virt:rhel and virt-devel:rhel security, bug fix, and enhancement update

Kernel-based Virtual Machine (KVM) offers a full virtualization solution for
Linux on numerous hardware platforms. The virt:rhel module contains packages
which provide user-space components used to run virtual machines using KVM. The
packages also provide APIs for managing and interacting with the virtualized
systems.

Security Fix(es):

* libvirt: double free in qemuAgentGetInterfaces() in qemu_agent.c (CVE-2020-
25637)
* QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c
(CVE-2020-27821)
* QEMU: ide: atapi: OOB access while processing read commands (CVE-2020-29443)
* QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead
to information disclosure (CVE-2020-11947)
* QEMU: reachable assertion failure in net_tx_pkt_add_raw_fragment() in
hw/net/net_tx_pkt.c (CVE-2020-16092)
* QEMU: infinite loop in e1000e_write_packet_to_guest() in
hw/net/e1000e_core.c (CVE-2020-25707)
* QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
(CVE-2020-25723)
* QEMU: e1000e: infinite loop scenario in case of null packet descriptor
(CVE-2020-28916)
* QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets
(CVE-2020-29129, CVE-2020-29130)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise
Linux 8.4 Release Notes linked from the References section.

CVE(s):
CVE-2020-11947
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer
over-read that may disclose unrelated information from process memory to an
attacker.
CVE-2020-16092
In QEMU through 5.0.0, an assertion failure can occur in the network packet
processing. This issue affects the e1000e and vmxnet3 network devices. A
malicious guest user/process could use this flaw to abort the QEMU process on
the host, resulting in a denial of service condition in
net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
CVE-2020-25637
A double free memory issue was found to occur in the libvirt API, in versions
before 6.8.0, responsible for requesting information about network interfaces of
a running QEMU domain. This flaw affects the polkit access control driver.
Specifically, clients connecting to the read-write socket with limited ACL
permissions could use this flaw to crash the libvirt daemon, resulting in a
denial of service, or potentially escalate their privileges on the system. The
highest threat from this vulnerability is to data confidentiality and integrity
as well as system availability.
CVE-2020-25707
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate is a
duplicate of CVE-2020-28916
CVE-2020-25723
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It
could occur while processing USB requests due to missing handling of DMA memory
map failure. A malicious privileged user within the guest may abuse this flaw to
send bogus USB requests and crash the QEMU process on the host, resulting in a
denial of service.
CVE-2020-27821
A flaw was found in the memory management API of QEMU during the initialization
of a memory region cache. This issue could lead to an out-of-bounds write access
to the MSI-X table while performing MMIO operations. A guest user may abuse this
flaw to crash the QEMU process on the host, resulting in a denial of service.
This flaw affects QEMU versions prior to 5.2.0.
CVE-2020-28916
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor
with a NULL buffer address.
CVE-2020-29129
ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read
a certain amount of header data even if that exceeds the total packet length.
CVE-2020-29130
slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to
read a certain amount of header data even if that exceeds the total packet
length.
CVE-2020-29443
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds
read access because a buffer index is not validated.

Modularity name: [security-medium]virt
Stream name: rhel