Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1554
Important: qemu-kvm-rhev security update
23 May 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu-kvm-rhev
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2018-3639
Reference: ASB-2018.0121
ESB-2018.1549
ESB-2018.1548
ESB-2018.1545
Original Bulletin:
https://access.redhat.com/errata/RHSA-2018:1643
https://access.redhat.com/errata/RHSA-2018:1644
https://access.redhat.com/errata/RHSA-2018:1645
https://access.redhat.com/errata/RHSA-2018:1646
https://access.redhat.com/errata/RHSA-2018:1654
https://access.redhat.com/errata/RHSA-2018:1686
Comment: This bulletin contains six (6) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1643-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1643
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
12.0 (Pike).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 12.0 - ppc64le, x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 12.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
ppc64le:
qemu-img-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQwk9zjgjWX9erEAQglCA/7Bjn5OZvdp0TOl/4uHhhJQQgPX9PwReEN
E+OxdLj2fqatjeo4hN+bdQMHBIjM8jp4uU/TY5Ax5h801afq1sVF2cnkhO0izDB/
lSanfWXPcdKMMwjGFAybfrqh352Ztms0+KhUAMKccQhrJOwAvBsuRCuBhKs/ISVK
l0+uXnwQpcDB9QoTHOV3GzVdWiHs047P9/PBhk77iDYuSdu5bLR3kSeUb6eUpkjs
EIMP66hCnyZFlwOGAPuMVpz9MaMlkDZtf+ceqS/QDMEYzSazelJWDPX79o7Ge4nh
kRPNHD7oWQ/8r5ZBsbpPaow1OikQne8iwhiX57Ok6ruFnJ3M9jv6YsnTCYwESM00
0rYlC/2AseAG3S62GHXc5jw753bBhxhYKLm8sktdjpp7flYwy5rdhIkEE7B1rCuk
fjWSRHw+OaZXZzlq1fzDPG3wCmK1EejcBnbMseePPDHiPGsMRnc/sd139MfxtLkO
ysYO+WYiUHlX86/vZhKsM6afbUo6gEHbTWWv5hwC3AgJyndyU/2q0snpWuFUUiyU
WH0dJph+l7A2MywhAGBXwrCRJY7cktxyW17+/Ywo+r45RFhYRi9MIg1J5sg6OB6d
Z+hU7FsgNfMXBGeJsoP8QdEkTbs6F7iLOhOHA5tqNOME7izk3drQ+jWLlgMQni+f
FeN11ZJYdyU=
=Xuyz
- -----END PGP SIGNATURE-----
==============================================================================
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1644-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1644
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 10.0 - x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 10.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQqKdzjgjWX9erEAQhJqQ/9GcSmF+rGkARprUAQ2dadNz1lqbhOomlS
25PvF7/IeCjuzQwrOm84lFo76sqFD5Ta1+4Negecpp2X4jDtmf9IisAWMfvsXBnq
672GJ0adzeTVAcpDc27Vuv3Boq9rwvC3AHWPyQ7ZciDe0taBvPano/Toe6z3c2cE
+yUGjMaC1qleBCm5FY1I7a8OKagHT7gKl+DWIIQzM4lg2C44wYZzJQMq/pxTAnUn
HzTW3y++jKa1KiPfZf45XTil81SMjHt1tBBNeNGH44K6lekPCNaqZUqjlBZFcQZi
Eh1PfATLs5qiK9XGE0r8UJLtkFFaDCuDdwWL6ivtaEJlhZPq6g2x9AdtoFpvkRC/
RDRXIRhIuZk45fe7hV+GQmLh74ZdpOGS8wbij5Mjq2EeQtgjH4Va3lJJcYEbuhZ1
JxSYqSCjpV9J1AVeQSwYrQIOsgdY3tqkvH3UarSisUKSqA99nxz1jhnRnMRYQ1wI
TZQ7xSD/klOiJMtXN14SkWncr6Yy7uEGf9Su0ESYQtPz026qio9snEc4hpkaQf4u
t9CB0dPXjw3UHYvB7O69Pl3OCY0k+DtJ6STTAyCsHON+3drSMfL+LAlo2JCSxnAo
L7C272zH6KAn5ov2Bv6kZVPwVoMggxVBvRfw+EMqJB0aaZL1RL//8NR70SXLSLDs
ZFoQJPCuzYU=
=B/Vi
- -----END PGP SIGNATURE-----
==============================================================================
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1645-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1645
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 9.0 - x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 9.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQxWtzjgjWX9erEAQiuCA//TpG18nTgoSBqHFiK59ChgwouOx8wqrlc
Vb0fTeWF+qZvIU7JJppHWOHr32vgAC60WCPDjQjh+9icKsNfkwAmjS3i2ll5yZI5
RYemFUCOA3IgLCvXcL3zXpvCNcPR8Z5c3yojHVLnr7J/5k6Mcjb7QB2rlPTIJdmk
8TAvkGIQixnYks9jZVqx4ZyD3iZ0Q+Vudta1Ef4trnfrAkgEwuUjL2sDaxEwR2BP
cUp7MGeSKQ6sY43WwNidDsOkash9L2QqYIJpxjIvDJZCrtIjQcKn6JxSLlUP4h1t
Cp3rFvxDv4oFh0wU/YPCxpb2GNijaq5vIuc+Xa4ol95D+FXT2YI2pTZ/z9oBHG8e
AMwmJuJPyCM7IyxlsShGaFnVvIBqeihRTnCFcj65da6lHtUBIhcCfAd9JKY9vDtI
SUUg2sTQ9NiYDUntllV3LG0OtCleWFaf4NDARhV2HxLv30WCTz0j/kgIT3U8y+ws
jYWdB9ZhGVJ3J8iT+R7d7dnEY4ZHSuBRaOM+O+WajaXtKvmDC1nerjrOscDLm8rL
aaKKfyRuVmDgv7hKpcs9UmoYAcELbvdVBY2uCIXtnJ/JLArA1tWuke0IUCYz+LLT
RcyYcNSDnK9wpOi1gxStvaSjHPJ7TM16dU/O4GoD0ool6q8+/Cx+ol2Q0NkboHr9
vRi2BHH9sX4=
=L92X
- -----END PGP SIGNATURE-----
==============================================================================
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1646-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1646
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 8.0 (Liberty) - x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 8.0 (Liberty):
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQpvtzjgjWX9erEAQh14g/8DRtASjPAOqFTDXHjINrSO/X7ou00tYED
SuEg9KBc9E29wy9Ishe6Syicdd8J/TNrybdVzwvMycslPdO7bpPLKZLavl5c8vkG
vcobEF+lgqGrBMJ39wIKZ0SyWOEO5HYZliMZkMsjz35oIHyZF+l+QhwBHaqA7+Rv
8ToQQ+s0BC6MZacr4ClI9a1EHtJrv9x1Uc1B1uruWhyL/QJNNN92egU3kUxbLihZ
gtxw98NqnNf6yFIzanmF92kTuzVzGJGGLbstoZtugc4miSWQoKkIwaU5wXUzf7oc
r/dPeyiyL0z/iGlkSbylxp75Br6mivhdQfiuQcoFYFrSoaRof8dSvEs7djKe1aTn
OpGWWCCQvCnd4wyPqw8kJSV9qZt7fhoKF48saILmHY6xCOcFf1z8l40n+S5ahDJd
Qzf+wuw6eaKPfEU7SWq0vlTh9hS1voOIY3+nbWw6nxkMWBDr3nGT7o/IYtxEbc8z
0kWWg8SklxBRe/t7b+M652OUhn/vUrj26fWPh0ZzEVHtqE8oQzlJkktkwNT2luaC
0LxFLKyjXF3MzbCJUc8tVz1v3GruzN3y1L8Y7jeNS/fLVyXsXrwJEAZlzwdsQEsM
XqlBSGXcF3FYw2lKcUGsdIa0oAaC68y1P6MbyDGWciPlgWRvh+aRRAa3spxBK0Ta
aZcw4Q7W3Dw=
=IVqz
- -----END PGP SIGNATURE-----
==============================================================================
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1654-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1654
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and
Agents for Red Hat Enterprise Linux 7 Extended Life Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
RHEV-H and VDSM for 7 Hosts ELS - x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
RHEV-H and VDSM for 7 Hosts ELS:
Source:
qemu-kvm-rhev-2.6.0-28.el7_3.17.src.rpm
x86_64:
qemu-img-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-common-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-tools-rhev-2.6.0-28.el7_3.17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQxS9zjgjWX9erEAQgTZg//YT5dhcDPwo38rirti8c40ydJzaXgI82G
eQElzfNx+NfW0/y/pn16h/yDr6WouCDM4Ea/+Lz3EOJ20RAT2MPSEifAyhOcOHJF
7n1YI8uo/H2e0zftKQLCuZk8VAlnsRoiVPIQsGZHoit/Ffcsu6ZWaL3sXciCDI9o
I1JIpXtHqEtC+7ncyQlXA+XeUbg0xYy3bC4aNH9KB8tr7W9Lxc5pBP/kII8N7+wl
xEdsvMlr+2NLJrRWyiE8Os+o1XMPE5WZPu3saiX9nG7bh8h2XzJ55lfB1wH365Bm
LDdeTJTpxqSUASccXklutzp4mjXUmMGh/kPM3zh0qumcZ8kdknUtNpU9w/iHImvk
oRP5160CU/WrSJHE1LS8ZClQQgIb2QFHbq8sVu2TgIQgFLt5Z3BMacjdbTW061+6
RdrPcasIGi0gDUab9JMe02DSrAmMITbmCyO9hY/+r8ZIRVuxICtqaIuwx0Ne/Jtj
CBGZTD6mrw8Uiw4/8mnlAUCzZAPAjsXISgTLOM7AFunfO+owjKWytaUb1o3UfYM5
gTVVbRXKO0wej75BGmldFat5IcEyffs0pr+Vj7P6xyhDoBZMVERU1G/j5ztpC4cU
NVZxbGMjVUHtCtHKcAVu2zrn2c60dYpSJbS8+ljaxgOgps6U0OS3uhS2IvQXqlUn
r2/VV8kxG7k=
=Ct+f
- -----END PGP SIGNATURE-----
==============================================================================
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1686-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1686
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 7.0 (Kilo) for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 - x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor's data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 - CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7:
Source:
qemu-kvm-rhev-2.9.0-16.el7_4.17.src.rpm
x86_64:
qemu-img-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-16.el7_4.17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBWwQwWtzjgjWX9erEAQhbzA//apHiQlcFqNmk3M1MMX1sugpfD/+92bhH
PGXxWvu+mV7De2BGkoTGEqX2cAo7ZOAJAdMW4zZg/IRSHXtCE9YxlyixxOna/OEt
lPqW+fht68dcoXZoBnEsoY6XuNtIwWzHDjRS2s0sexNLRT3t/YQnp0HnIFAd6F/E
GoEv4buQ+xfdGZYNpCd6Vg9jrT/w+9/hWy5PShKjScktHmBR/tvcqluS1SaluVFy
rwTgwrZVmifregn37T9GRIH/Vb628V4LGrwGN4VDGLKOSlNri1Dm2UlxYDBD3EaD
Q6JIGCV3XtB0+r1X9v+16AU3MokdA+d9JNY6DcYQtscINJ4Q0/krPZnU5+7tI7pq
LFjaTCPqPdNZmiyaxoKBk9a66v2eYSGVeFrx9S+Ej9DlYCwF/gksJlvYyKCasyRc
f6ytfF0Xpl5f2xLIRPBhoi25UCkh6k5khSJpri3rJ5gJTo+yQ6ZP+Y3upB9tmswr
wooA78mXLB1EsUToNgUgJxvQVRW/OUodrCxLiirGnJF6aZgYp5N+Q3FHH25khPBe
VjOOs20QiGNBqJoj1nlnilDI2qeGyM8b5G8cbhe3qDCCXC+1nqaaKYKDDPfyFK3H
W4rqM5j+0RuhpzG770I94a96IhC/gcstWVn/gsbif1tlwbNTeUMTFLaYmG4AxdVH
l/RkK5Q8/3Q=
=Gde/
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWwSxsox+lLeg9Ub1AQigOg/+ImWLsf0KRpDVD7u4rxcWL9IsuIud5sLh
E+AZJJZD7aqlJme/rtts+tgLs3zXP1DV3W6F8VzXRbDu8JQsupvAyReWzLATBGM+
4IivfnbRkCs2vepMxQqJozpLttAJxqSI/WZE1+cXkVgAVHpGTDHj/A3NVZoyhCaU
8sJSnnKEeR1eONU+/rdlBPBpEb8S4i1xQU/kzoh70VOV9UxR5sbLwfVrxn+Xyx02
wRQsHMFqF3sKyJ+D9+Iy+NhvmiXDdCf/XImTcpFt4E1PIhdg9YdxftLXtAY85six
w9KsGCDDcH+x1Taoce1obINvDrpJV2IqCn+cDQTGXvHasThLu+pF3DgTuMwGJVOB
dftksRCyA/Un6UDkP3LnjqDh9Gaicabyz3HqJLz268m2SkjgnQSyRxALPQ3bkApz
O7O1KoCUOqT+z/KlSFPQFn37y7lrDDBZMrGp6VxLSMswtNN8/b+mNATEuTcqXhoJ
QjGIJgU/mFd0fiA9kPxqa27VA8eooytu6zAizvIYbQPs2JLvVH98Z9SpKq6tpLVA
wnHzcfffKY+C2g9OYOZ/8Xo78ectPJw5yoZ03gLq37lqai0frZD810wX8/esZ9b7
DLE6/ZIvCRIxOCIxviCQ4hSX4hoqUbkVE4G4sVh0KXGrv6BG2p8SUct3ZAilWlzy
MQKwwnjgK4Y=
=fuzc
-----END PGP SIGNATURE-----