Security Fix(es) :

  - Quick emulator (QEMU) built with the Cirrus CLGD 54xx     VGA emulator support is vulnerable to an out-of-bounds     access issue. It could occur while copying VGA data via     bitblt copy in backward mode. A privileged user inside a     guest could use this flaw to crash the QEMU process     resulting in DoS or potentially execute arbitrary code     on the host with privileges of QEMU process on the host.
    (CVE-2017-2615)

  - Quick emulator (QEMU) built with the Cirrus CLGD 54xx     VGA Emulator support is vulnerable to an out-of-bounds     access issue. The issue could occur while copying VGA     data in cirrus_bitblt_cputovideo. A privileged user     inside guest could use this flaw to crash the QEMU     process OR potentially execute arbitrary code on host     with privileges of the QEMU process. (CVE-2017-2620)

This update for xen fixes several issues.

These security issues were fixed :

  - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the     bitblit copy routine cirrus_bitblt_cputovideo failed to     check the memory region, allowing for an out-of-bounds     write that allows for privilege escalation     (bsc#1024834).

  - CVE-2017-2615: An error in the bitblt copy operation     could have allowed a malicious guest administrator to     cause an out of bounds memory access, possibly leading     to information disclosure or privilege escalation     (bsc#1023004).

  - A malicious guest could have, by frequently rebooting     over extended periods of time, run the host system out     of memory, resulting in a Denial of Service (DoS)     (bsc#1022871)

  - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1015169

These non-security issues were fixed :

  - bsc#1000195: Prevent panic on CPU0 while booting on SLES     11 SP3 

  - bsc#1002496: Added support for reloading clvm in     block-dmmd block-dmmd

  - bsc#1005028: Fixed building Xen RPMs from Sources

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2016-10155: The virtual hardware watchdog     'wdt_i6300esb' was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1024183)

  - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the     bitblit copy routine cirrus_bitblt_cputovideo failed to     check the memory region, allowing for an out-of-bounds     write that allows for privilege escalation (bsc#1024834)

  - CVE-2017-2615: An error in the bitblt copy operation     could have allowed a malicious guest administrator to     cause an out of bounds memory access, possibly leading     to information disclosure or privilege escalation     (bsc#1023004)

  - CVE-2014-8106: A heap-based buffer overflow in the     Cirrus VGA emulator allowed local guest users to execute     arbitrary code via vectors related to blit regions     (bsc#907805)

  - CVE-2016-9911: The USB EHCI Emulation support was     vulnerable to a memory leakage issue while processing     packet data in 'ehci_init_transfer'. A guest     user/process could have used this issue to leak host     memory, resulting in DoS for the host (bsc#1014507)

  - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1015169)

  - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support     was vulnerable to a divide by zero issue while copying     VGA data. A privileged user inside guest could have used     this flaw to crash the process instance on the host,     resulting in DoS (bsc#1015169)

  - CVE-2016-10013: Xen allowed local 64-bit x86 HVM guest     OS users to gain privileges by leveraging mishandling of     SYSCALL singlestep during emulation (bsc#1016340).

  - CVE-2016-9932: CMPXCHG8B emulation on x86 systems     allowed local HVM guest OS users to obtain sensitive     information from host stack memory via a     'supposedly-ignored' operand size prefix (bsc#1012651).

  - CVE-2016-9101: A memory leak in hw/net/eepro100.c     allowed local guest OS administrators to cause a denial     of service (memory consumption and QEMU process crash)     by repeatedly unplugging an i8255x (PRO100) NIC device     (bsc#1013668)

  - CVE-2016-9776: The ColdFire Fast Ethernet Controller     emulator support was vulnerable to an infinite loop     issue while receiving packets in 'mcf_fec_receive'. A     privileged user/process inside guest could have used     this issue to crash the Qemu process on the host leading     to DoS (bsc#1013657)

  - A malicious guest could have, by frequently rebooting     over extended periods of time, run the host system out     of memory, resulting in a Denial of Service (DoS)     (bsc#1022871)

  - CVE-2016-10024: Xen allowed local x86 PV guest OS kernel     administrators to cause a denial of service (host hang     or crash) by modifying the instruction stream     asynchronously while performing certain kernel     operations (bsc#1014298)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2017-5525: audio: memory leakage in ac97 (bz     #1414110)

  - CVE-2017-5526: audio: memory leakage in es1370 (bz     #1414210)

  - CVE-2016-10155 watchdog: memory leakage in i6300esb (bz     #1415200)

  - CVE-2017-5552: virtio-gpu-3d: memory leakage (bz     #1415283)

  - CVE-2017-5667: sd: sdhci OOB access during multi block     transfer (bz #1417560)

  - CVE-2017-5857: virtio-gpu-3d: host memory leakage in     virgl_cmd_resource_unref (bz #1418383)

  - CVE-2017-5856: scsi: megasas: memory leakage (bz     #1418344)

  - CVE-2017-5898: usb: integer overflow in     emulated_apdu_from_guest (bz #1419700)

  - CVE-2017-5987: sd: infinite loop issue in multi block     transfers (bz #1422001)

  - CVE-2017-6505: usb: an infinite loop issue in     ohci_service_ed_list (bz #1429434)

  - CVE-2017-2615: cirrus: oob access while doing bitblt     copy backward (bz #1418206)

  - CVE-2017-2620: cirrus: potential arbitrary code     execution (bz #1425419)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es) :

* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615)

* Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)

Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.

Bug Fix(es) :

* When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected.
(BZ#1420049)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
97597	Scientific Linux Security Update : kvm on SL5.x x86_64 (20170307)	Nessus	Scientific Linux Local Security Checks	3/8/2017	6/3/2021	critical
97712	openSUSE Security Update : xen (openSUSE-2017-329)	Nessus	SuSE Local Security Checks	3/14/2017	6/3/2021	critical
97828	SUSE SLES11 Security Update : xen (SUSE-SU-2017:0718-1)	Nessus	SuSE Local Security Checks	3/20/2017	6/3/2021	critical
97865	Fedora 24 : 2:qemu (2017-62ac1230f7)	Nessus	Fedora Local Security Checks	3/22/2017	6/3/2021	critical
101433	Virtuozzo 7 : qemu-img / qemu-kvm / qemu-kvm-common / etc (VZLSA-2017-0396)	Nessus	Virtuozzo Local Security Checks	7/13/2017	6/3/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical