SB2020030613 - Red Hat Virtualization Engine 4.2 update for qemu-kvm-rhev 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020030613

SB2020030613 - Red Hat Virtualization Engine 4.2 update for qemu-kvm-rhev

Published: March 6, 2020

Security Bulletin ID SB2020030613
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Resource management error (CVE-ID: CVE-2019-11135)

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the TSX Asynchronous Abort (TAA) in Intel CPUs. The TAA condition, on some microprocessors utilizing speculative execution, may allow an authenticated user to potentially enable information disclosure via a side channel.

2) Heap-based buffer overflow (CVE-ID: CVE-2020-1711)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to a boundary error in the way the iSCSI Block driver handles a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an "iscsi_co_block_status()" routine. A remote authenticated attacker can trigger heap-based buffer overflow and cause a denial of service condition or potentially execute arbitrary code with privileges of the QEMU process on the host.



Remediation

Install update from vendor's website.

References