====================================================================                   Red Hat Security Advisory

Synopsis:          Important: qemu-kvm security, bug fix, and enhancement update
Advisory ID:       RHSA-2011:0534-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2011:0534.html
Issue date:        2011-05-19
CVE Names:         CVE-2011-1750 CVE-2011-1751 
====================================================================
1. Summary:

Updated qemu-kvm packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - x86_64
Red Hat Enterprise Linux Workstation (v. 6) - x86_64

3. Description:

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component
for running virtual machines using KVM.

It was found that the virtio-blk driver in qemu-kvm did not properly
validate read and write requests from guests. A privileged guest user could
use this flaw to crash the guest or, possibly, execute arbitrary code on
the host. (CVE-2011-1750)

It was found that the PIIX4 Power Management emulation layer in qemu-kvm
did not properly check for hot plug eligibility during device removals. A
privileged guest user could use this flaw to crash the guest or, possibly,
execute arbitrary code on the host. (CVE-2011-1751)

Red Hat would like to thank Nelson Elhage for reporting CVE-2011-1751.

This update also fixes several bugs and adds various enhancements.
Documentation for these bug fixes and enhancements will be available
shortly from the Technical Notes document, linked to in the References
section.

All users of qemu-kvm should upgrade to these updated packages, which
contain backported patches to resolve these issues, and fix the bugs and
add the enhancements noted in the Technical Notes. After installing this
update, shut down all running virtual machines. Once all virtual machines
have shut down, start them again for this update to take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

482427 - support high resolutions
581750 - Vhost: Segfault when assigning a none vhostfd
596610 - "Guest moved used index from 0 to 61440" if remove virtio serial device before virtserialport
599307 - info snapshot return "bdrv_snapshot_list: error -95"
602205 - Could not ping guest successfully after changing e1000 MTU
603413 - RHEL3.9 guest netdump hung with e1000
604992 - index is empty in qemu-doc.html
607598 - Incorrect & misleading error reporting when failing to open a drive due to block driver whitelist denial
608548 - QEMU doesn't respect hardware sector size of underlying block device when doing O_DIRECT
609016 - incorrect committed memory on idle host
613893 - [RFE] qemu-io enable truncate function for qcow2.
615947 - RFE QMP: support of query spice for guest
616187 - vmware device emulation enabled but not supported
616659 - mrg buffers: migration breaks between systems with/without vhost
616703 - qemu-kvm core dump with virtio-serial-pci max-port greater than 31
617119 - Qemu becomes unresponsive during unattended_installation
619168 - qemu should more clearly indicate internal detection of this host out-of-memory condition at startup..
619259 - qemu "-cpu [check | enforce ]" should work even when a model name is not specified on the command line
623552 - SCP image fails from host to guest with vhost on when do migration
623735 - hot unplug of vhost net virtio NIC causes qemu segfault
624396 - migration failed after hot-unplug virtserialport - Unknown savevm section or instance '0000:00:07.0/virtio-console' 0
624572 - time drift after guest running for more than 12 hours624607 - [qemu] [rhel6] guest installation stop (pause) on 'eother' event over COW disks (thin-provisioning)
624721 - [qemu] [rhel6] bad error handling when qemu has no 'read' permissions over {kernel,initrd} files [pass boot options]
624767 - Replace virtio-net TX timer mitigation with bottom half handler
624790 - pass through fails with KVM using Neterion Inc's X3100 Series 10GbE PCIe I/O Virtualized Server Adapter in Multifunction mode.
625319 - Failed to update the media in floppy device
625333 - qemu treatment of -nodefconfig and -readconfig problematic for debug
625681 - RFE QMP: should have command to disconnect and connect network card for whql testing
625948 - qemu exits when hot adding rtl8139 nic to win2k8 guest
628634 - vhost_net: untested error handling in vhost_net_start
631522 - spice: prepare qxl for 6.1 update.
632257 - Duplicate CPU fea.tures in cpu-x86_64.conf
632458 - Guest may core dump when booting with spice and qxl.
632722 - [6.1 FEAT] QEMU static tracing framework
633394 - [6.1 FEAT] virtio-blk ioeventfd support
633699 - Cannot hot-plug nic in windows VM when the vmem is larger
634153 - coredumped when enable qxl without spice
635354 - Can not commit copy-on-write image's data to raw backing-image
635418 - Allow enable/disable ksm per VM
635527 - KVM:qemu-img re-base poor performance(on local storage) when snapshot to a new disk
635954 - RFE: Assigned device should block migration
636494 - -cpu check  does not correctly enforce CPUID items
637180 - watchdog timer isn't reset when qemu resets
637976 - ksmtuned: give a nicer message if retune is called while ksmtuned is off
638468 - [qemu-kvm] bochs vga lfb @ 0xe0000000 causes trouble for hot-plug
639437 - Incorrect russian vnc keymap
641127 - qemu-img ignores close() errors642131 - qemu-kvm aborts of 'qemu_spice_display_create_update: unhandled depth: 0 bits'
643681 - Do not advertise boot=on capability to libvirt
643687 - Allow to specify boot order on qemu command line.
643970 - guest migration turns failed by the end (16G + stress load)
645342 - Implement QEMU driver for modern sound device like Intel HDA
647307 - Support slow mapping of PCI Bars647308 - Support Westmere as a CPU model or included within existing models..
647447 - QMP:  provide a hmp_passthrough command to allow execution of non-converted commands
647865 - support 2560x1440 in qxl
648333 - TCP checksum overflows in qemu's e1000 emulation code when TSO is enabled in guest OS
653582 - Changing media with -snapshot deletes image file
653972 - qcow2: Backport performance related patches
655735 - qemu-kvm (or libvirt?) permission denied errors when exporting readonly IDE disk to guest
656198 - Can only see 16 virtio ports while assigned 30 virtio serial ports on commandLine
658288 - Include (disabled by default) -fake-machine patch on qemu-kvm RPM spec
662633 - Fix build problem with recent compilers662701 - Option -enable-kvm should exit when KVM is unavailable
665025 - lost double clicks on slow connections
665299 - load vhost-net by default
667188 - device-assignment leaks option ROM memory
669268 - WinXP hang when reboot after setup copies files to the installation folders670539 - Block devices don't implement correct flush error handling
670787 - Hot plug the 14st VF to guest causes guest shut down
671100 - possible migration failure due to erroneous interpretation of subsection
672187 - Improper responsive message when shrinking qcow2 image
672191 - spicevmc: flow control on the spice agent channel is missing in both directions
672229 - romfile memory leak
672441 - Tracetool autogenerate qemu-kvm.stp with wrong qemu-kvm path
672720 - getting 'ctrl buffer too small' error on USB passthrough
674539 - slow guests block other guests on the same lan
674562 - disable vhost-net for rhel5 and older guests
675229 - Install of cpu-x86_64.conf bombs for an out of tree build..
676015 - set_link  off not working with vhost-net
676529 - core dumped when save snapshot to non-exist disk
677222 - segment fault happens after hot drive add then drive delete
677712 - disabling vmware device emulation breaks old->new migration
678208 - qemu-kvm hangs when installing guest with -spice option
678524 - Exec based migration randomly fails, particularly under high load
680058 - can't hotplug second vf successful with message "Too many open files"
681777 - floppy I/O error after live migration while floppy in use
683295 - qemu-kvm: Invalid parameter 'vhostforce'
684076 - Segfault occurred during migration
685147 - guest with assigned nic got kernel panic when send system_reset signal in QEMU monitor
688058 - Drive serial number gets truncated
688119 - qcow2: qcow2_open doesn't return useful errors688146 - qcow2: Some paths fail to handle I/O errors688147 - qcow2: Reads fail with backing file smaller than snapshot
688428 - qemu-kvm -no-kvm segfaults on pci_add
688572 - spice-server does not switch back to server mouse mode if guest spice-agent dies.
690267 - Backport qemu_get_ram_ptr() performance improvement
693741 - qemu-img re-base  fail with read-only new backing file
694095 - Migration fails when migrate guest from RHEL6.1 host to RHEL6 host with the same libvirt version
694196 - RHEL 6.1 qemu-kvm: Specifying ipv6 addresses breaks migration
698906 - CVE-2011-1750 virtio-blk: heap buffer overflow caused by unaligned requests
699773 - CVE-2011-1751 qemu: acpi_piix4: missing hotplug check during device removal

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:

x86_64:
qemu-img-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:

x86_64:
qemu-img-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:

x86_64:
qemu-img-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:

x86_64:
qemu-img-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package

7. References:

https://www.redhat.com/security/data/cve/CVE-2011-1750.html
https://www.redhat.com/security/data/cve/CVE-2011-1751.html
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/search/

8. Contact:

The Red Hat security contact is .  More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2011 Red Hat, Inc.

Red Hat: 2011:0534-01: qemu-kvm: Important Advisory

Updated qemu-kvm packages that fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6

Summary

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.
It was found that the virtio-blk driver in qemu-kvm did not properly validate read and write requests from guests. A privileged guest user could use this flaw to crash the guest or, possibly, execute arbitrary code on the host. (CVE-2011-1750)
It was found that the PIIX4 Power Management emulation layer in qemu-kvm did not properly check for hot plug eligibility during device removals. A privileged guest user could use this flaw to crash the guest or, possibly, execute arbitrary code on the host. (CVE-2011-1751)
Red Hat would like to thank Nelson Elhage for reporting CVE-2011-1751.
This update also fixes several bugs and adds various enhancements. Documentation for these bug fixes and enhancements will be available shortly from the Technical Notes document, linked to in the References section.
All users of qemu-kvm should upgrade to these updated packages, which contain backported patches to resolve these issues, and fix the bugs and add the enhancements noted in the Technical Notes. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Summary

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259

References

https://www.redhat.com/security/data/cve/CVE-2011-1750.html https://www.redhat.com/security/data/cve/CVE-2011-1751.html https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/search/

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source:
x86_64: qemu-img-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
x86_64: qemu-img-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
x86_64: qemu-img-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
x86_64: qemu-img-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-debuginfo-0.12.1.2-2.160.el6.x86_64.rpm qemu-kvm-tools-0.12.1.2-2.160.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package

Severity

Advisory ID: RHSA-2011:0534-01

Product: Red Hat Enterprise Linux

Advisory URL: https://access.redhat.com/errata/RHSA-2011:0534.html

Issued Date: : 2011-05-19

CVE Names: CVE-2011-1750 CVE-2011-1751

Topic

Updated qemu-kvm packages that fix two security issues, several bugs, andadd various enhancements are now available for Red Hat Enterprise Linux 6.The Red Hat Security Response Team has rated this update as havingimportant security impact. Common Vulnerability Scoring System (CVSS) basescores, which give detailed severity ratings, are available for eachvulnerability from the CVE links in the References section.

Topic

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - x86_64

Red Hat Enterprise Linux Workstation (v. 6) - x86_64

Bugs Fixed

482427 - support high resolutions

581750 - Vhost: Segfault when assigning a none vhostfd

596610 - "Guest moved used index from 0 to 61440" if remove virtio serial device before virtserialport

599307 - info snapshot return "bdrv_snapshot_list: error -95"

602205 - Could not ping guest successfully after changing e1000 MTU

603413 - RHEL3.9 guest netdump hung with e1000

604992 - index is empty in qemu-doc.html

607598 - Incorrect & misleading error reporting when failing to open a drive due to block driver whitelist denial

608548 - QEMU doesn't respect hardware sector size of underlying block device when doing O_DIRECT

609016 - incorrect committed memory on idle host

613893 - [RFE] qemu-io enable truncate function for qcow2.

615947 - RFE QMP: support of query spice for guest

616187 - vmware device emulation enabled but not supported

616659 - mrg buffers: migration breaks between systems with/without vhost

616703 - qemu-kvm core dump with virtio-serial-pci max-port greater than 31

617119 - Qemu becomes unresponsive during unattended_installation

619168 - qemu should more clearly indicate internal detection of this host out-of-memory condition at startup..

619259 - qemu "-cpu [check | enforce ]" should work even when a model name is not specified on the command line

623552 - SCP image fails from host to guest with vhost on when do migration

623735 - hot unplug of vhost net virtio NIC causes qemu segfault

624396 - migration failed after hot-unplug virtserialport - Unknown savevm section or instance '0000:00:07.0/virtio-console' 0

624572 - time drift after guest running for more than 12 hours624607 - [qemu] [rhel6] guest installation stop (pause) on 'eother' event over COW disks (thin-provisioning)

624721 - [qemu] [rhel6] bad error handling when qemu has no 'read' permissions over {kernel,initrd} files [pass boot options]

624767 - Replace virtio-net TX timer mitigation with bottom half handler

624790 - pass through fails with KVM using Neterion Inc's X3100 Series 10GbE PCIe I/O Virtualized Server Adapter in Multifunction mode.

625319 - Failed to update the media in floppy device

625333 - qemu treatment of -nodefconfig and -readconfig problematic for debug

625681 - RFE QMP: should have command to disconnect and connect network card for whql testing

625948 - qemu exits when hot adding rtl8139 nic to win2k8 guest

628634 - vhost_net: untested error handling in vhost_net_start

631522 - spice: prepare qxl for 6.1 update.

632257 - Duplicate CPU fea.tures in cpu-x86_64.conf

632458 - Guest may core dump when booting with spice and qxl.

632722 - [6.1 FEAT] QEMU static tracing framework

633394 - [6.1 FEAT] virtio-blk ioeventfd support

633699 - Cannot hot-plug nic in windows VM when the vmem is larger

634153 - coredumped when enable qxl without spice

635354 - Can not commit copy-on-write image's data to raw backing-image

635418 - Allow enable/disable ksm per VM

635527 - KVM:qemu-img re-base poor performance(on local storage) when snapshot to a new disk

635954 - RFE: Assigned device should block migration

636494 - -cpu check does not correctly enforce CPUID items

637180 - watchdog timer isn't reset when qemu resets

637976 - ksmtuned: give a nicer message if retune is called while ksmtuned is off

638468 - [qemu-kvm] bochs vga lfb @ 0xe0000000 causes trouble for hot-plug

639437 - Incorrect russian vnc keymap

641127 - qemu-img ignores close() errors642131 - qemu-kvm aborts of 'qemu_spice_display_create_update: unhandled depth: 0 bits'

643681 - Do not advertise boot=on capability to libvirt

643687 - Allow to specify boot order on qemu command line.

643970 - guest migration turns failed by the end (16G + stress load)

645342 - Implement QEMU driver for modern sound device like Intel HDA

647307 - Support slow mapping of PCI Bars647308 - Support Westmere as a CPU model or included within existing models..

647447 - QMP: provide a hmp_passthrough command to allow execution of non-converted commands

647865 - support 2560x1440 in qxl

648333 - TCP checksum overflows in qemu's e1000 emulation code when TSO is enabled in guest OS

653582 - Changing media with -snapshot deletes image file

653972 - qcow2: Backport performance related patches

655735 - qemu-kvm (or libvirt?) permission denied errors when exporting readonly IDE disk to guest

656198 - Can only see 16 virtio ports while assigned 30 virtio serial ports on commandLine

658288 - Include (disabled by default) -fake-machine patch on qemu-kvm RPM spec

662633 - Fix build problem with recent compilers662701 - Option -enable-kvm should exit when KVM is unavailable

665025 - lost double clicks on slow connections

665299 - load vhost-net by default

667188 - device-assignment leaks option ROM memory

669268 - WinXP hang when reboot after setup copies files to the installation folders670539 - Block devices don't implement correct flush error handling

670787 - Hot plug the 14st VF to guest causes guest shut down

671100 - possible migration failure due to erroneous interpretation of subsection

672187 - Improper responsive message when shrinking qcow2 image

672191 - spicevmc: flow control on the spice agent channel is missing in both directions

672229 - romfile memory leak

672441 - Tracetool autogenerate qemu-kvm.stp with wrong qemu-kvm path

672720 - getting 'ctrl buffer too small' error on USB passthrough

674539 - slow guests block other guests on the same lan

674562 - disable vhost-net for rhel5 and older guests

675229 - Install of cpu-x86_64.conf bombs for an out of tree build..

676015 - set_link off not working with vhost-net

676529 - core dumped when save snapshot to non-exist disk

677222 - segment fault happens after hot drive add then drive delete

677712 - disabling vmware device emulation breaks old->new migration

678208 - qemu-kvm hangs when installing guest with -spice option

678524 - Exec based migration randomly fails, particularly under high load

680058 - can't hotplug second vf successful with message "Too many open files"

681777 - floppy I/O error after live migration while floppy in use

683295 - qemu-kvm: Invalid parameter 'vhostforce'

684076 - Segfault occurred during migration

685147 - guest with assigned nic got kernel panic when send system_reset signal in QEMU monitor

688058 - Drive serial number gets truncated

688119 - qcow2: qcow2_open doesn't return useful errors688146 - qcow2: Some paths fail to handle I/O errors688147 - qcow2: Reads fail with backing file smaller than snapshot

688428 - qemu-kvm -no-kvm segfaults on pci_add

688572 - spice-server does not switch back to server mouse mode if guest spice-agent dies.

690267 - Backport qemu_get_ram_ptr() performance improvement

693741 - qemu-img re-base fail with read-only new backing file

694095 - Migration fails when migrate guest from RHEL6.1 host to RHEL6 host with the same libvirt version

694196 - RHEL 6.1 qemu-kvm: Specifying ipv6 addresses breaks migration

698906 - CVE-2011-1750 virtio-blk: heap buffer overflow caused by unaligned requests

699773 - CVE-2011-1751 qemu: acpi_piix4: missing hotplug check during device removal