virt:rhel security update

Linux on numerous hardware platforms. The virt module contains packages
which provide user-space components used to run virtual machines using KVM. The
packages also provide APIs for managing and interacting with the virtualized
systems.

Security Fix(es):

* QEMU: usb: out-of-bounds r/w access issue while processing usb packets
(CVE-2020-14364)
* QEMU: slirp: networking out-of-bounds read information disclosure
vulnerability (CVE-2020-10756)

CVE(s):
CVE-2020-10756
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible information disclosure. This flaw affects versions of libslirp before 4.3.1.
CVE-2020-14364
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process on the host.

Modularity name: virt
Stream name: rhel