Описание
ELSA-2022-7967: qemu-kvm security, bug fix, and enhancement update (MODERATE)
[7.0.0-13]
- kvm-i386-reset-KVM-nested-state-upon-CPU-reset.patch [bz#2117546]
- kvm-i386-do-kvm_put_msr_feature_control-first-thing-when.patch [bz#2117546]
- Resolves: bz#2117546 ([RHEL9.1] Guests in VMX root operation fail to reboot with QEMUs system_reset command)
[7.0.0-12]
- kvm-scsi-generic-Fix-emulated-block-limits-VPD-page.patch [bz#2120275]
- kvm-vhost-Get-vring-base-from-vq-not-svq.patch [bz#2114060]
- kvm-vdpa-Skip-the-maps-not-in-the-iova-tree.patch [bz#2114060]
- kvm-vdpa-do-not-save-failed-dma-maps-in-SVQ-iova-tree.patch [bz#2114060]
- kvm-util-Return-void-on-iova_tree_remove.patch [bz#2114060]
- kvm-util-accept-iova_tree_remove_parameter-by-value.patch [bz#2114060]
- kvm-vdpa-Remove-SVQ-vring-from-iova_tree-at-shutdown.patch [bz#2114060]
- kvm-vdpa-Make-SVQ-vring-unmapping-return-void.patch [bz#2114060]
- kvm-vhost-Always-store-new-kick-fd-on-vhost_svq_set_svq_.patch [bz#2114060]
- kvm-vdpa-Use-ring-hwaddr-at-vhost_vdpa_svq_unmap_ring.patch [bz#2114060]
- kvm-vhost-stop-transfer-elem-ownership-in-vhost_handle_g.patch [bz#2114060]
- kvm-vhost-use-SVQ-element-ndescs-instead-of-opaque-data-.patch [bz#2114060]
- kvm-vhost-Delete-useless-read-memory-barrier.patch [bz#2114060]
- kvm-vhost-Do-not-depend-on-NULL-VirtQueueElement-on-vhos.patch [bz#2114060]
- kvm-vhost_net-Add-NetClientInfo-start-callback.patch [bz#2114060]
- kvm-vhost_net-Add-NetClientInfo-stop-callback.patch [bz#2114060]
- kvm-vdpa-add-net_vhost_vdpa_cvq_info-NetClientInfo.patch [bz#2114060]
- kvm-vdpa-Move-command-buffers-map-to-start-of-net-device.patch [bz#2114060]
- kvm-vdpa-extract-vhost_vdpa_net_cvq_add-from-vhost_vdpa_.patch [bz#2114060]
- kvm-vhost_net-add-NetClientState-load-callback.patch [bz#2114060]
- kvm-vdpa-Add-virtio-net-mac-address-via-CVQ-at-start.patch [bz#2114060]
- kvm-vdpa-Delete-CVQ-migration-blocker.patch [bz#2114060]
- kvm-virtio-scsi-fix-race-in-virtio_scsi_dataplane_start.patch [bz#2099541]
- Resolves: bz#2120275 (Wrong max_sectors_kb and Maximum transfer length on the pass-through device [rhel-9.1])
- Resolves: bz#2114060 (vDPA state restore support through control virtqueue in Qemu)
- Resolves: bz#2099541 (qemu coredump with error Assertion qemu_mutex_iothread_locked() failed when repeatly hotplug/unplug disks in pause status)
[7.0.0-11]
- kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch [bz#2107466]
- kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch [bz#2107466]
- kvm-migration-multifd-Report-to-user-when-zerocopy-not-w.patch [bz#2107466]
- kvm-migration-Avoid-false-positive-on-non-supported-scen.patch [bz#2107466]
- kvm-migration-add-remaining-params-has_-true-in-migratio.patch [bz#2107466]
- kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch [bz#2107466]
- kvm-pc-bios-s390-ccw-Fix-booting-with-logical-block-size.patch [bz#2112303]
- kvm-vdpa-Fix-bad-index-calculus-at-vhost_vdpa_get_vring_.patch [bz#2116876]
- kvm-vdpa-Fix-index-calculus-at-vhost_vdpa_svqs_start.patch [bz#2116876]
- kvm-vdpa-Fix-memory-listener-deletions-of-iova-tree.patch [bz#2116876]
- kvm-vdpa-Fix-file-descriptor-leak-on-get-features-error.patch [bz#2116876]
- Resolves: bz#2107466 (zerocopy capability can be enabled when set migrate capabilities with multifd and compress/xbzrle together)
- Resolves: bz#2112303 (virtio-blk: Cant boot fresh installation from used 512 cluster_size image under certain conditions)
- Resolves: bz#2116876 (Fixes for vDPA control virtqueue support in Qemu)
[7.0.0-10]
- kvm-vhost-Track-descriptor-chain-in-private-at-SVQ.patch [bz#1939363]
- kvm-vhost-Fix-device-s-used-descriptor-dequeue.patch [bz#1939363]
- kvm-hw-virtio-Replace-g_memdup-by-g_memdup2.patch [bz#1939363]
- kvm-vhost-Fix-element-in-vhost_svq_add-failure.patch [bz#1939363]
- kvm-meson-create-have_vhost_-variables.patch [bz#1939363]
- kvm-meson-use-have_vhost_-variables-to-pick-sources.patch [bz#1939363]
- kvm-vhost-move-descriptor-translation-to-vhost_svq_vring.patch [bz#1939363]
- kvm-virtio-net-Expose-MAC_TABLE_ENTRIES.patch [bz#1939363]
- kvm-virtio-net-Expose-ctrl-virtqueue-logic.patch [bz#1939363]
- kvm-vdpa-Avoid-compiler-to-squash-reads-to-used-idx.patch [bz#1939363]
- kvm-vhost-Reorder-vhost_svq_kick.patch [bz#1939363]
- kvm-vhost-Move-vhost_svq_kick-call-to-vhost_svq_add.patch [bz#1939363]
- kvm-vhost-Check-for-queue-full-at-vhost_svq_add.patch [bz#1939363]
- kvm-vhost-Decouple-vhost_svq_add-from-VirtQueueElement.patch [bz#1939363]
- kvm-vhost-Add-SVQDescState.patch [bz#1939363]
- kvm-vhost-Track-number-of-descs-in-SVQDescState.patch [bz#1939363]
- kvm-vhost-add-vhost_svq_push_elem.patch [bz#1939363]
- kvm-vhost-Expose-vhost_svq_add.patch [bz#1939363]
- kvm-vhost-add-vhost_svq_poll.patch [bz#1939363]
- kvm-vhost-Add-svq-avail_handler-callback.patch [bz#1939363]
- kvm-vdpa-Export-vhost_vdpa_dma_map-and-unmap-calls.patch [bz#1939363]
- kvm-vhost-net-vdpa-add-stubs-for-when-no-virtio-net-devi.patch [bz#1939363]
- kvm-vdpa-manual-forward-CVQ-buffers.patch [bz#1939363]
- kvm-vdpa-Buffer-CVQ-support-on-shadow-virtqueue.patch [bz#1939363]
- kvm-vdpa-Extract-get-features-part-from-vhost_vdpa_get_m.patch [bz#1939363]
- kvm-vdpa-Add-device-migration-blocker.patch [bz#1939363]
- kvm-vdpa-Add-x-svq-to-NetdevVhostVDPAOptions.patch [bz#1939363]
- kvm-redhat-Update-linux-headers-linux-kvm.h-to-v5.18-rc6.patch [bz#2111994]
- kvm-target-s390x-kvm-Honor-storage-keys-during-emulation.patch [bz#2111994]
- kvm-kvm-don-t-use-perror-without-useful-errno.patch [bz#2095608]
- kvm-multifd-Copy-pages-before-compressing-them-with-zlib.patch [bz#2099934]
- kvm-Revert-migration-Simplify-unqueue_page.patch [bz#2099934]
- Resolves: bz#1939363 (vDPA control virtqueue support in Qemu)
- Resolves: bz#2111994 (RHEL9: skey test in kvm_unit_test got failed)
- Resolves: bz#2095608 (Please correct the error message when try to start qemu with -M kernel-irqchip=split)
- Resolves: bz#2099934 (Guest reboot on destination host after postcopy migration completed)
[7.0.0-9]
- kvm-virtio-iommu-Add-bypass-mode-support-to-assigned-dev.patch [bz#2100106]
- kvm-virtio-iommu-Use-recursive-lock-to-avoid-deadlock.patch [bz#2100106]
- kvm-virtio-iommu-Add-an-assert-check-in-translate-routin.patch [bz#2100106]
- kvm-virtio-iommu-Fix-the-partial-copy-of-probe-request.patch [bz#2100106]
- kvm-virtio-iommu-Fix-migration-regression.patch [bz#2100106]
- kvm-pc-bios-s390-ccw-virtio-Introduce-a-macro-for-the-DA.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-bootmap-Improve-the-guessing-logic-.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-blkdev-Simplify-fix-virtio_i.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-blkdev-Remove-virtio_assume_.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-Set-missing-status-bits-whil.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-Read-device-config-after-fea.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-Beautify-the-code-for-readin.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-Split-virtio-scsi-code-from-virtio_.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-virtio-blkdev-Request-the-right-fea.patch [bz#2098077]
- kvm-pc-bios-s390-ccw-netboot.mak-Ignore-Clang-s-warnings.patch [bz#2098077]
- kvm-hw-block-fdc-Prevent-end-of-track-overrun-CVE-2021-3.patch [bz#1951522]
- kvm-tests-qtest-fdc-test-Add-a-regression-test-for-CVE-2.patch [bz#1951522]
- Resolves: bz#2100106 (Fix virtio-iommu/vfio bypass)
- Resolves: bz#2098077 (virtio-blk: Cant boot fresh installation from used virtio-blk dasd disk under certain conditions)
- Resolves: bz#1951522 (CVE-2021-3507 qemu-kvm: QEMU: fdc: heap buffer overflow in DMA read data transfers [rhel-9.0])
[7.0.0-8]
- kvm-tests-avocado-update-aarch64_virt-test-to-exercise-c.patch [bz#2060839]
- kvm-RHEL-only-tests-avocado-Switch-aarch64-tests-from-a5.patch [bz#2060839]
- kvm-RHEL-only-AArch64-Drop-unsupported-CPU-types.patch [bz#2060839]
- kvm-target-i386-deprecate-CPUs-older-than-x86_64-v2-ABI.patch [bz#2060839]
- kvm-target-s390x-deprecate-CPUs-older-than-z14.patch [bz#2060839]
- kvm-target-arm-deprecate-named-CPU-models.patch [bz#2060839]
- kvm-meson.build-Fix-docker-test-build-alpine-when-includ.patch [bz#1968509]
- kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch [bz#1968509]
- kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch [bz#1968509]
- kvm-migration-Add-zero-copy-send-parameter-for-QMP-HMP-f.patch [bz#1968509]
- kvm-migration-Add-migrate_use_tls-helper.patch [bz#1968509]
- kvm-multifd-multifd_send_sync_main-now-returns-negative-.patch [bz#1968509]
- kvm-multifd-Send-header-packet-without-flags-if-zero-cop.patch [bz#1968509]
- kvm-multifd-Implement-zero-copy-write-in-multifd-migrati.patch [bz#1968509]
- kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch [bz#1968509]
- kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch [bz#1968509]
- kvm-migration-Change-zero_copy_send-from-migration-param.patch [bz#1968509]
- kvm-migration-Allow-migrate-recover-to-run-multiple-time.patch [bz#2096143]
- Resolves: bz#2060839 (Consider deprecating CPU models like kvm64 / qemu64 on RHEL 9)
- Resolves: bz#1968509 (Use MSG_ZEROCOPY on QEMU Live Migration)
- Resolves: bz#2096143 (The migration port is not released if use it again for recovering postcopy migration)
[7.0.0-7]
- kvm-coroutine-ucontext-use-QEMU_DEFINE_STATIC_CO_TLS.patch [bz#1952483]
- kvm-coroutine-use-QEMU_DEFINE_STATIC_CO_TLS.patch [bz#1952483]
- kvm-coroutine-win32-use-QEMU_DEFINE_STATIC_CO_TLS.patch [bz#1952483]
- kvm-Enable-virtio-iommu-pci-on-x86_64.patch [bz#2094252]
- kvm-linux-aio-fix-unbalanced-plugged-counter-in-laio_io_.patch [bz#2092788]
- kvm-linux-aio-explain-why-max-batch-is-checked-in-laio_i.patch [bz#2092788]
- Resolves: bz#1952483 (RFE: QEMUs coroutines fail with CFLAGS=-flto on non-x86_64 architectures)
- Resolves: bz#2094252 (Compile the virtio-iommu device on x86_64)
- Resolves: bz#2092788 (Stalled IO Operations in VM)
[7.0.0-6]
- kvm-Introduce-event-loop-base-abstract-class.patch [bz#2031024]
- kvm-util-main-loop-Introduce-the-main-loop-into-QOM.patch [bz#2031024]
- kvm-util-event-loop-base-Introduce-options-to-set-the-th.patch [bz#2031024]
- kvm-qcow2-Improve-refcount-structure-rebuilding.patch [bz#2072379]
- kvm-iotests-108-Test-new-refcount-rebuild-algorithm.patch [bz#2072379]
- kvm-qcow2-Add-errp-to-rebuild_refcount_structure.patch [bz#2072379]
- kvm-iotests-108-Fix-when-missing-user_allow_other.patch [bz#2072379]
- kvm-virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch [bz#2070804]
- kvm-virtio-net-align-ctrl_vq-index-for-non-mq-guest-for-.patch [bz#2070804]
- kvm-vhost-vdpa-fix-improper-cleanup-in-net_init_vhost_vd.patch [bz#2070804]
- kvm-vhost-net-fix-improper-cleanup-in-vhost_net_start.patch [bz#2070804]
- kvm-vhost-vdpa-backend-feature-should-set-only-once.patch [bz#2070804]
- kvm-vhost-vdpa-change-name-and-polarity-for-vhost_vdpa_o.patch [bz#2070804]
- kvm-virtio-net-don-t-handle-mq-request-in-userspace-hand.patch [bz#2070804]
- kvm-Revert-globally-limit-the-maximum-number-of-CPUs.patch [bz#2094270]
- kvm-vfio-common-remove-spurious-warning-on-vfio_listener.patch [bz#2086262]
- Resolves: bz#2031024 (Add support for fixing thread pool size [QEMU])
- Resolves: bz#2072379 (Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs))
- Resolves: bz#2070804 (PXE boot crash qemu when using multiqueue vDPA)
- Resolves: bz#2094270 (Do not set the hard vCPU limit to the soft vCPU limit in downstream qemu-kvm anymore)
- Resolves: bz#2086262 ([Win11][tpm]vfio_listener_region_del received unaligned region)
[7.0.0-5]
- kvm-qemu-nbd-Pass-max-connections-to-blockdev-layer.patch [bz#1708300]
- kvm-nbd-server-Allow-MULTI_CONN-for-shared-writable-expo.patch [bz#1708300]
- Resolves: bz#1708300 (RFE: qemu-nbd vs NBD_FLAG_CAN_MULTI_CONN)
[7.0.0-4]
- kvm-qapi-machine.json-Add-cluster-id.patch [bz#2041823]
- kvm-qtest-numa-test-Specify-CPU-topology-in-aarch64_numa.patch [bz#2041823]
- kvm-hw-arm-virt-Consider-SMP-configuration-in-CPU-topolo.patch [bz#2041823]
- kvm-qtest-numa-test-Correct-CPU-and-NUMA-association-in-.patch [bz#2041823]
- kvm-hw-arm-virt-Fix-CPU-s-default-NUMA-node-ID.patch [bz#2041823]
- kvm-hw-acpi-aml-build-Use-existing-CPU-topology-to-build.patch [bz#2041823]
- kvm-coroutine-Rename-qemu_coroutine_inc-dec_pool_size.patch [bz#2079938]
- kvm-coroutine-Revert-to-constant-batch-size.patch [bz#2079938]
- kvm-virtio-scsi-fix-ctrl-and-event-handler-functions-in-.patch [bz#2079347]
- kvm-virtio-scsi-don-t-waste-CPU-polling-the-event-virtqu.patch [bz#2079347]
- kvm-virtio-scsi-clean-up-virtio_scsi_handle_event_vq.patch [bz#2079347]
- kvm-virtio-scsi-clean-up-virtio_scsi_handle_ctrl_vq.patch [bz#2079347]
- kvm-virtio-scsi-clean-up-virtio_scsi_handle_cmd_vq.patch [bz#2079347]
- kvm-virtio-scsi-move-request-related-items-from-.h-to-.c.patch [bz#2079347]
- kvm-Revert-virtio-scsi-Reject-scsi-cd-if-data-plane-enab.patch [bz#1995710]
- kvm-migration-Fix-operator-type.patch [bz#2064530]
- Resolves: bz#2041823 ([aarch64][numa] When there are at least 6 Numa nodes serial log shows arch topology borken)
- Resolves: bz#2079938 (qemu coredump when boot with multi disks (qemu) failed to set up stack guard page: Cannot allocate memory)
- Resolves: bz#2079347 (Guest boot blocked when scsi disks using same iothread and 100% CPU consumption)
- Resolves: bz#1995710 (RFE: Allow virtio-scsi CD-ROM media change with IOThreads)
- Resolves: bz#2064530 (Rebuild qemu-kvm with clang-14)
[7.0.0-3]
- kvm-hw-arm-virt-Remove-the-dtb-kaslr-seed-machine-option.patch [bz#2046029]
- kvm-hw-arm-virt-Fix-missing-initialization-in-instance-c.patch [bz#2046029]
- kvm-Enable-virtio-iommu-pci-on-aarch64.patch [bz#1477099]
- kvm-sysemu-tpm-Add-a-stub-function-for-TPM_IS_CRB.patch [bz#2037612]
- kvm-vfio-common-remove-spurious-tpm-crb-cmd-misalignment.patch [bz#2037612]
- Resolves: bz#2046029 ([WRB] New machine type property - dtb-kaslr-seed)
- Resolves: bz#1477099 (virtio-iommu (including ACPI, VHOST/VFIO integration, migration support))
- Resolves: bz#2037612 ([Win11][tpm][QL41112 PF] vfio_listener_region_add received unaligned region)
[7.0.0-2]
- kvm-configs-devices-aarch64-softmmu-Enable-CONFIG_VIRTIO.patch [bz#2044162]
- kvm-target-ppc-cpu-models-Fix-ppc_cpu_aliases-list-for-R.patch [bz#2081022]
- Resolves: bz#2044162 ([RHEL9.1] Enable virtio-mem as tech-preview on ARM64 QEMU)
- Resolves: bz#2081022 (Build regression on ppc64le with c9s qemu-kvm 7.0.0-1 changes)
[7.0.0-1]
- Rebase to QEMU 7.0.0 [bz#2064757]
- Do not build ssh block driver anymore [bz#2064500]
- Removed hpet and parallel port support [bz#2065042]
- Compatibility support [bz#2064782 bz#2064771]
- Resolves: bz#2064757 (Rebase to QEMU 7.0.0)
- Resolves: bz#2064500 (Install qemu-kvm-6.2.0-11.el9_0.1 failed as conflict with qemu-kvm-block-ssh-6.2.0-11.el9_0.1)
- Resolves: bz#2065042 (Remove upstream-only devices from the qemu-kvm binary)
- Resolves: bz#2064782 (Update machine type compatibility for QEMU 7.0.0 update [s390x])
- Resolves: bz#2064771 (Update machine type compatibility for QEMU 7.0.0 update [x86_64])
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
qemu-guest-agent
7.0.0-13.el9
qemu-img
7.0.0-13.el9
qemu-kvm
7.0.0-13.el9
qemu-kvm-audio-pa
7.0.0-13.el9
qemu-kvm-block-curl
7.0.0-13.el9
qemu-kvm-block-rbd
7.0.0-13.el9
qemu-kvm-common
7.0.0-13.el9
qemu-kvm-core
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-gl
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-gl
7.0.0-13.el9
qemu-kvm-device-usb-host
7.0.0-13.el9
qemu-kvm-docs
7.0.0-13.el9
qemu-kvm-tools
7.0.0-13.el9
qemu-pr-helper
7.0.0-13.el9
Oracle Linux x86_64
qemu-guest-agent
7.0.0-13.el9
qemu-img
7.0.0-13.el9
qemu-kvm
7.0.0-13.el9
qemu-kvm-audio-pa
7.0.0-13.el9
qemu-kvm-block-curl
7.0.0-13.el9
qemu-kvm-block-rbd
7.0.0-13.el9
qemu-kvm-common
7.0.0-13.el9
qemu-kvm-core
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-gl
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci
7.0.0-13.el9
qemu-kvm-device-display-virtio-gpu-pci-gl
7.0.0-13.el9
qemu-kvm-device-display-virtio-vga
7.0.0-13.el9
qemu-kvm-device-display-virtio-vga-gl
7.0.0-13.el9
qemu-kvm-device-usb-host
7.0.0-13.el9
qemu-kvm-device-usb-redirect
7.0.0-13.el9
qemu-kvm-docs
7.0.0-13.el9
qemu-kvm-tools
7.0.0-13.el9
qemu-kvm-ui-egl-headless
7.0.0-13.el9
qemu-kvm-ui-opengl
7.0.0-13.el9
qemu-pr-helper
7.0.0-13.el9
Связанные CVE
Связанные уязвимости
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.