SuSE Security Update: kvm (2011-05-18)

NASLDB: SuSE Security Update: kvm (2011-05-18)

General

ID: 54640
Name: SuSE Security Update: kvm (2011-05-18)

Summary: Check for the kvm package

Credits: Tenable Network Security, Inc.

Classification

Risk: –

CVSS: –
CVSS Base Vector: –
CVSS Temporal Vector: –

Port: 0
Family: SuSE Local Security Checks
Type: –

Description

The following bugs have been fixed:

*

By causing a hot-unplug of the pci-isa bridge from within guests the
qemu process could access already freed memory. A privileged user
inside the guest could exploit that to crash the guest instance or
potentially execute arbitrary code on the host (CVE-2011-1751).

*

The virtio-blk driver did not properly validate read and write
request. A privileged user inside the guest could exploit that to
cause a heap corruption and crash the guest instance or potentially
execute arbitrary code on the host (CVE-2011-1750).

Security Issue references:

* CVE-2011-1750
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1750>
* CVE-2011-1751
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1751>