—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1657-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1657
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.5
Advanced Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server AUS (v. 6.5) – x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux Server AUS (v. 6.5):
Source:
qemu-kvm-0.12.1.2-2.415.el6_5.18.src.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.415.el6_5.18.x86_64.rpm
qemu-img-0.12.1.2-2.415.el6_5.18.x86_64.rpm
qemu-kvm-0.12.1.2-2.415.el6_5.18.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.415.el6_5.18.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.415.el6_5.18.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQptNzjgjWX9erEAQg7Fg//d90hzc3/kpDZi3LfAg9EkN5aImN4Yizb
al6n73dSfw4qShRsaE8lculzn7YNZAffzM1JN5XRlDiFTjUv3k+QYfY3YJDHsNTO
6WfVBnTR25aJXGrMF4MgBnwcputmIe60kYuyaLZzVoubMeBlkWBDuf5l+Ct641zR
7upVb3LitSUBqvmesRbswpFEVqecsnCpAOC9ah7cvHYIqeXu/6/jT/lTAY/xtcLD
qkkuB6My7JT1nSGKgeN/11xQawh/BmskOZXktbpN+7yvGV96IpUOJ85sqJYV6Ux+
LB734yHnfsDxdc1gu92UQCy+FOefLbOpbVRriiZvJlhQHuPf1mOTWVN7Wer0cYFs
lXgwrw5jHFLc2UZQzqYVzguAcJYjAXZhiQoI9Rx2J/K1+lQsCGqqraJrJIlRPPxk
cYjibTjhptpj7syt426+WPIFMI6RyFaHDg3u34VMFVmwm6hLRTk9a2aHPgSOT7ZB
niOSM1xGhkXKdWaboOxt0EtaUa1K4Upv01WU3n9B9pbiB7RkFS9C1IKhyFnpH7jg
aEqXfwvSpmsnEM+f2drDjHj39M2ue+nAbjlz06CD7sPIquyWRpmJq3uGSs7nEE4l
6H+oTkBhC5UrucTEy9CJWAiEIsBWFVwAczOegjhaeu5iJ+mkyB3FSE4Q79iGdkMf
5dx/R0XzmDM=
=pzi7
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1663-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1663
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.4
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) – x86_64
Red Hat Enterprise Linux Server EUS (v. 7.4) – ppc64, ppc64le, x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4):
Source:
qemu-kvm-1.5.3-141.el7_4.7.src.rpm
x86_64:
qemu-img-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-common-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-tools-1.5.3-141.el7_4.7.x86_64.rpm
Red Hat Enterprise Linux Server EUS (v. 7.4):
Source:
qemu-kvm-1.5.3-141.el7_4.7.src.rpm
ppc64:
qemu-img-1.5.3-141.el7_4.7.ppc64.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.7.ppc64.rpm
ppc64le:
qemu-img-1.5.3-141.el7_4.7.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.7.ppc64le.rpm
x86_64:
qemu-img-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-common-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-141.el7_4.7.x86_64.rpm
qemu-kvm-tools-1.5.3-141.el7_4.7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQprdzjgjWX9erEAQiU8Q//dacyGt5QBy4nm0fU1yuk6qUXgreMOQyG
5xgQo/WTaDPntW+4exa+YU3AfX8SWW9G1ZbGPGh0MkqXqnJJTxfc/wFmZiHV9MKD
Ky4i/VInHwQfatwD5Rd4q7u0/vpaWe2QLyISy+7QiiJ6hgCm4folMlEvcd+Ok45B
vfEz03JHsZi83+Dz5sUu8hOKIvOBIse/4gXLdejILs2kfyodpUtm6G9yB4f3SiOe
pKS/VeGh224u6s7dY9kv2Jb01792POXpP5AX5HpA2V6jOB4qoAXjCpclDLmz03hV
sAggXx6fK+hEsjOdu6FE4ejyNM77zhyZidvbCj5C2wZY3uSPLsj3md+u3Q8pKC/T
UvE0JrGePZC2iCJ3PZ6fDMgZOYV+LIv7nJiuWAzWvDyBy70/Gimzg6GFNHGEH65Y
ZjQoPkyXqeljIj4jeBDiyJYRoKGWRYLKroX+1qDzT1OMs+4cw/JzcWXmXe8WTiO0
HNQd237j95+T9A+RH527MwDlO8PEzF7u7jEnaA3dQQFA6kceYWgGM8HmjcLkSs11
cDgskR9OeqoyJIq34VDs6s5v5UZFopn6xbDqfVHaxaC481PZF31wydi5GoWHdDKq
AIvb8pZKHuvWB4HE5R3/72BR0y3gK97QB9JfKNz3cLHbz60UVDjFy23GdOnivhqe
SyWXPrW6Pxk=
=knS2
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1646-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1646
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
8.0 (Liberty).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 8.0 (Liberty) – x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 8.0 (Liberty):
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQpvtzjgjWX9erEAQh14g/8DRtASjPAOqFTDXHjINrSO/X7ou00tYED
SuEg9KBc9E29wy9Ishe6Syicdd8J/TNrybdVzwvMycslPdO7bpPLKZLavl5c8vkG
vcobEF+lgqGrBMJ39wIKZ0SyWOEO5HYZliMZkMsjz35oIHyZF+l+QhwBHaqA7+Rv
8ToQQ+s0BC6MZacr4ClI9a1EHtJrv9x1Uc1B1uruWhyL/QJNNN92egU3kUxbLihZ
gtxw98NqnNf6yFIzanmF92kTuzVzGJGGLbstoZtugc4miSWQoKkIwaU5wXUzf7oc
r/dPeyiyL0z/iGlkSbylxp75Br6mivhdQfiuQcoFYFrSoaRof8dSvEs7djKe1aTn
OpGWWCCQvCnd4wyPqw8kJSV9qZt7fhoKF48saILmHY6xCOcFf1z8l40n+S5ahDJd
Qzf+wuw6eaKPfEU7SWq0vlTh9hS1voOIY3+nbWw6nxkMWBDr3nGT7o/IYtxEbc8z
0kWWg8SklxBRe/t7b+M652OUhn/vUrj26fWPh0ZzEVHtqE8oQzlJkktkwNT2luaC
0LxFLKyjXF3MzbCJUc8tVz1v3GruzN3y1L8Y7jeNS/fLVyXsXrwJEAZlzwdsQEsM
XqlBSGXcF3FYw2lKcUGsdIa0oAaC68y1P6MbyDGWciPlgWRvh+aRRAa3spxBK0Ta
aZcw4Q7W3Dw=
=IVqz
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1644-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1644
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
10.0 (Newton).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 10.0 – x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 10.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQqKdzjgjWX9erEAQhJqQ/9GcSmF+rGkARprUAQ2dadNz1lqbhOomlS
25PvF7/IeCjuzQwrOm84lFo76sqFD5Ta1+4Negecpp2X4jDtmf9IisAWMfvsXBnq
672GJ0adzeTVAcpDc27Vuv3Boq9rwvC3AHWPyQ7ZciDe0taBvPano/Toe6z3c2cE
+yUGjMaC1qleBCm5FY1I7a8OKagHT7gKl+DWIIQzM4lg2C44wYZzJQMq/pxTAnUn
HzTW3y++jKa1KiPfZf45XTil81SMjHt1tBBNeNGH44K6lekPCNaqZUqjlBZFcQZi
Eh1PfATLs5qiK9XGE0r8UJLtkFFaDCuDdwWL6ivtaEJlhZPq6g2x9AdtoFpvkRC/
RDRXIRhIuZk45fe7hV+GQmLh74ZdpOGS8wbij5Mjq2EeQtgjH4Va3lJJcYEbuhZ1
JxSYqSCjpV9J1AVeQSwYrQIOsgdY3tqkvH3UarSisUKSqA99nxz1jhnRnMRYQ1wI
TZQ7xSD/klOiJMtXN14SkWncr6Yy7uEGf9Su0ESYQtPz026qio9snEc4hpkaQf4u
t9CB0dPXjw3UHYvB7O69Pl3OCY0k+DtJ6STTAyCsHON+3drSMfL+LAlo2JCSxnAo
L7C272zH6KAn5ov2Bv6kZVPwVoMggxVBvRfw+EMqJB0aaZL1RL//8NR70SXLSLDs
ZFoQJPCuzYU=
=B/Vi
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1661-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1661
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.2
Advanced Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update
Support, and Red Hat Enterprise Linux 7.2 Update Services for SAP
Solutions.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server AUS (v. 7.2) – x86_64
Red Hat Enterprise Linux Server E4S (v. 7.2) – ppc64le, x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 7.2) – x86_64
Red Hat Enterprise Linux Server Optional E4S (v. 7.2) – ppc64le, x86_64
Red Hat Enterprise Linux Server Optional TUS (v. 7.2) – x86_64
Red Hat Enterprise Linux Server TUS (v. 7.2) – x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux Server AUS (v. 7.2):
Source:
qemu-kvm-1.5.3-105.el7_2.17.src.rpm
x86_64:
libcacard-1.5.3-105.el7_2.17.i686.rpm
libcacard-1.5.3-105.el7_2.17.x86_64.rpm
qemu-img-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-common-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-tools-1.5.3-105.el7_2.17.x86_64.rpm
Red Hat Enterprise Linux Server E4S (v. 7.2):
Source:
qemu-kvm-1.5.3-105.el7_2.17.src.rpm
ppc64le:
qemu-img-1.5.3-105.el7_2.17.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.ppc64le.rpm
x86_64:
libcacard-1.5.3-105.el7_2.17.i686.rpm
libcacard-1.5.3-105.el7_2.17.x86_64.rpm
qemu-img-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-common-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-tools-1.5.3-105.el7_2.17.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 7.2):
Source:
qemu-kvm-1.5.3-105.el7_2.17.src.rpm
x86_64:
libcacard-1.5.3-105.el7_2.17.i686.rpm
libcacard-1.5.3-105.el7_2.17.x86_64.rpm
qemu-img-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-common-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-tools-1.5.3-105.el7_2.17.x86_64.rpm
Red Hat Enterprise Linux Server Optional AUS (v. 7.2):
x86_64:
libcacard-devel-1.5.3-105.el7_2.17.i686.rpm
libcacard-devel-1.5.3-105.el7_2.17.x86_64.rpm
libcacard-tools-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
Red Hat Enterprise Linux Server Optional E4S (v. 7.2):
ppc64le:
libcacard-1.5.3-105.el7_2.17.ppc64le.rpm
libcacard-devel-1.5.3-105.el7_2.17.ppc64le.rpm
libcacard-tools-1.5.3-105.el7_2.17.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.ppc64le.rpm
x86_64:
libcacard-devel-1.5.3-105.el7_2.17.i686.rpm
libcacard-devel-1.5.3-105.el7_2.17.x86_64.rpm
libcacard-tools-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
Red Hat Enterprise Linux Server Optional TUS (v. 7.2):
x86_64:
libcacard-devel-1.5.3-105.el7_2.17.i686.rpm
libcacard-devel-1.5.3-105.el7_2.17.x86_64.rpm
libcacard-tools-1.5.3-105.el7_2.17.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.i686.rpm
qemu-kvm-debuginfo-1.5.3-105.el7_2.17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQqMtzjgjWX9erEAQhz4g/+P5UH4oBk7Oxv6k6Yxa+lf5ZMrSvFe+9U
W4bch6nEWTAV6fMTfybfRgVDGF8WWyqaCNC3gjqA+xAveTo81IRHtyOT2I2+Zr45
+t/niCIORdASGV1thP1/DefctpyWN1oTYpxGPeNWfhfA4hCl/v6GGFOo9tst5hJ6
bB2aXDQmRHYhea4y2y4XHGoYI38CpnuC/eDUyDf4f5JwNCNcuZhdiXRWvvZlsVvT
gqq6fVKOIfg4sA2qxKEG11svg8bk9SmIi53D5fIH+2AWY4sFazItdKDCap6PzUmP
1MwqfgaD2TgBP56PFAtQemimgmvARTHbkwR3qAg6xfYbyoWYBJhI88SmMUL7qGO/
dQ5wYA/9GwyCMB/OhIO9qMyKGzSFfEF/v7+4H0QPjv2JRE21qvq+tpBLh5KVAcmO
OglxEmUSSjuUOBakyvMTpVmGOUofCbu7xYmmA19ZDzqu+HhXvxQ6j5Q62kShD4Sb
DlRborQvocRHdKf1ru7cKolmJ8VCQjdTbVeTIAvZzQ3rMwBRhQ483zAw/MSMDHI8
pAJOM34fMtqub7jxNe1NDIRxuXEmbaJFBY7PYnIYhcRK+J7vdkYSyo9H4DXuWFik
875z/O5MpLXZ9PO6vOnweiUmJ+bhJGZ4hcRuhPwWag18a8yGjM7XNsNt1Pn8qW0O
NvFUoTSfELw=
=E6y6
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1658-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1658
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.6
Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended
Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server AUS (v. 6.6) – x86_64
Red Hat Enterprise Linux Server TUS (v. 6.6) – x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux Server AUS (v. 6.6):
Source:
qemu-kvm-0.12.1.2-2.448.el6_6.6.src.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-img-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.448.el6_6.6.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 6.6):
Source:
qemu-kvm-0.12.1.2-2.448.el6_6.6.src.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-img-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.448.el6_6.6.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.448.el6_6.6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQwS9zjgjWX9erEAQgB6RAAoAoZvcJTo5OQMCqptpRU4a+ZPmlB3C9C
2Z3vFhGS+sgF1FUkqMfy8JcFpVaDjFKK+TUAVFKTEz0Hhawd+0xYRuUKNku7DXHI
r5PK/2ex3AoJezXxkyuGwODKYjX0siG3nuIdGw+qD3VnIF1jaAVNpK+fnqzTVKrs
AdOMGv18xJw4joxDNZNUCi3jDfgAVLwAdLGyWzhYnmIT14BfOnuSo3YDmxoeV45X
Kmnj7rF4DQQPzPIejHf5stJu55iJM0cOWO51bmBakybIizFKdDKiCiGuVTsHkFXg
gHHxA7VwdrrSC2MofyBEP0jsd9LhFskZdi4+ZdmQT7tPbf59k6Nms+RoBgUGaNJv
zLAX9b2OusjR3deoe1KIdNF7KYG6B9YWuV7vnykT4Wofg/GUesFYr3SZpXxVtud8
fbCUh2OiYXROtXXIHj+D7E3TbR5HSMtbrVrPF4vyE3GQ5VyNBL82lFYl0vhh+IzW
HefX9XJEVYXT4dBZUEA1ombB2zn8lvYyXiQHThOF1BswlZmELEX72gxbrPWsGUr5
VXuufoLcUd9VLcrsloHDS6IqyWodKYczZSQL5rEnGxGL5osjSWcXq9WvS2MUzTTM
wVgjskHPLaozCO7/GitjRGNwKGiFAWbkb9IxeQV+e8hrAq2JD0X2RvW8fZtPd5o2
9eWpfBsNk3w=
=1FPw
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1633-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1633
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) – x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) – x86_64
Red Hat Enterprise Linux Server (v. 7) – x86_64
Red Hat Enterprise Linux Workstation (v. 7) – x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
qemu-kvm-1.5.3-156.el7_5.2.src.rpm
x86_64:
qemu-img-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-common-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-tools-1.5.3-156.el7_5.2.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
Source:
qemu-kvm-1.5.3-156.el7_5.2.src.rpm
x86_64:
qemu-img-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-common-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-tools-1.5.3-156.el7_5.2.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
qemu-kvm-1.5.3-156.el7_5.2.src.rpm
x86_64:
qemu-img-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-common-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-tools-1.5.3-156.el7_5.2.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
qemu-kvm-1.5.3-156.el7_5.2.src.rpm
x86_64:
qemu-img-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-common-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-156.el7_5.2.x86_64.rpm
qemu-kvm-tools-1.5.3-156.el7_5.2.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQw3dzjgjWX9erEAQjRHhAAg7JsNEjDOPS+6ovojJMDRo70/ltYoPAI
YXoYfBO2fex8oFPzbqPEBg6E4pzlxar1bWTFfU4Zlw3WcD4pnDyxjPEfteke3eGy
9H2h3Lu2MerwilxrtLftWXQoaPDkCFO1HjtOpg+G4HRt28LsWfpuf7bfXbcZu+q9
Medx6+brduTPB1vWC4Uu01e96zdUc1cBp7PiBVShkyLEVkBlR7pqPT19AgluXwAj
5JC1ccEmy9H47VAGktdzt9BXh3K+r7k73yFYFwBfAeCV4ee4GmJUYDSpNpUMX8nI
6Md1HswlPP2fC1K8qq9Fv539NnSlsstBix3SClu6HeZe5tDW7ARgzUMLA6vfVMez
Qc1SzvT4yOUcYLQozWMPTFd/UlJikrg47TkGc/Qq3Wj75YXGa5/gUlQOAFLvy+27
wjCFk2JSC6uNzE1/tXx6eKPpyPrFEthvNrA/O1RR2xiUIaFCFBpSASFzF0jYmiqH
CHCN/Cg9GxqTqniyWhBMZ1bf5o/2bTrKHXn8KCyNTy96fFSkL9ZpQuWAsmv0eP+F
NV6UBQNlxmsGvU1GjpQbnRTrbq6nZy+g33GaYIJkLzD95RAw1luPopd9PSHJuE/b
ionCKP27nMJVV5MyQBaSpTZNF2D4YpL51uS9cmUJ46FGWKVqeOmdOnydcCkxBofR
i+rws00JXQM=
=fAb+
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1686-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1686
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat Enterprise Linux
OpenStack Platform 7.0 (Kilo) for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 – x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7:
Source:
qemu-kvm-rhev-2.9.0-16.el7_4.17.src.rpm
x86_64:
qemu-img-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-common-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-rhev-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.9.0-16.el7_4.17.x86_64.rpm
qemu-kvm-tools-rhev-2.9.0-16.el7_4.17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQwWtzjgjWX9erEAQhbzA//apHiQlcFqNmk3M1MMX1sugpfD/+92bhH
PGXxWvu+mV7De2BGkoTGEqX2cAo7ZOAJAdMW4zZg/IRSHXtCE9YxlyixxOna/OEt
lPqW+fht68dcoXZoBnEsoY6XuNtIwWzHDjRS2s0sexNLRT3t/YQnp0HnIFAd6F/E
GoEv4buQ+xfdGZYNpCd6Vg9jrT/w+9/hWy5PShKjScktHmBR/tvcqluS1SaluVFy
rwTgwrZVmifregn37T9GRIH/Vb628V4LGrwGN4VDGLKOSlNri1Dm2UlxYDBD3EaD
Q6JIGCV3XtB0+r1X9v+16AU3MokdA+d9JNY6DcYQtscINJ4Q0/krPZnU5+7tI7pq
LFjaTCPqPdNZmiyaxoKBk9a66v2eYSGVeFrx9S+Ej9DlYCwF/gksJlvYyKCasyRc
f6ytfF0Xpl5f2xLIRPBhoi25UCkh6k5khSJpri3rJ5gJTo+yQ6ZP+Y3upB9tmswr
wooA78mXLB1EsUToNgUgJxvQVRW/OUodrCxLiirGnJF6aZgYp5N+Q3FHH25khPBe
VjOOs20QiGNBqJoj1nlnilDI2qeGyM8b5G8cbhe3qDCCXC+1nqaaKYKDDPfyFK3H
W4rqM5j+0RuhpzG770I94a96IhC/gcstWVn/gsbif1tlwbNTeUMTFLaYmG4AxdVH
l/RkK5Q8/3Q=
=Gde/
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1662-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1662
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.3
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3) – x86_64
Red Hat Enterprise Linux Server EUS (v. 7.3) – ppc64, ppc64le, x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3):
Source:
qemu-kvm-1.5.3-126.el7_3.14.src.rpm
x86_64:
qemu-img-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-common-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-tools-1.5.3-126.el7_3.14.x86_64.rpm
Red Hat Enterprise Linux Server EUS (v. 7.3):
Source:
qemu-kvm-1.5.3-126.el7_3.14.src.rpm
ppc64:
qemu-img-1.5.3-126.el7_3.14.ppc64.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.14.ppc64.rpm
ppc64le:
qemu-img-1.5.3-126.el7_3.14.ppc64le.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.14.ppc64le.rpm
x86_64:
qemu-img-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-common-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-debuginfo-1.5.3-126.el7_3.14.x86_64.rpm
qemu-kvm-tools-1.5.3-126.el7_3.14.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQw89zjgjWX9erEAQgKbQ//aYH1eeiZ58ROUldya0L537oBupzAYFje
KuMIGVqTss4nh9B3jYyeYY6v1m1zB5BK9QpXImIVmx8DZ1Fkviv1Z9LvxsCle78g
x5aOlXN4LJMBQ0seIQOuWMze5/4L2ZPSwedKa4jIiX623+aG9TUunuNhta2Me4cz
2rwozZpW1UKR2FNC94uKMB3sERo92w2b52fDjLuQpWvuiWN+aJWQzSGDYGFOWBLi
Jgb69BYp0rSgOwxKsns/+wWwbHbow7/H/WYHnwgx4jn3b6i7zBOJUbQDMlnr3FfP
4/SyvXimQrTdrWMgUouNLg4BxOIJyStypNmAb5cxIw6lcjz2n7IxrktNO7VR5Ko8
nIB6pw6aKzpPHClw8G90Edmsdnpct7eAUTui+OC3Y8CQrpnKZghtw8G1FmdSirwO
HILjx5BavJ02AQE84guYKCrFEjLjAaOC7/vNAA2JqYfDwxB+jU5iGfaXCPO2g/Hm
+1QZbUiXtA7WGYvkvrlu352tNCYb0TCmzNnq0fzOa83uUVi594Dl/L9n4sE1l6YN
wRThtXN9atxhoNH4TbvMKgJ0M6IP6imZyPiC13batjvuucJJgJ6KBGmtGyaD25Zl
keyM09qBVVGGd1mcc4VYvNt2Jsg+p/RizSNLNs4YFL7w/UnY04UqcdFTrzFzWCKg
UvRRtwiY0Uo=
=6bI2
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1643-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1643
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
12.0 (Pike).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 12.0 – ppc64le, x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 12.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
ppc64le:
qemu-img-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.ppc64le.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.ppc64le.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQwk9zjgjWX9erEAQglCA/7Bjn5OZvdp0TOl/4uHhhJQQgPX9PwReEN
E+OxdLj2fqatjeo4hN+bdQMHBIjM8jp4uU/TY5Ax5h801afq1sVF2cnkhO0izDB/
lSanfWXPcdKMMwjGFAybfrqh352Ztms0+KhUAMKccQhrJOwAvBsuRCuBhKs/ISVK
l0+uXnwQpcDB9QoTHOV3GzVdWiHs047P9/PBhk77iDYuSdu5bLR3kSeUb6eUpkjs
EIMP66hCnyZFlwOGAPuMVpz9MaMlkDZtf+ceqS/QDMEYzSazelJWDPX79o7Ge4nh
kRPNHD7oWQ/8r5ZBsbpPaow1OikQne8iwhiX57Ok6ruFnJ3M9jv6YsnTCYwESM00
0rYlC/2AseAG3S62GHXc5jw753bBhxhYKLm8sktdjpp7flYwy5rdhIkEE7B1rCuk
fjWSRHw+OaZXZzlq1fzDPG3wCmK1EejcBnbMseePPDHiPGsMRnc/sd139MfxtLkO
ysYO+WYiUHlX86/vZhKsM6afbUo6gEHbTWWv5hwC3AgJyndyU/2q0snpWuFUUiyU
WH0dJph+l7A2MywhAGBXwrCRJY7cktxyW17+/Ywo+r45RFhYRi9MIg1J5sg6OB6d
Z+hU7FsgNfMXBGeJsoP8QdEkTbs6F7iLOhOHA5tqNOME7izk3drQ+jWLlgMQni+f
FeN11ZJYdyU=
=Xuyz
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1659-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1659
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.7
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux HPC Node EUS (v. 6.7) – x86_64
Red Hat Enterprise Linux Server EUS (v. 6.7) – i386, ppc64, x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux HPC Node EUS (v. 6.7):
Source:
qemu-kvm-0.12.1.2-2.479.el6_7.7.src.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-img-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.479.el6_7.7.x86_64.rpm
Red Hat Enterprise Linux Server EUS (v. 6.7):
Source:
qemu-kvm-0.12.1.2-2.479.el6_7.7.src.rpm
i386:
qemu-guest-agent-0.12.1.2-2.479.el6_7.7.i686.rpm
qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.7.i686.rpm
ppc64:
qemu-guest-agent-0.12.1.2-2.479.el6_7.7.ppc64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.7.ppc64.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-img-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.479.el6_7.7.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.479.el6_7.7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQwntzjgjWX9erEAQgqIg//S3l80PbK4YoZsYy3KOepOQvOVuwxVpI3
AYA9hZ7e28id38cA5tI36m+rx+lkQdVD5AyoIY/stqhRdFiLvydOeHTztiiDr1ab
pCo7nRhFCP9LmvDJil65K74GkxBREGB1rXt7/TWmZrXuM0fPX4MgAYEFEkoE0wbW
ak3RNwk39oLtEjESd1/xzChQ2t7JYGRtftzp2HowJ/ohpU9pCVzBzWC72TgIQnHO
pPjUMFiuvFlzduIc6ZMhmT7oivNwGmXc/4jswwAAPDoqxodjzJ6nQCC1snEOHNCO
ffg96lMOVXGchcnZVWLl7lLx5npL3lzVEDMvWePafqZ1zGuiOSXk52Ml2BDz9Xbn
BoPHs+kA5pH/ggy2w9alq1FKOyTU8hGho8cXq087d+UsUdquQLKgq9pmkBHxY0Dk
f/58DHOt3oCB1FZ3CMJuat9y21JNWiA1DpSMlExhexYOF2X8ARz/r39ikD+y383y
hX3A15uY9vkvYGV5PHJYyHrrz7czsWgdqi55liUSojrjJ+TBTkb8f2dne3MkOA8l
83nrWYMZQp2qJBxH0uMfBRjcyzdxCnNSd79E8yCAzmain4vD/D62JbobY9/0cxzi
YGLhJcTdU9NIfphNMaWNdfqq61We7zHQn9KN4UExTO3ikTkguhX7BLYqfUqeSk76
27jVYeNH7v8=
=jS9o
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm security update
Advisory ID: RHSA-2018:1656-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1656
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.4
Advanced Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Server AUS (v. 6.4) – x86_64
Red Hat Enterprise Linux Server Optional AUS (v. 6.4) – x86_64
3. Description:
Kernel-based Virtual Machine (KVM) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm packages provide the
user-space component for running virtual machines that use KVM.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat Enterprise Linux Server AUS (v. 6.4):
Source:
qemu-kvm-0.12.1.2-2.355.el6_4.11.src.rpm
x86_64:
qemu-guest-agent-0.12.1.2-2.355.el6_4.11.x86_64.rpm
qemu-img-0.12.1.2-2.355.el6_4.11.x86_64.rpm
qemu-kvm-0.12.1.2-2.355.el6_4.11.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.355.el6_4.11.x86_64.rpm
qemu-kvm-tools-0.12.1.2-2.355.el6_4.11.x86_64.rpm
Red Hat Enterprise Linux Server Optional AUS (v. 6.4):
x86_64:
qemu-guest-agent-win32-0.12.1.2-2.355.el6_4.11.x86_64.rpm
qemu-kvm-debuginfo-0.12.1.2-2.355.el6_4.11.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQw/NzjgjWX9erEAQibHhAAnQB3w7HZPsbJL4CZmQ6RiV2jFetYREs4
3uKesj4cIVIg5J1LtGU7sr8HW6dObPGoaqUcTtufUJRGYeQ0K70HJBdnQp7uzG7E
8xR4IjPcYYlPXQKTkFSVRhSi70UMljLMrNKkSK0bx5SSTr6n9EDbgJ2NqqIUa/Se
ltBHixPaMZsGF039djGCmTaeqzApL54KxbRS7ypC5FI2nM6CmGNpSTzL7g30lgVu
ryb4IrmG6OeujXA6WYMRjR7/ELfZ/APQFBnZwY4SnBlO544mu6WT7dh2fqnOqZy4
7vfXvhw/S7BqhBW+YTh9dp+KKXaeU/GhIrdTtJ7G5eF2QC0wZp1NxHhq7CMN/ROE
sj12U4EEZwn0/J+/DZu8eoXsDu8vA1u4JYr0fhDKlnGL1grkfHyzS83isTrelPkr
Rug5Efss9YNrUlPJIjcvPRmGOBEwHev73PYGRbEq/T0BeLKK9w3aXJX35hfoSaCU
yNCkR06oH4q8mvK1kIvwOdkZOiPhezYDz91PsCZ9W7TO0meOyb1OVSL3z5KfsnhT
95g3HETNqfAkzO4kh/CG63mlkdWpwU1r4+SnzV88iZcqZIR8d47Iy/2SwZhISIzu
0b3T1Jh1Tp3TlhX86gJa0GpzlpAz3Hs0vuULuSnQz02K7B6V56R/rRe+1IsqZR3H
QDFk7cwzswg=
=J81W
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1654-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1654
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and
Agents for Red Hat Enterprise Linux 7 Extended Life Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
RHEV-H and VDSM for 7 Hosts ELS – x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
RHEV-H and VDSM for 7 Hosts ELS:
Source:
qemu-kvm-rhev-2.6.0-28.el7_3.17.src.rpm
x86_64:
qemu-img-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-common-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-rhev-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.6.0-28.el7_3.17.x86_64.rpm
qemu-kvm-tools-rhev-2.6.0-28.el7_3.17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQxS9zjgjWX9erEAQgTZg//YT5dhcDPwo38rirti8c40ydJzaXgI82G
eQElzfNx+NfW0/y/pn16h/yDr6WouCDM4Ea/+Lz3EOJ20RAT2MPSEifAyhOcOHJF
7n1YI8uo/H2e0zftKQLCuZk8VAlnsRoiVPIQsGZHoit/Ffcsu6ZWaL3sXciCDI9o
I1JIpXtHqEtC+7ncyQlXA+XeUbg0xYy3bC4aNH9KB8tr7W9Lxc5pBP/kII8N7+wl
xEdsvMlr+2NLJrRWyiE8Os+o1XMPE5WZPu3saiX9nG7bh8h2XzJ55lfB1wH365Bm
LDdeTJTpxqSUASccXklutzp4mjXUmMGh/kPM3zh0qumcZ8kdknUtNpU9w/iHImvk
oRP5160CU/WrSJHE1LS8ZClQQgIb2QFHbq8sVu2TgIQgFLt5Z3BMacjdbTW061+6
RdrPcasIGi0gDUab9JMe02DSrAmMITbmCyO9hY/+r8ZIRVuxICtqaIuwx0Ne/Jtj
CBGZTD6mrw8Uiw4/8mnlAUCzZAPAjsXISgTLOM7AFunfO+owjKWytaUb1o3UfYM5
gTVVbRXKO0wej75BGmldFat5IcEyffs0pr+Vj7P6xyhDoBZMVERU1G/j5ztpC4cU
NVZxbGMjVUHtCtHKcAVu2zrn2c60dYpSJbS8+ljaxgOgps6U0OS3uhS2IvQXqlUn
r2/VV8kxG7k=
=Ct+f
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: qemu-kvm-rhev security update
Advisory ID: RHSA-2018:1645-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1645
Issue date: 2018-05-21
CVE Names: CVE-2018-3639
=====================================================================
1. Summary:
An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform
9.0 (Mitaka).
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat OpenStack Platform 9.0 – x86_64
3. Description:
KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on a variety of architectures. The qemu-kvm-rhev packages provide the
user-space component for running virtual machines that use KVM in
environments managed by Red Hat products.
Security Fix(es):
* An industry-wide issue was found in the way many modern microprocessor
designs have implemented speculative execution of Load & Store instructions
(a commonly used performance optimization). It relies on the presence of a
precisely-defined instruction sequence in the privileged code as well as
the fact that memory read from address to which a recent memory write has
occurred may see an older value and subsequently cause an update into the
microprocessor’s data cache even for speculatively executed instructions
that never actually commit (retire). As a result, an unprivileged attacker
could use this flaw to read privileged memory by conducting targeted cache
side-channel attacks. (CVE-2018-3639)
Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.
Red Hat would like to thank Ken Johnson (Microsoft Security Response
Center) and Jann Horn (Google Project Zero) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing this update, shut down all running virtual machines. Once
all virtual machines have shut down, start them again for this update to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1566890 – CVE-2018-3639 hw: cpu: speculative store bypass
6. Package List:
Red Hat OpenStack Platform 9.0:
Source:
qemu-kvm-rhev-2.10.0-21.el7_5.3.src.rpm
x86_64:
qemu-img-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-common-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-rhev-debuginfo-2.10.0-21.el7_5.3.x86_64.rpm
qemu-kvm-tools-rhev-2.10.0-21.el7_5.3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2018-3639
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/vulnerabilities/ssbd
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBWwQxWtzjgjWX9erEAQiuCA//TpG18nTgoSBqHFiK59ChgwouOx8wqrlc
Vb0fTeWF+qZvIU7JJppHWOHr32vgAC60WCPDjQjh+9icKsNfkwAmjS3i2ll5yZI5
RYemFUCOA3IgLCvXcL3zXpvCNcPR8Z5c3yojHVLnr7J/5k6Mcjb7QB2rlPTIJdmk
8TAvkGIQixnYks9jZVqx4ZyD3iZ0Q+Vudta1Ef4trnfrAkgEwuUjL2sDaxEwR2BP
cUp7MGeSKQ6sY43WwNidDsOkash9L2QqYIJpxjIvDJZCrtIjQcKn6JxSLlUP4h1t
Cp3rFvxDv4oFh0wU/YPCxpb2GNijaq5vIuc+Xa4ol95D+FXT2YI2pTZ/z9oBHG8e
AMwmJuJPyCM7IyxlsShGaFnVvIBqeihRTnCFcj65da6lHtUBIhcCfAd9JKY9vDtI
SUUg2sTQ9NiYDUntllV3LG0OtCleWFaf4NDARhV2HxLv30WCTz0j/kgIT3U8y+ws
jYWdB9ZhGVJ3J8iT+R7d7dnEY4ZHSuBRaOM+O+WajaXtKvmDC1nerjrOscDLm8rL
aaKKfyRuVmDgv7hKpcs9UmoYAcELbvdVBY2uCIXtnJ/JLArA1tWuke0IUCYz+LLT
RcyYcNSDnK9wpOi1gxStvaSjHPJ7TM16dU/O4GoD0ool6q8+/Cx+ol2Q0NkboHr9
vRi2BHH9sX4=
=L92X
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
