration: disallow recovery for release-ram (Peter Xu)
- migration: update recv bitmap only on dest vm (Peter Xu)
- audio/hda: Fix migration (Dr. David Alan G
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | ivshmem-tools | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-block-gluster | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-block-iscsi | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-block-rbd | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-common | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-img | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-kvm | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-kvm-core | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-system-aarch64 | 15:3.0.0-1.el7 |
| Oracle Linux · 7 | qemu-system-aarch64-core | 15:3.0.0-1.el7 |
Vulnerabilities 39
-
High 7.5
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
-
Medium 6.5
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could le…
-
Medium 5.8
The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. …
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of…
-
Medium 5.6
Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disc…
-
Medium 5.5
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD…
-
Medium 5.5
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addre…
-
Medium 5.4
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This fl…
-
Unscored —
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a de…
-
Unscored —
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users…
-
Unscored —
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileg…
-
Unscored —CVE-2017-13672 Public exploit
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to …
-
Unscored —
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used cau…
-
Unscored —
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to …
-
Unscored —
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest …
-
Unscored —
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users …
-
Unscored —
VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory a…
-
Unscored —
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, rel…
-
Unscored —
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denia…
-
Unscored —
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds acc…
-
Unscored —
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error …
-
Unscored —
The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged users to caus…
-
Unscored —
Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of service (Qemu…
-
Unscored —
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerabl…
-
Unscored —
Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable…
-
Unscored —
hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (…
-
Unscored —
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (mem…
-
Unscored —
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged …
-
Unscored —
Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact v…
-
Unscored —
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest …
-
Unscored —
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
-
Unscored —
qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 …
-
Unscored —
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishan…
-
Unscored —
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
-
Unscored —
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause…
-
Unscored —
The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds r…
-
Unscored —
The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute …
-
Unscored —
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged …