SB2019080903 - Red Hat update for qemu-kvm-rhev
Published: August 9, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2018-15746)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The vulnerability exists in qemu-seccomp.c due to an error when processing malicious input. An adjacent attacker can leverage mishandling of the seccomp policy for threads other than the main thread and cause the service to crash.
2) Integer overflow (CVE-ID: CVE-2018-17958)
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The vulnerability exists due to a boundary error in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. An adjacent attacker can trigger integer overflow and cause the service to crash.
3) Buffer overflow (CVE-ID: CVE-2018-17963)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to buffer overflow when qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX. A remote attacker can supply specially crafted packets over the network, trigger memory corruption and crash the Qemu process.
4) Buffer overflow (CVE-ID: CVE-2019-6501)
The vulnerability allows a local user to perform denial of service attack.
The vulnerability exists due to a boundary error within the scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c. A local user can create a specially crafted application, trigger buffer overflow and crash the affected emulator.
5) Heap-based buffer overflow (CVE-ID: CVE-2019-6778)
The vulnerability allows a local user to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the tcp_emu() function in slirp/tcp_subr.c. A local user can send specially crafted networking packets, trigger heap-based buffer overflow and crash the affected system.
6) Memory leak (CVE-ID: CVE-2019-9824)
The vulnerability allows a local user to gain access to sensitive information on the system.
The vulnerability exists due memory leak within the SLiRP networking implementation. A local user can read uninitialised stack memory contents.
Remediation
Install update from vendor's website.