-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: qemu-kvm-rhev security, bug fix, and enhancement update
Advisory ID:       RHSA-2016:2705-01
Product:           Red Hat Enterprise Linux OpenStack Platform
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-2705.html
Issue date:        2016-11-14
CVE Names:         CVE-2015-8817 CVE-2015-8818 
=====================================================================

1. Summary:

An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 6.0 (Juno) for RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 - x86_64

3. Description:

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the
user-space component for running virtual machines using KVM in environments
managed by Red Hat Enterprise Virtualization Manager.

The following packages have been upgraded to a newer upstream version:
qemu-kvm-rhev (2.6.0). (BZ#1386379)

Security Fix(es):

* An out-of-bounds flaw was found in the QEMU emulator built using
'address_space_translate' to map an address to a MemoryRegionSection. The
flaw could occur while doing pci_dma_read/write calls, resulting in an
out-of-bounds read-write access error. A privileged user inside a guest
could use this flaw to crash the guest instance (denial of service).
(CVE-2015-8817, CVE-2015-8818)

Red Hat would like to thank Donghai Zdh of Alibaba Inc. for reporting this
issue.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1300771 - CVE-2015-8817 CVE-2015-8818 Qemu: OOB access in address_space_rw leads to segmentation fault
1374368 - RHSA-2016-1756 breaks migration of instances [OSP6]
1386379 - Rebase qemu-kvm-rhev to 2.6.0

6. Package List:

Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7:

Source:
qemu-kvm-rhev-2.6.0-27.el7.src.rpm

x86_64:
qemu-img-rhev-2.6.0-27.el7.x86_64.rpm
qemu-kvm-common-rhev-2.6.0-27.el7.x86_64.rpm
qemu-kvm-rhev-2.6.0-27.el7.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.6.0-27.el7.x86_64.rpm
qemu-kvm-tools-rhev-2.6.0-27.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-8817
https://access.redhat.com/security/cve/CVE-2015-8818
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFYKiC8XlSAg2UNWIIRAr4kAJ9Remx9N4wjGW2mGlK5nsETcsP+NQCcDkNt
+pXlLZuzUOl0dfAI9ea6p48=
=BSaZ
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce