Red Hat Security Advisory

RHSA-2019:1699

redhat-virtualization-host security and enhancement update

Released 2019-07-08 · Red Hat rating Important · View on Red Hat →

Fixed in

RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host-4.3.4-1.el7ev, redhat-virtualization-host-image-update-placeholder-4.3.4-1.el7ev
Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host-4.3.4-20190620.3.el7_6, redhat-virtualization-host-image-update-4.3.4-20190620.3.el7_6

Fixes 7 records

TI-2019-08569 CVE-2019-11477 · GHSA-748j-px2m-cwgh

Integer overflow in TCP_SKB_CB(skb)->tcp_gso_segs

HIGH 78

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.98745 Published 2019-06-18 Fixed in 4.4.182, 4.9.182 +3 CWE-190

TI-2019-08570 CVE-2019-11478 · GHSA-xh2h-cw6h-x9h5

SACK can cause extensive memory use via fragmented resend queue

HIGH 77

Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.94414 Published 2019-06-18 Partial fix · 4.4.182, 4.9.182 +3 CWE-770

TI-2019-08571 CVE-2019-11479 · GHSA-99cq-xr7g-h22w

Resource allocation without limits in Linux kernel

HIGH 76

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.91326 Published 2019-06-18 Partial fix · 4.4.182, 4.9.182 +3 CWE-405

TI-2019-07489 CVE-2019-10168 · GHSA-v3hc-v42h-rp66

Improper access control in libvirt

LOW 35

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00549 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250

TI-2019-07488 CVE-2019-10167 · GHSA-5p5j-3wqp-w634

Improper access control in libvirt

LOW 35

The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00521 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-250

TI-2019-07482 CVE-2019-10161 · GHSA-6cwp-pxj6-56c7

Improper access control in libvirt

LOW 35

It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00516 Published 2019-07-30 Fixed CWE-284

TI-2019-07487 CVE-2019-10166 · GHSA-g9cg-gvh5-48hm

Improper access control in libvirt

LOW 34

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state fil…

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00469 Published 2019-08-02 Fixed in 4.10.1, 5.4.1 CWE-284