Skip to content
OpenAdvisories
High ELSA-2019-4713 5 CVEs

Important: qemu security update (Oracle Linux 7)

Published Jul 10, 2019 · Updated Jul 10, 2019

Summary

[15:3.1.0-5.el7]
- Only enable the halt poll control MSR if it is supported by the host (Mark
Kanda) [Orabug: 29946722]

[15:3.1.0-4.el7]
- kvm: i386: halt poll control MSR support (Marcelo Tosatti) [Orabug: 29933278]
- Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda) [Orabug: 29886908] {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
- pvrdma: release device resources in case of an error (Prasad J Pandit) [Orabug: 29056678] {CVE-2018-20123}
- qxl: check release info object (Prasad J Pandit) [Orabug: 29886906] {CVE-2019-12155}
- target/i386: add MDS-NO feature (Paolo Bonzini) [Orabug: 29820428] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
- docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrange) [Orabug: 29820428] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
- target/i386: define md-clear bit (Paolo Bonzini) [Orabug: 29820428] {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
- pvh: block migration if booting using PVH (Liam Merwick) [Orabug: 29796676]
- hw/i386/pc: run the multiboot loader before the PVH loader (Stefano Garzarella) [Orabug: 29796676]
- optionrom/pvh: load initrd from fw_cfg (Stefano Garzarella) [Orabug: 29796676]
- hw/i386/pc: use PVH option rom (Stefano Garzarella) [Orabug: 29796676]
- qemu.spec: add pvh.bin to %files (Liam Merwick) [Orabug: 29796676]
- optionrom: add new PVH option rom (Stefano Garzarella) [Orabug: 29796676]
- linuxboot_dma: move common functions in a new header (Stefano Garzarella) [Orabug: 29796676]
- linuxboot_dma: remove duplicate definitions of FW_CFG (Stefano Garzarella) [Orabug: 29796676]
- pvh: load initrd and expose it through fw_cfg (Stefano Garzarella) [Orabug: 29796676]
- pvh: Boot uncompressed kernel using direct boot ABI (Liam Merwick) [Orabug: 29796676]
- pvh: Add x86/HVM direct boot ABI header file (Liam Merwick) [Orabug: 29796676]
- elf-ops.h: Add get_elf_note_type() (Liam Merwick) [Orabug: 29796676]
- elf: Add optional function ptr to load_elf() to parse ELF notes (Liam Merwick) [Orabug: 29796676]

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 7 ivshmem-tools 15:3.1.0-5.el7
Oracle Linux · 7 qemu 15:3.1.0-5.el7
Oracle Linux · 7 qemu-block-gluster 15:3.1.0-5.el7
Oracle Linux · 7 qemu-block-iscsi 15:3.1.0-5.el7
Oracle Linux · 7 qemu-block-rbd 15:3.1.0-5.el7
Oracle Linux · 7 qemu-common 15:3.1.0-5.el7
Oracle Linux · 7 qemu-img 15:3.1.0-5.el7
Oracle Linux · 7 qemu-kvm 15:3.1.0-5.el7
Oracle Linux · 7 qemu-kvm-core 15:3.1.0-5.el7
Oracle Linux · 7 qemu-system-aarch64 15:3.1.0-5.el7
Oracle Linux · 7 qemu-system-aarch64-core 15:3.1.0-5.el7
Oracle Linux · 7 qemu-system-x86 15:3.1.0-5.el7
Oracle Linux · 7 qemu-system-x86-core 15:3.1.0-5.el7

Vulnerabilities 5

  • Unscored —

    Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to ca…

  • Unscored —

    Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature i…

  • Unscored —

    The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows…

  • Unscored —

    pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.

  • Unscored —

    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.