rhsa-2010_0172
Vulnerability from csaf_redhat
Published
2010-03-24 15:46
Modified
2024-11-14 10:48
Summary
Red Hat Security Advisory: rhev-hypervisor security and bug fix update

Notes

Topic
An updated rhev-hypervisor package that fixes multiple security issues and several bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.
Details
The rhev-hypervisor package provides a Red Hat Enterprise Virtualization (RHEV) Hypervisor ISO disk image. The RHEV Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: RHEV Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. A flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially-crafted SCTP packet to a target system, resulting in a denial of service. (CVE-2010-0008) A flaw was found in the way the x86 emulator in KVM loaded segment selectors (used for memory segmentation and protection) into segment registers. In some guest system configurations, an unprivileged guest user could leverage this flaw to crash the guest or possibly escalate their privileges within the guest. (CVE-2010-0419) The KVM x86 emulator implementation was missing a check for the Current Privilege Level (CPL) while accessing debug registers. An unprivileged user in a guest could leverage this flaw to crash the guest. (CVE-2009-3722) A flaw was found in the USB passthrough handling code in KVM. A specially-crafted USB packet sent from inside a guest could be used to trigger a buffer overflow in the usb_host_handle_control() function, which runs under the QEMU-KVM context on the host. A user in a guest could leverage this flaw to cause a denial of service (guest hang or crash) or possibly escalate their privileges within the host. (CVE-2010-0297) This updated package provides updated components that include fixes for security issues; however, these issues have no security impact for RHEV Hypervisor. These fixes are for kernel issues CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0415, and CVE-2010-0437; and sudo issues CVE-2010-0426 and CVE-2010-0427. This update also fixes the following bugs: * the required storage device driver was not detected correctly by mkdumprd when using multipath devices. When RHEV Hypervisor was installed on a multipath device, kdump was unable to mount the logical volume to store the kernel core dump; therefore, the core dump would not be recorded. With this update, multipath support has been added to the mkdumprd tool, which resolves this issue. (BZ#569459) As RHEV Hypervisor is based on KVM, the bug fixes from KVM updates RHSA-2010:0126 and RHBA-2010:0158 have been included in this update: https://rhn.redhat.com/errata/RHSA-2010-0126.html https://rhn.redhat.com/errata/RHBA-2010-0158.html Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which corrects these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated rhev-hypervisor package that fixes multiple security issues and\nseveral bugs is now available.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The rhev-hypervisor package provides a Red Hat Enterprise Virtualization\n(RHEV) Hypervisor ISO disk image. The RHEV Hypervisor is a dedicated\nKernel-based Virtual Machine (KVM) hypervisor. It includes everything\nnecessary to run and manage virtual machines: A subset of the Red Hat\nEnterprise Linux operating environment and the Red Hat Enterprise\nVirtualization Agent.\n\nNote: RHEV Hypervisor is only available for the Intel 64 and AMD64\narchitectures with virtualization extensions.\n\nA flaw was found in the sctp_rcv_ootb() function in the Linux kernel Stream\nControl Transmission Protocol (SCTP) implementation. A remote attacker\ncould send a specially-crafted SCTP packet to a target system, resulting in\na denial of service. (CVE-2010-0008)\n\nA flaw was found in the way the x86 emulator in KVM loaded segment\nselectors (used for memory segmentation and protection) into segment\nregisters. In some guest system configurations, an unprivileged guest user\ncould leverage this flaw to crash the guest or possibly escalate their\nprivileges within the guest. (CVE-2010-0419)\n\nThe KVM x86 emulator implementation was missing a check for the Current\nPrivilege Level (CPL) while accessing debug registers. An unprivileged user\nin a guest could leverage this flaw to crash the guest. (CVE-2009-3722)\n\nA flaw was found in the USB passthrough handling code in KVM. A\nspecially-crafted USB packet sent from inside a guest could be used to\ntrigger a buffer overflow in the usb_host_handle_control() function, which\nruns under the QEMU-KVM context on the host. A user in a guest could\nleverage this flaw to cause a denial of service (guest hang or crash) or\npossibly escalate their privileges within the host. (CVE-2010-0297)\n\nThis updated package provides updated components that include fixes for\nsecurity issues; however, these issues have no security impact for RHEV\nHypervisor. These fixes are for kernel issues CVE-2009-4308, CVE-2010-0003,\nCVE-2010-0007, CVE-2010-0415, and CVE-2010-0437; and sudo issues\nCVE-2010-0426 and CVE-2010-0427.\n\nThis update also fixes the following bugs:\n\n* the required storage device driver was not detected correctly by mkdumprd\nwhen using multipath devices. When RHEV Hypervisor was installed on a\nmultipath device, kdump was unable to mount the logical volume to store the\nkernel core dump; therefore, the core dump would not be recorded. With this\nupdate, multipath support has been added to the mkdumprd tool, which\nresolves this issue. (BZ#569459)\n\nAs RHEV Hypervisor is based on KVM, the bug fixes from KVM updates\nRHSA-2010:0126 and RHBA-2010:0158 have been included in this update:\n\nhttps://rhn.redhat.com/errata/RHSA-2010-0126.html\nhttps://rhn.redhat.com/errata/RHBA-2010-0158.html\n\nUsers of the Red Hat Enterprise Virtualization Hypervisor are advised to\nupgrade to this updated package, which corrects these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2010:0172",
        "url": "https://access.redhat.com/errata/RHSA-2010:0172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "531660",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=531660"
      },
      {
        "category": "external",
        "summary": "555658",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=555658"
      },
      {
        "category": "external",
        "summary": "557025",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=557025"
      },
      {
        "category": "external",
        "summary": "563463",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=563463"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0172.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhev-hypervisor security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T10:48:27+00:00",
      "generator": {
        "date": "2024-11-14T10:48:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2010:0172",
      "initial_release_date": "2010-03-24T15:46:00+00:00",
      "revision_history": [
        {
          "date": "2010-03-24T15:46:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2010-03-24T11:46:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T10:48:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Virtualization Hypervisor 5",
                "product": {
                  "name": "Red Hat Enterprise Virtualization Hypervisor 5",
                  "product_id": "5Server-RHEV-Hypervisor-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::hypervisor"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                "product": {
                  "name": "rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                  "product_id": "rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhev-hypervisor-pxe@5.4-2.1.10.el5_4rhev2_1?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                "product": {
                  "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                  "product_id": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhev-hypervisor@5.4-2.1.10.el5_4rhev2_1?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
                "product": {
                  "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
                  "product_id": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhev-hypervisor@5.4-2.1.10.el5_4rhev2_1?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch as a component of Red Hat Enterprise Virtualization Hypervisor 5",
          "product_id": "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        },
        "product_reference": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
        "relates_to_product_reference": "5Server-RHEV-Hypervisor-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src as a component of Red Hat Enterprise Virtualization Hypervisor 5",
          "product_id": "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src"
        },
        "product_reference": "rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
        "relates_to_product_reference": "5Server-RHEV-Hypervisor-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch as a component of Red Hat Enterprise Virtualization Hypervisor 5",
          "product_id": "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        },
        "product_reference": "rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch",
        "relates_to_product_reference": "5Server-RHEV-Hypervisor-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-3722",
      "discovery_date": "2009-10-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "531660"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "KVM: Check cpl before emulating debug register access",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3722\n\nThe Red Hat Product Security has rated this issue as having moderate security impact, a future update will address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2009-3722"
        },
        {
          "category": "external",
          "summary": "RHBZ#531660",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=531660"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2009-3722",
          "url": "https://www.cve.org/CVERecord?id=CVE-2009-3722"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2009-3722",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3722"
        }
      ],
      "release_date": "2009-09-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-03-24T15:46:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0172"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 4.9,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "products": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "KVM: Check cpl before emulating debug register access"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Telesys Software"
          ]
        }
      ],
      "cve": "CVE-2010-0008",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2009-01-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "555658"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: sctp remote denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3 as it did not include support for SCTP. It did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG as it has already had the fix to this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2010-0008"
        },
        {
          "category": "external",
          "summary": "RHBZ#555658",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=555658"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2010-0008",
          "url": "https://www.cve.org/CVERecord?id=CVE-2010-0008"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-0008",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0008"
        }
      ],
      "release_date": "2010-03-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-03-24T15:46:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0172"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.8,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "products": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: sctp remote denial of service"
    },
    {
      "cve": "CVE-2010-0297",
      "discovery_date": "2010-01-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "557025"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted USB packet.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kvm-userspace-rhel5: usb-linux.c: fix buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2010-0297"
        },
        {
          "category": "external",
          "summary": "RHBZ#557025",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=557025"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2010-0297",
          "url": "https://www.cve.org/CVERecord?id=CVE-2010-0297"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-0297",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0297"
        }
      ],
      "release_date": "2009-10-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-03-24T15:46:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0172"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          "products": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kvm-userspace-rhel5: usb-linux.c: fix buffer overflow"
    },
    {
      "cve": "CVE-2010-0419",
      "discovery_date": "2010-02-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "563463"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not properly restrict writing of segment selectors to segment registers, which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kvm: emulator privilege escalation segment selector check",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
          "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2010-0419"
        },
        {
          "category": "external",
          "summary": "RHBZ#563463",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=563463"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2010-0419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2010-0419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2010-0419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0419"
        }
      ],
      "release_date": "2010-03-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2010-03-24T15:46:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259",
          "product_ids": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2010:0172"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.9,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "products": [
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.noarch",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-0:5.4-2.1.10.el5_4rhev2_1.src",
            "5Server-RHEV-Hypervisor-2:rhev-hypervisor-pxe-0:5.4-2.1.10.el5_4rhev2_1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kvm: emulator privilege escalation segment selector check"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.