Red Hat Security Advisory

RHSA-2018:1396

libvirt security and bug fix update

Released 2018-05-14 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4, libvirt-daemon-3.9.0-14.el7_5.4 +20
Red Hat Enterprise Linux Client Optional (v. 7) libvirt-admin-3.9.0-14.el7_5.4, libvirt-daemon-lxc-3.9.0-14.el7_5.4, libvirt-devel-3.9.0-14.el7_5.4 +4
Red Hat Enterprise Linux ComputeNode (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4, libvirt-libs-3.9.0-14.el7_5.4
Red Hat Enterprise Linux ComputeNode Optional (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-admin-3.9.0-14.el7_5.4, libvirt-daemon-3.9.0-14.el7_5.4 +25
Red Hat Enterprise Linux Server (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4.ppc +25
Red Hat Enterprise Linux Server Optional (v. 7) libvirt-admin-3.9.0-14.el7_5.4, libvirt-daemon-lxc-3.9.0-14.el7_5.4, libvirt-lock-sanlock-3.9.0-14.el7_5.4 +3
Red Hat Enterprise Linux Workstation (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4, libvirt-daemon-3.9.0-14.el7_5.4 +22
Red Hat Enterprise Linux Workstation Optional (v. 7) libvirt-admin-3.9.0-14.el7_5.4, libvirt-daemon-lxc-3.9.0-14.el7_5.4, libvirt-lock-sanlock-3.9.0-14.el7_5.4 +2
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4, libvirt-daemon-3.9.0-14.el7_5.4 +20
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) libvirt-3.9.0-14.el7_5.4, libvirt-admin-3.9.0-14.el7_5.4, libvirt-client-3.9.0-14.el7_5.4 +25

Fixes 2 records

TI-2018-04154 CVE-2018-5748 · GHSA-vgrm-6fx3-7frj

qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory…

LOW 39

qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03175 Published 2018-01-25 Fixed CWE-400

TI-2018-00984 CVE-2018-1064 · GHSA-r8xf-5287-837j

Uncontrolled resource consumption in libvirt

LOW 38

libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now also triggered via QEMU guest agent.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02855 Published 2018-03-28 Fixed in 4.2.0-rc1 CWE-400