ELSA-2024-12574

ELSA-2024-12574 - qemu-kvm security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2024-08-07

Description

[7.2.0-13.el9]
- vfio/migration: Enhance VFIO migration state tracing (Avihai Horon)
- vfio/migration: Don't emit STOP_COPY VFIO migration QAPI event twice (Avihai Horon)
- vfio/migration: Emit VFIO migration QAPI event (Avihai Horon)
- qapi/vfio: Add VFIO migration QAPI event (Avihai Horon)
- migration/multifd: solve zero page causing multiple page faults (Yuan Liu) [Orabug: 36727051]
- multifd: Add the ramblock to MultiFDRecvParams (Lukas Straub) [Orabug: 36727051]
- migration: Fix qmp_query_migrate mbps value (Fabiano Rosas) [Orabug: 36727104]
- migration: Allow user to specify available switchover bandwidth (Peter Xu) [Orabug: 35636284]
- migration/dirtyrate: Fix precision losses and g_usleep overshoot (Andrei Gudkov) [Orabug: 36727091]
- Use new created qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- softmmu: Create qemu_target_pages_to_MiB() (Juan Quintela) [Orabug: 36727091]
- migration/calc-dirty-rate: replaced CRC32 with xxHash (Andrei Gudkov) [Orabug: 36727063]
- migration/multifd: Enable multifd zero page checking by default. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement ram_save_target_page_multifd to handle multifd version of MigrationOps::ram_save_target_page. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Implement zero page transmission on the multifd thread. (Hao Xiang) [Orabug: 34131170]
- migration/multifd: Add new migration option zero-page-detection. (Hao Xiang) [Orabug: 34131170]
- migration: Make ram_save_target_page() a pointer (Juan Quintela) [Orabug: 34131170]
- migration: Yield bitmap_mutex properly when sending/sleeping (Peter Xu) [Orabug: 34131170]
- migration/multifd: Add a synchronization point for channel creation (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Unify multifd and TLS connection paths (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup into migration thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Move multifd_send_setup error handling in to the function (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Remove p->running (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Optimize sender side to be lockless (Peter Xu) [Orabug: 34131170]
- migration/multifd: Join the TLS thread (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Fix MultiFDSendParams.packet_num race (Peter Xu) [Orabug: 34131170]
- migration/multifd: Stick with send/recv on function names (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_load_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Cleanup multifd_save_cleanup() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rewrite multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_send_pages() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Change retval of multifd_queue_page() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Split multifd_send_terminate_threads() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Forbid spurious wakeups (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move header prepare/fill into send_prepare() (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_prepare_header() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move trace_multifd_send|recv() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Move total_normal_pages accounting (Peter Xu) [Orabug: 34131170]
- migration/multifd: Rename p->num_packets and clean it up (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop pages->num check in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Simplify locking in sender thread (Peter Xu) [Orabug: 34131170]
- migration/multifd: Separate SYNC request with normal jobs (Peter Xu) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.normal[] array (Peter Xu) [Orabug: 34131170]
- migration/multifd: Postpone reset of MultiFDPages_t (Peter Xu) [Orabug: 34131170]
- migration/multifd: Remove MultiFDPages_t::packet_num (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Drop MultiFDSendParams.quit, cleanup error paths (Peter Xu) [Orabug: 34131170]
- migration/multifd: multifd_send_kick_main() (Peter Xu) [Orabug: 34131170]
- migration/multifd: Fix leaking of Error in TLS error flow (Avihai Horon) [Orabug: 34131170]
- migration/ram: Merge save_zero_page functions (Fabiano Rosas) [Orabug: 34131170]
- migration/ram: Move xbzrle zero page handling into save_zero_page (Fabiano Rosas) [Orabug: 34131170]
- migration/multifd: Stop setting p->ioc before connecting (Fabiano Rosas) [Orabug: 34131170]
- migration: Centralize BH creation and dispatch (Fabiano Rosas) [Orabug: 34131170]
- migration: Add a wrapper to qemu_bh_schedule (Fabiano Rosas) [Orabug: 34131170]
- migration: Remove transferred atomic counter (Juan Quintela) [Orabug: 35636284]
- migration: Use migration_transferred_bytes() (Juan Quintela) [Orabug: 35636284]
- migration: migration_rate_limit_reset() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- migration: migration_transferred_bytes() don't need the QEMUFile (Juan Quintela) [Orabug: 35636284]
- multifd: reset next_packet_len after sending pages (Elena Ufimtseva) [Orabug: 35636284]
- multifd: fix counters in multifd_send_thread (Elena Ufimtseva) [Orabug: 35636284]
- migration/multifd: Compute transferred bytes correctly (Juan Quintela) [Orabug: 35636284]
- migration: check for rate_limit_max for RATE_LIMIT_DISABLED (Elena Ufimtseva) [Orabug: 35636284]
- migration: Use the number of transferred bytes directly (Juan Quintela) [Orabug: 35636284]
- qemu_file: Use a stat64 for qemu_file_transferred (Juan Quintela) [Orabug: 35636284]
- migration: set file error on subsection loading (Marc-Andre Lureau) [Orabug: 35636284]
- migration: Receiving a zero page non zero is an error (Juan Quintela) [Orabug: 35636284]
- migration/multifd: Stop checking p->quit in multifd_send_thread (Fabiano Rosas) [Orabug: 35636284]
- migration/multifd: Clarify Error usage in multifd_channel_connect (Fabiano Rosas) [Orabug: 35636284]
- multifd: cleanup the function multifd_channel_connect (Li Zhang) [Orabug: 35636284]
- migration/multifd: Unify multifd_send_thread error paths (Fabiano Rosas) [Orabug: 35636284]
- migration: Non multifd migration don't care about multifd flushes (Juan Quintela) [Orabug: 35636284]
- migration: fix RAMBlock add NULL check (Dmitry Frolov) [Orabug: 35829153]
- migration: We don't need the field rate_limit_used anymore (Juan Quintela) [Orabug: 35636284]
- migration: Use migration_transferred_bytes() to calculate rate_limit (Juan Quintela) [Orabug: 35636284]
- migration: Add a trace for migration_transferred_bytes (Juan Quintela) [Orabug: 35636284]
- migration: Move migration_total_bytes() to migration-stats.c (Juan Quintela) [Orabug: 35636284]
- qemu-file: Remove total from qemu_file_total_transferred_*() (Juan Quintela) [Orabug: 35636284]
- migration: Move rate_limit_max and rate_limit_used to migration_stats (Juan Quintela) [Orabug: 35636284]
- qemu-file: Account for rate_limit usage on qemu_fflush() (Juan Quintela) [Orabug: 35636284]
- migration: Don't use INT64_MAX for unlimited rate (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make rate_limit_used an uint64_t (Juan Quintela) [Orabug: 35636284]
- qemu-file: make qemu_file_[sg]et_rate_limit() use an uint64_t (Juan Quintela) [Orabug: 35636284]
- migration: We set the rate_limit by a second (Juan Quintela) [Orabug: 35829153]
- migration: A rate limit value of 0 is valid (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make ram_control_save_page() use accessors for rate_limit (Juan Quintela) [Orabug: 35636284]
- qemu-file: Make total_transferred an uint64_t (Juan Quintela) [Orabug: 35636284]
- qemu-file: No need to check for shutdown in qemu_file_rate_limit (Juan Quintela) [Orabug: 35636284]
- migration: Document all migration_stats (Juan Quintela) [Orabug: 35636284]
- multifd: We already account for this packet on the multifd thread (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_bytes_last_sync atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_pages_rate atomic (Juan Quintela) [Orabug: 35636284]
- stat64: Add stat64_set() operation (Paolo Bonzini) [Orabug: 35636284]
- multifd: Only flush once each full round of memory (Juan Quintela) [Orabug: 35636284]
- migration: Make find_dirty_block() return a single parameter (Juan Quintela) [Orabug: 35636284]
- migration: Simplify ram_find_and_save_block() (Juan Quintela) [Orabug: 35636284]
- multifd: Protect multifd_send_sync_main() calls (Juan Quintela) [Orabug: 35636284]
- multifd: Create property multifd-flush-after-each-section (Juan Quintela) [Orabug: 35636284]
- multifd: Fix the number of channels ready (Juan Quintela) [Orabug: 35636284]
- migration: Rename normal to normal_pages (Juan Quintela) [Orabug: 35636284]
- migration: Rename duplicate to zero_pages (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_sync_count atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make downtime_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make precopy_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make dirty_sync_missed_zero_copy atomic (Juan Quintela) [Orabug: 35636284]
- migration: Make multifd_bytes atomic (Juan Quintela) [Orabug: 35636284]
- migration: Update atomic stats out of the mutex (Juan Quintela) [Orabug: 35636284]
- migration: Merge ram_counters and ram_atomic_counters (Juan Quintela) [Orabug: 35636284]
- migration/multifd: correct multifd_send_thread to trace the flags (Wei Wang) [Orabug: 35636284]
- ram: Document migration ram flags (Juan Quintela) [Orabug: 35636284]
- migration: Calculate ram size once (Juan Quintela) [Orabug: 35636284]
- multifd: Fix a race on reading MultiFDPages_t.block (Zhenzhong Duan) [Orabug: 35636284]
- migration: Use atomic ops properly for page accountings (Peter Xu) [Orabug: 35636284]
- migration: Export ram_release_page() (Juan Quintela) [Orabug: 35636284]
- migration: Export ram_transferred_ram() (Juan Quintela) [Orabug: 35636284]
- multifd: Create page_count fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
- multifd: Create page_size fields into both MultiFD{Recv,Send}Params (Juan Quintela) [Orabug: 35636284]
- migration: Fix migration_channel_read_peek() error path () (Avihai Horon) [Orabug: 36726827]
- migration/multifd: Remove error_setg() in migration_ioc_process_incoming() (Avihai Horon) [Orabug: 36726827]
- migration: Refactor migration_incoming_setup() (Avihai Horon) [Orabug: 36726827]
- migration: check magic value for deciding the mapping of channels (manish.mishra) [Orabug: 36726827]
- io: Add support for MSG_PEEK for socket channel (manish.mishra) [Orabug: 36726827]
- hw/sd/sdhci: Do not update TRNMOD when Command Inhibit (DAT) is set (hilippe Mathieu-Daude) [Orabug: 36575206] {CVE-2024-3447}
- block: lock AioContext in bdrv_replace_child_noperm() when in non-coroutine context (Mark Kanda) [Orabug: 36514180]
- hw/scsi/scsi-generic: Fix io_timeout property not applying (Lorenz Brun) [Orabug: 36637684]
- target/i386/monitor: synchronize cpu state for lapic info (Dongli Zhang) [Orabug: 36607747]
- qemu_init: increase NOFILE soft limit on POSIX (Fiona Ebner) [Orabug: 36416389]

Related CVEs

CVE-2024-3447

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	qemu-kvm-7.2.0-13.el9.src.rpm	1555680bcbee8dcf1d1ede06928fedaa4b5b2dd933a51410c4532fc0557184d6	-	ol9_aarch64_kvm_utils
	qemu-guest-agent-7.2.0-13.el9.aarch64.rpm	6b7594c5939a4efc476471af952bc80cab2fd3237068f0955d3bfaf430ba609d	-	ol9_aarch64_kvm_utils
	qemu-img-7.2.0-13.el9.aarch64.rpm	dfe63eb6a5662072746f2bc806d01135d7dd88d46adac7bf8bacf1826f9053c4	-	ol9_aarch64_kvm_utils
	qemu-kvm-7.2.0-13.el9.aarch64.rpm	5719386c2caf539a3795dce60125387cd33fa565e97c9e9ef1f10d920a84bde7	-	ol9_aarch64_kvm_utils
	qemu-kvm-block-curl-7.2.0-13.el9.aarch64.rpm	dd6db7d71f94d76e9b57bd61c5a7a7172ba30150cc17cef808f882b0169cc3dd	-	ol9_aarch64_kvm_utils
	qemu-kvm-block-iscsi-7.2.0-13.el9.aarch64.rpm	50e39d605cd3efe1fcebe0a4d98cf9329f680ca18e07f148a9de81531d288f1e	-	ol9_aarch64_kvm_utils
	qemu-kvm-block-rbd-7.2.0-13.el9.aarch64.rpm	964bc61db33d28c9eb2ee513b76791d5de1c9415fbacf018424d5ccd0e783a97	-	ol9_aarch64_kvm_utils
	qemu-kvm-block-ssh-7.2.0-13.el9.aarch64.rpm	55e438f6bad873461386c0c73b6af37a9aca43e8079e18d76769bf09751d5e69	-	ol9_aarch64_kvm_utils
	qemu-kvm-common-7.2.0-13.el9.aarch64.rpm	ce70ef29ad91f0d6814d307fcd1d015361d908037a28d2046f4342212ef4ba04	-	ol9_aarch64_kvm_utils
	qemu-kvm-core-7.2.0-13.el9.aarch64.rpm	746e6c4526a9ec7f5ce82df4538c56861ad9252376d0578420a186caef8fbe6d	-	ol9_aarch64_kvm_utils
	qemu-virtiofsd-7.2.0-13.el9.aarch64.rpm	d09b037e21e6f0fb66fe8bfa5b59f0062aafc81a19c69a59fa40eccf34fd29f6	-	ol9_aarch64_kvm_utils
Oracle Linux 9 (x86_64)	qemu-kvm-7.2.0-13.el9.src.rpm	1555680bcbee8dcf1d1ede06928fedaa4b5b2dd933a51410c4532fc0557184d6	-	ol9_x86_64_kvm_utils
	qemu-guest-agent-7.2.0-13.el9.x86_64.rpm	149fbb8c755f3e143eabbfb3941fe10f30cc5b30e47f7851372e2689711c809c	-	ol9_x86_64_kvm_utils
	qemu-img-7.2.0-13.el9.x86_64.rpm	3962990a41aaf968d85d82790c4ed5910bc2e3547157f1151323f3eab46f3674	-	ol9_x86_64_kvm_utils
	qemu-kvm-7.2.0-13.el9.x86_64.rpm	a00eb74c27bfa7220fc049155d4b3ea7ff14c2f508b54ef350b91130874589aa	-	ol9_x86_64_kvm_utils
	qemu-kvm-block-curl-7.2.0-13.el9.x86_64.rpm	400dcb559be110c0e653e5ae33310e351f9b58960dcc3314be348f2793ae4544	-	ol9_x86_64_kvm_utils
	qemu-kvm-block-iscsi-7.2.0-13.el9.x86_64.rpm	fe152bfec1a9ba531522cd92632232302433659a919485def577386b64f41997	-	ol9_x86_64_kvm_utils
	qemu-kvm-block-rbd-7.2.0-13.el9.x86_64.rpm	9fc3fd432687d1df148c6b18211962b8a90d338c4cb482f2f677c5bc1d69697c	-	ol9_x86_64_kvm_utils
	qemu-kvm-block-ssh-7.2.0-13.el9.x86_64.rpm	fcda3dffad562522100bfad274cb7285c1c449143d830fa2b12fa44ed42850ec	-	ol9_x86_64_kvm_utils
	qemu-kvm-common-7.2.0-13.el9.x86_64.rpm	bac10b390aca3162c8429a69e406d1a51588f0810aea44829ac43c58e149f124	-	ol9_x86_64_kvm_utils
	qemu-kvm-core-7.2.0-13.el9.x86_64.rpm	c9f34cfcbc8174f736752196e0d96ddfefb98f6320fe80f066fe6fd2ed9337bf	-	ol9_x86_64_kvm_utils
	qemu-virtiofsd-7.2.0-13.el9.x86_64.rpm	172405a66d60b702959eee60ebd188d4d711918ed1b2108d698d181ddc81be2b	-	ol9_x86_64_kvm_utils

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team