FEDORA-2018-87f2ace20d — security update for qemu

stable

qemu-3.0.0-2.fc29

FEDORA-2018-87f2ace20d created by crobinso 5 years ago for Fedora 29

Fix cpu model crash on AMD hosts (bz #1640140)
CVE-2018-15746: seccomp blacklist is not applied to all threads (bz #1618357)
Fix assertion in address_space_stw_le_cached (bz #1644728)
CVE-2018-10839: ne2000: fix possible out of bound access (bz #1636429)
CVE-2018-17958: rtl8139: fix possible out of bound access (bz #1636729)
CVE-2018-17962: pcnet: fix possible buffer overflow (bz #1636775)
CVE-2018-17963: net: ignore packet size greater than INT_MAX (bz #1636782)
CVE-2018-18849: lsi53c895a: OOB msg buffer access leads to DoS (bz #1644977)
CVE-2018-18954: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb (bz #1645442)

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2018-87f2ace20d

This update has been submitted for testing by crobinso.

5 years ago

This update has been pushed to testing.

5 years ago

lantw44 commented & provided feedback 5 years ago

Thanks for the update, it is able to run OpenBSD guest with VirtIO network interface without crash now.

BZ#1644728 OSv build fails because of qemu assertion failure

lantw44 commented & provided feedback 5 years ago

Thanks for the update, it is able to run OpenBSD guest with VirtIO network interface without crash now.

BZ#1644728 OSv build fails because of qemu assertion failure

atim commented & provided feedback 5 years ago

Seems fine and #1640140 fixed since i can create VM on AMD x4 845.

BZ#1640140 cpu mode=host-model causes guest kernel panics for AMD hosts

filiperosset commented & provided feedback 5 years ago

karma

no regressions noted

besser82 commented & provided feedback 5 years ago

karma

Works great! LGTM! =)

ngompa commented & provided feedback 5 years ago

karma

Works for me.

lbrabec commented & provided feedback 5 years ago

karma

works for me

BZ#1640140 cpu mode=host-model causes guest kernel panics for AMD hosts

lbrabec commented & provided feedback 5 years ago

karma

works for me

BZ#1640140 cpu mode=host-model causes guest kernel panics for AMD hosts

cserpentis commented & provided feedback 5 years ago

karma

works for me

pwalter commented & provided feedback 5 years ago

karma

Works

andilinux commented & provided feedback 5 years ago

karma

works fine

davisclick commented & provided feedback 5 years ago

karma

Works as usual.

davisclick commented & provided feedback 5 years ago

karma

Works as usual.

kparal commented & provided feedback 5 years ago

karma

my existing VMs boot fine

ozeszty commented & provided feedback 5 years ago

karma

No regressions spotted with VMs on IvyBridge host.

ozeszty commented & provided feedback 5 years ago

karma

No regressions spotted with VMs on IvyBridge host.

This update has reached the stable karma threshold and can be pushed to stable now if the maintainer wishes.

5 years ago

This update has been submitted for batched by bonzini.

5 years ago

This update has been submitted for stable by bonzini.

5 years ago

This update has been pushed to stable.

5 years ago

Please login to add feedback.

Metadata

Type

security

Severity

low

Karma

Signed

Content Type

RPM

Test Gating

ignored

Builds

qemu-3.0.0-2.fc29

Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

5 years ago

in testing

5 years ago

in stable

5 years ago

BZ#1526029 CVE-2018-18954 QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb

BZ#1581013 CVE-2018-10839 Qemu: ne2000: integer overflow leads to buffer overflow issue

BZ#1615637 CVE-2018-15746 Qemu: seccomp: blacklist is not applied to all threads

BZ#1618357 qemu: seccomp: blacklist is not applied to all threads [fedora-all]

BZ#1636429 CVE-2018-10839 qemu: ne2000: integer overflow leads to buffer overflow issue [fedora-all]

BZ#1636712 CVE-2018-17958 Qemu: rtl8139: integer overflow leads to buffer overflow

BZ#1636729 CVE-2018-17958 qemu: rtl8139: integer overflow leads to buffer overflow [fedora-all]

BZ#1636773 CVE-2018-17962 Qemu: pcnet: integer overflow leads to buffer overflow

BZ#1636775 CVE-2018-17962 qemu: pcnet: integer overflow leads to buffer overflow [fedora-all]

BZ#1636777 CVE-2018-17963 QEMU: net: ignore packets with large size

BZ#1636782 CVE-2018-17963 qemu: net: ignore packets with large size [fedora-all]

BZ#1640140 cpu mode=host-model causes guest kernel panics for AMD hosts

BZ#1644728 OSv build fails because of qemu assertion failure

BZ#1644973 CVE-2018-18849 QEMU: lsi53c895a: OOB msg buffer access leads to DoS

BZ#1644977 CVE-2018-18849 qemu: lsi53c895a: OOB msg buffer access leads to DoS [fedora-all]

BZ#1645442 CVE-2018-16847 qemu: nvme: Out-of-bounds r/w buffer access in cmb operations [fedora-all]

qemu-3.0.0-2.fc29

Automated Test Results

ignored