Skip to navigation

Security Advisory Important: qemu-kvm security update

Advisory: RHSA-2012:1234-1
Type: Security Advisory
Severity: Important
Issued on: 2012-09-05
Last updated on: 2012-09-05
Affected Products: Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server EUS (v. 6.3.z)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2012-3515

Details

Updated qemu-kvm packages that fix one security issue are now available for
Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space
component for running virtual machines using KVM.

A flaw was found in the way QEMU handled VT100 terminal escape sequences
when emulating certain character devices. A guest user with privileges to
write to a character device that is emulated on the host using a virtual
console back-end could use this flaw to crash the qemu-kvm process on the
host or, possibly, escalate their privileges on the host. (CVE-2012-3515)

This flaw did not affect the default use of KVM. Affected configurations
were:

* When guests were started from the command line ("/usr/libexec/qemu-kvm")
without the "-nodefaults" option, and also without specifying a
serial or parallel device, or a virtio-console device, that specifically
does not use a virtual console (vc) back-end. (Note that Red Hat does not
support invoking "qemu-kvm" from the command line without "-nodefaults" on
Red Hat Enterprise Linux 6.)

* Guests that were managed via libvirt, such as when using Virtual Machine
Manager (virt-manager), but that have a serial or parallel device, or a
virtio-console device, that uses a virtual console back-end. By default,
guests managed via libvirt will not use a virtual console back-end
for such devices.

Red Hat would like to thank the Xen project for reporting this issue.

All users of qemu-kvm should upgrade to these updated packages, which
resolve this issue. After installing this update, shut down all running
virtual machines. Once all virtual machines have shut down, start them
again for this update to take effect.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Updated packages

Red Hat Enterprise Linux Desktop (v. 6)

SRPMS:
qemu-kvm-0.12.1.2-2.295.el6_3.2.src.rpm
File outdated by:  RHBA-2014:0360
    MD5: a6870d1d1706500e02ee0361f5e019d3
SHA-256: bca8b67ad7c9a0db1441a672e6aead7384422770b223bcfec0371a6e9e73102b
 
x86_64:
qemu-guest-agent-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: bdcccbcc37d420057ee744a86a473239
SHA-256: 1e23a1060fbca0df3d9ad45f8bc2d497fd457d36058616a60e7e1e0966671a76
qemu-img-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 8e021f2d80e1e4f05dc2ecbbd6a88d87
SHA-256: 1bbd9f94d426d0edbf065fa5dcd8e13e41ff0005870e5f4d2f2f09f1a3969ef8
qemu-kvm-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 4f7cd3df31060d35ded8049dab2abed1
SHA-256: 52368822335489e09fd2e6451c11564e30c13a133f57fc42c901c2b34ec03e0b
qemu-kvm-debuginfo-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: cc946d93f17c5f60f4a6d2ed65ca8aa4
SHA-256: 2eeb6dc6efe65db4ae36ff6eefee9ad50b9921b8b2799548f2af9a5b536f1012
qemu-kvm-tools-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: b99c51f25ca34b6405b944ab81bdd7b1
SHA-256: c06cc8f29a84eff8b7d380db04e08b2133ead7bf303527c006ee4482b520000c
 
Red Hat Enterprise Linux HPC Node (v. 6)

SRPMS:
qemu-kvm-0.12.1.2-2.295.el6_3.2.src.rpm
File outdated by:  RHBA-2014:0360
    MD5: a6870d1d1706500e02ee0361f5e019d3
SHA-256: bca8b67ad7c9a0db1441a672e6aead7384422770b223bcfec0371a6e9e73102b
 
x86_64:
qemu-guest-agent-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: bdcccbcc37d420057ee744a86a473239
SHA-256: 1e23a1060fbca0df3d9ad45f8bc2d497fd457d36058616a60e7e1e0966671a76
qemu-img-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 8e021f2d80e1e4f05dc2ecbbd6a88d87
SHA-256: 1bbd9f94d426d0edbf065fa5dcd8e13e41ff0005870e5f4d2f2f09f1a3969ef8
qemu-kvm-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 4f7cd3df31060d35ded8049dab2abed1
SHA-256: 52368822335489e09fd2e6451c11564e30c13a133f57fc42c901c2b34ec03e0b
qemu-kvm-debuginfo-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: cc946d93f17c5f60f4a6d2ed65ca8aa4
SHA-256: 2eeb6dc6efe65db4ae36ff6eefee9ad50b9921b8b2799548f2af9a5b536f1012
qemu-kvm-tools-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: b99c51f25ca34b6405b944ab81bdd7b1
SHA-256: c06cc8f29a84eff8b7d380db04e08b2133ead7bf303527c006ee4482b520000c
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
qemu-kvm-0.12.1.2-2.295.el6_3.2.src.rpm
File outdated by:  RHBA-2014:0360
    MD5: a6870d1d1706500e02ee0361f5e019d3
SHA-256: bca8b67ad7c9a0db1441a672e6aead7384422770b223bcfec0371a6e9e73102b
 
x86_64:
qemu-guest-agent-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: bdcccbcc37d420057ee744a86a473239
SHA-256: 1e23a1060fbca0df3d9ad45f8bc2d497fd457d36058616a60e7e1e0966671a76
qemu-img-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 8e021f2d80e1e4f05dc2ecbbd6a88d87
SHA-256: 1bbd9f94d426d0edbf065fa5dcd8e13e41ff0005870e5f4d2f2f09f1a3969ef8
qemu-kvm-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 4f7cd3df31060d35ded8049dab2abed1
SHA-256: 52368822335489e09fd2e6451c11564e30c13a133f57fc42c901c2b34ec03e0b
qemu-kvm-debuginfo-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: cc946d93f17c5f60f4a6d2ed65ca8aa4
SHA-256: 2eeb6dc6efe65db4ae36ff6eefee9ad50b9921b8b2799548f2af9a5b536f1012
qemu-kvm-tools-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: b99c51f25ca34b6405b944ab81bdd7b1
SHA-256: c06cc8f29a84eff8b7d380db04e08b2133ead7bf303527c006ee4482b520000c
 
Red Hat Enterprise Linux Server EUS (v. 6.3.z)

SRPMS:
qemu-kvm-0.12.1.2-2.295.el6_3.2.src.rpm
File outdated by:  RHBA-2014:0360
    MD5: a6870d1d1706500e02ee0361f5e019d3
SHA-256: bca8b67ad7c9a0db1441a672e6aead7384422770b223bcfec0371a6e9e73102b
 
x86_64:
qemu-guest-agent-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2012:1582
    MD5: bdcccbcc37d420057ee744a86a473239
SHA-256: 1e23a1060fbca0df3d9ad45f8bc2d497fd457d36058616a60e7e1e0966671a76
qemu-img-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2012:1582
    MD5: 8e021f2d80e1e4f05dc2ecbbd6a88d87
SHA-256: 1bbd9f94d426d0edbf065fa5dcd8e13e41ff0005870e5f4d2f2f09f1a3969ef8
qemu-kvm-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2012:1582
    MD5: 4f7cd3df31060d35ded8049dab2abed1
SHA-256: 52368822335489e09fd2e6451c11564e30c13a133f57fc42c901c2b34ec03e0b
qemu-kvm-debuginfo-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2012:1582
    MD5: cc946d93f17c5f60f4a6d2ed65ca8aa4
SHA-256: 2eeb6dc6efe65db4ae36ff6eefee9ad50b9921b8b2799548f2af9a5b536f1012
qemu-kvm-tools-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2012:1582
    MD5: b99c51f25ca34b6405b944ab81bdd7b1
SHA-256: c06cc8f29a84eff8b7d380db04e08b2133ead7bf303527c006ee4482b520000c
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
qemu-kvm-0.12.1.2-2.295.el6_3.2.src.rpm
File outdated by:  RHBA-2014:0360
    MD5: a6870d1d1706500e02ee0361f5e019d3
SHA-256: bca8b67ad7c9a0db1441a672e6aead7384422770b223bcfec0371a6e9e73102b
 
x86_64:
qemu-guest-agent-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: bdcccbcc37d420057ee744a86a473239
SHA-256: 1e23a1060fbca0df3d9ad45f8bc2d497fd457d36058616a60e7e1e0966671a76
qemu-img-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 8e021f2d80e1e4f05dc2ecbbd6a88d87
SHA-256: 1bbd9f94d426d0edbf065fa5dcd8e13e41ff0005870e5f4d2f2f09f1a3969ef8
qemu-kvm-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: 4f7cd3df31060d35ded8049dab2abed1
SHA-256: 52368822335489e09fd2e6451c11564e30c13a133f57fc42c901c2b34ec03e0b
qemu-kvm-debuginfo-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: cc946d93f17c5f60f4a6d2ed65ca8aa4
SHA-256: 2eeb6dc6efe65db4ae36ff6eefee9ad50b9921b8b2799548f2af9a5b536f1012
qemu-kvm-tools-0.12.1.2-2.295.el6_3.2.x86_64.rpm
File outdated by:  RHBA-2014:0360
    MD5: b99c51f25ca34b6405b944ab81bdd7b1
SHA-256: c06cc8f29a84eff8b7d380db04e08b2133ead7bf303527c006ee4482b520000c
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

851252 - CVE-2012-3515 qemu: VT100 emulation vulnerability


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/