Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Synopsis
========
Two vulnerabilities allow local users to execute arbitrary code (CVE-2007-1320
[1]) and allow local guest users to read arbitrary files (CVE-2008-2004[2]) 
through kvm.

Background
==========
KVM (for Kernel-based Virtual Machine) is a full virtualization solution for 
Linux on x86 hardware containing virtualization extensions (Intel VT or 
AMD-V).
It consists of a loadable kernel module, kvm.ko, that provides the core 
virtualization infrastructure and a processor specific module, kvm-intel.ko 
or kvm-amd.ko. KVM also requires a modified QEMU although work is underway to 
get the required changes upstream.

Using KVM, one can run multiple virtual machines running unmodified Linux or
Windows images. Each virtual machine has private virtualized hardware: a 
network card, disk, graphics adapter, etc.

Description
===========
CVE-2007-1320:
Multiple heap-based buffer overflows in the cirrus_invalidate_region function 
in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other 
products, might allow local users to execute arbitrary code via unspecified 
vectors related to "attempting to mark non-existent regions as dirty," aka 
the "bitblt" heap overflow.

CVE-2008-2004:
The drive_init function in QEMU 0.9.1 determines the format of a raw disk 
image based on the header, which allows local guest users to read arbitrary 
files on the host by modifying the header to identify a different format, 
which is used when the guest is restarted.

Affected packages
=================
These vulnerabilities were reported for all versions of kvm prior to 69. kvm 
in all grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All firefox users should upgrade to the latest available version:
# scribe update
# cast -c kvm

If you maintain your own installation of kvm ouside of sorcery, there are 
patches available from upstream, please visit the kvm 69 release page[0] for 
information.

References
==========
[0] 
http://sourceforge.net/project/shownotes.php?group_id=180599&release_id=600309
[1] http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1320
[2] http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2004

-- 
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  http://counter.li.org/  #196285

Attachment: signature.asc
Description: This is a digitally signed message part.