CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
65.2%
Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.
Security Fix(es):
Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation that includes support for guests running on hosts with AMD processors.
Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 7 | x86_64 | qemu-kvm | < 1.5.3-156.el7_5.3 | qemu-kvm-1.5.3-156.el7_5.3.x86_64.rpm |
RedHat | 7 | x86_64 | qemu-kvm-common | < 1.5.3-156.el7_5.3 | qemu-kvm-common-1.5.3-156.el7_5.3.x86_64.rpm |
RedHat | 7 | x86_64 | qemu-kvm-debuginfo | < 1.5.3-156.el7_5.3 | qemu-kvm-debuginfo-1.5.3-156.el7_5.3.x86_64.rpm |
RedHat | 7 | x86_64 | qemu-img | < 1.5.3-156.el7_5.3 | qemu-img-1.5.3-156.el7_5.3.x86_64.rpm |
RedHat | 7 | x86_64 | qemu-kvm-tools | < 1.5.3-156.el7_5.3 | qemu-kvm-tools-1.5.3-156.el7_5.3.x86_64.rpm |
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
65.2%