libspice, as used in QEMU-KVM in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H or rhev-hypervisor) before 5.5-2.2 and possibly other products, allows guest OS users to read from or write to arbitrary QEMU memory by modifying the address that is used by Cairo for memory mappings.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0271 advisory.

    - Resolves: bz#563465       (EMBARGOED CVE-2010-0419 kvm: emulator privilege escalation segment selector check [rhel-5.5])
    - kvm-CVE-2010-0297-usb-linux.c-fix-buffer-overflow.patch [bz#560770]
    - Resolves: bz#560770       (CVE-2010-0297 kvm-userspace-rhel5: usb-linux.c: fix buffer overflow [rhel-5.5])
    - Resolves: bz#553126       (CVE-2010-0309 kvm: cat /dev/port in guest cause the host hang [rhel-5.5])
    - Resolves: bz#559095       (EMBARGOED CVE-2010-0298 kvm: emulator privilege escalation [rhel-5.5])
    - Resolves: bz#560698       (EMBARGOED CVE-2010-0306 kvm: emulator privilege escalation IOPL/CPL level check [rhel-5.5])
    - Resolves: bz#541165       (CVE-2009-4031 kernel: KVM: x86 emulator: limit instructions to 15 bytes [rhel-5.5])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An updated rhev-hypervisor package that fixes two security issues, multiple bugs, and adds enhancements is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found in the way QEMU-KVM handled erroneous data provided by the Linux virtio-net driver, used by guest operating systems. Due to a deficiency in the TSO (TCP segment offloading) implementation, a guest's virtio-net driver would transmit improper data to a certain QEMU-KVM process on the host, causing the guest to crash. A remote attacker could use this flaw to send specially crafted data to a target guest system, causing that guest to crash. (CVE-2010-0741)

A flaw was found in the way the Virtual Desktop Server Manager (VDSM) handled the removal of a virtual machine's (VM) data back end (such as an image or a volume). When removing an image or a volume, it was not securely deleted from its corresponding data domain as expected. A guest user in a new, raw VM, created in a data domain that has had VMs deleted from it, could use this flaw to read limited data from those deleted VMs, potentially disclosing sensitive information.
(CVE-2010-2223)

This updated package provides updated components that include fixes for security issues; however, these issues have no security impact for Red Hat Enterprise Virtualization Hypervisor. These fixes are for dbus issue CVE-2009-1189; kernel issues CVE-2010-0307, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, and CVE-2010-1086; openldap issue CVE-2009-3767; and sudo issues CVE-2010-0426, CVE-2010-0427, and CVE-2010-1163.

This update also fixes several bugs and adds several enhancements.
Documentation for these bug fixes and enhancements is available from http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/2.2 /html/ Servers-5.5-2.2_Hypervisor_Security_Update

As Red Hat Enterprise Virtualization Hypervisor is based on KVM, the bug fixes and enhancements from the KVM updates RHSA-2010:0271 and RHBA-2010:0419 have been included in this update. Also included are the bug fixes and enhancements from the Virtual Desktop Server Manager (VDSM) update RHSA-2010:0473, and fence-agents update RHBA-2010:0477.

KVM: https://rhn.redhat.com/errata/RHSA-2010-0271.html and https://rhn.redhat.com/errata/RHBA-2010-0419.html VDSM:
https://rhn.redhat.com/errata/RHSA-2010-0473.html fence-agents:
https://rhn.redhat.com/errata/RHBA-2010-0477.html

Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which corrects these issues and adds these enhancements.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0271 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for     the standard Red Hat Enterprise Linux kernel.

    A flaw was found in the way QEMU-KVM handled erroneous data provided by     the Linux virtio-net driver, used by guest operating systems. Due to a     deficiency in the TSO (TCP segment offloading) implementation, a guest's     virtio-net driver would transmit improper data to a certain QEMU-KVM     process on the host, causing the guest to crash. A remote attacker could     use this flaw to send specially-crafted data to a target guest system,     causing that guest to crash. (CVE-2010-0741)

    Additionally, these updated packages include numerous bug fixes and     enhancements. Refer to the KVM chapter of the Red Hat Enterprise Linux 5.5     Technical Notes for details:

    http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5.5/html/Technical_Notes/kvm.html

    All KVM users should upgrade to these updated packages, which resolve this     issue as well as fixing the bugs and adding the enhancements noted in the     Technical Notes. Note: The procedure in the Solution section must be     performed before this update will take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181100	Oracle Linux 5 : kvm (ELSA-2010-0271)	Nessus	Oracle Linux Local Security Checks	high
79275	RHEL 5 : rhev-hypervisor (RHSA-2010:0476)	Nessus	Red Hat Local Security Checks	high
63924	RHEL 5 : kvm (RHSA-2010:0271)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2010-0430

high

Tenable Plugins

high

high

high