Red Hat Security AdvisoryRHSA-2019:2425
qemu-kvm-rhev security and bug fix update
Released 2019-08-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 10.0 qemu-img-rhev-10:2.12.0-33.el7, qemu-kvm-common-rhev-10:2.12.0-33.el7, qemu-kvm-rhev-10:2.12.0-33.el7 +1
- Red Hat OpenStack Platform 13.0 qemu-img-rhev-10:2.12.0-33.el7, qemu-kvm-common-rhev-10:2.12.0-33.el7, qemu-kvm-rhev-10:2.12.0-33.el7 +1
- Red Hat OpenStack Platform 14.0 qemu-img-rhev-10:2.12.0-33.el7, qemu-kvm-common-rhev-10:2.12.0-33.el7, qemu-kvm-rhev-10:2.12.0-33.el7 +1
Fixes 6 records
Priority MEDIUM 50
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04653 · Published 2018-10-09 · Partial fix CWE-190
Priority MEDIUM 48
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06288 · Published 2018-10-09 · Partial fix CWE-190
Priority LOW 35
In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0061 · Published 2019-03-17 · Partial fix CWE-787
Priority LOW 26
In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read operations.
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00556 · Published 2019-03-17 · Partial fix CWE-125
Priority LOW 25
tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure.
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00515 · Published 2019-06-03 · Partial fix CWE-908
Priority LOW 25
qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by leveraging mishandling of the seccomp policy for threads other than the main thread.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.005 · Published 2018-08-29 · Partial fix
THREATIST.IORead the docs