Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Generic)  >   KVM Vendors:
(Red Hat Issues Fix) KVM virtio-net Driver TCP Processing Bug Lets Remote Users Deny Service
SecurityTracker Alert ID:  1023799
SecurityTracker URL:
CVE Reference:   CVE-2010-0741   (Links to External Site)
Date:  Mar 31 2010
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in KVM. A remote user can cause denial of service conditions.

The Linux virtio-net driver does not properly implement TCP segment offloading (TSO) processing. A remote user can send specially crafted data to a certain KVM process on the target system to cause the target guest to crash.

Impact:   A remote user can cause the target guest operating system to crash.
Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  5

Message History:   This archive entry is a follow-up to the message listed below.
Mar 31 2010 KVM virtio-net Driver TCP Processing Bug Lets Remote Users Deny Service

 Source Message Contents

Subject:  [RHSA-2010:0271-04] Important: kvm security, bug fix and enhancement update

Hash: SHA1

                   Red Hat Security Advisory

Synopsis:          Important: kvm security, bug fix and enhancement update
Advisory ID:       RHSA-2010:0271-04
Product:           Red Hat Enterprise Linux
Advisory URL:
Issue date:        2010-03-30
CVE Names:         CVE-2010-0741 

1. Summary:

Updated kvm packages that fix one security issue, multiple bugs, and add
enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

2. Relevant releases/architectures:

RHEL Desktop Multi OS (v. 5 client) - x86_64
RHEL Virtualization (v. 5 server) - x86_64

3. Description:

KVM (Kernel-based Virtual Machine) is a full virtualization solution for
Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for
the standard Red Hat Enterprise Linux kernel.

A flaw was found in the way QEMU-KVM handled erroneous data provided by
the Linux virtio-net driver, used by guest operating systems. Due to a
deficiency in the TSO (TCP segment offloading) implementation, a guest's
virtio-net driver would transmit improper data to a certain QEMU-KVM
process on the host, causing the guest to crash. A remote attacker could
use this flaw to send specially-crafted data to a target guest system,
causing that guest to crash. (CVE-2010-0741)

Additionally, these updated packages include numerous bug fixes and
enhancements. Refer to the KVM chapter of the Red Hat Enterprise Linux 5.5
Technical Notes for details:       

All KVM users should upgrade to these updated packages, which resolve this
issue as well as fixing the bugs and adding the enhancements noted in the
Technical Notes. Note: The procedure in the Solution section must be
performed before this update will take effect.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at

The following procedure must be performed before this update will take

1) Stop all KVM guest virtual machines.

2) Either reboot the hypervisor machine or, as the root user, remove (using
"modprobe -r [module]") and reload (using "modprobe [module]") all of the
following modules which are currently running (determined using "lsmod"):
kvm, ksm, kvm-intel or kvm-amd.

3) Restart the KVM guest virtual machines.

5. Bugs fixed (

508040 - Windows XP not using all CPUS
510706 - qemu-kvm segfault when using i82551 vnic
511072 - KVM - qemu-img fail to copy a RAW format image over FCP storage
512672 - Remove initrd warning message
515549 - upstream qemu issues on rhel 5.4
515655 - Add result test to prevent Infinite loop in raw_pread, reading too large offset
515749 - Remove warnings from kvm compilation
516545 - qemu-kvm crashed when setting 32bitwin28k with 64G ram
516672 - Disable unused/unsupported features on qemu-kvm
516762 - qemu aborted when restart 32bitwin23k with more than 4G mem in intel host.
517223 - BUG: warning at /builddir/build/BUILD/kvm-83-maint-snapshot-20090205/kernel-/x86/x86.c:240/kvm_queue_exception_e() (Tainted: G     )
518090 - [RFE] KVM should be able to export advanced cpu flags to the guest
518169 - Bad qcow2 performance with cache=off
519397 - KVM: MMU: make __kvm_mmu_free_some_pages handle empty list (upstream backport)
520285 - windows 64 bit does vmexit on each cr8 access.
521025 - rtc-td-hack stopped working. Time drifts in windows
521749 - Guest Window2008-R2-datacenter installation is stopped at  step "Setup will continue after restarting your computer" (AMD host only)
521835 - German keymap using KVM+VNC missing some keys
522887 - Call to migrate_set_speed after a migrate_cancel causes segmentation fault in kvm
524970 - Guest single-cpu IPI leads to a global IPI on host
525323 - QEMU terminates without warning with virtio-net and SMP enabled
525699 - x86_64 guest hang when set guest's cpu1 online on AMD host
526124 - ne model failed to get ip address
526837 - KVM: x86: verify MTRR/PAT validity (upstream backport)
527722 - Build tree for RHEL 5.X and RHEL 5.4.z contains build bugs
528310 - when kvm is load, Kernel panic on rebooting after implement suspend and resume
529694 - -initrd is broken with > 4GB guests
530134 - RFE - In-place backing file format change
530533 - debug message is displayed when save VM state into a compressed file
531631 - Windows XP unattended install doesn't get an IP address after rebooting, if using -net user
531701 - pvclock msr values are not preserved across remote migration
531827 - O/S Filesystem Corruption with RHEL-5.4 on a RHEV Guest
532086 - Rhev-Block driver causes  'unhandled vm exit' with 32bit win2k3r2sp2 Guest VM  on restart
533059 - kvm modules can't be built against latest kernel-devel package
533197 - kvm kmod package should filter only some specific ksym dependencies
533390 - RHEL5.4 VM image corruption with an IDE v-disk
533453 - kvm kmod package should require a compatible kernel version
537075 - qcow2: infinite recursion on grow_refcount_table() error handling
537077 - error codes aren't always propagated up through the block layer (e.g. -ENOSPC)
537646 - backports of qemu barrier support
537655 - qemu-img: error creating a new preallocated volume image on FCP storage
537888 - fix unsafe device data handling
539250 - Cannot eject cd-rom when configured to host cd-rom
539589 - kvm can't build against kernel-2.6.18-174.el5
540893 - qemu-img: snapshot info error
541084 - KVM: x86: Add KVM_GET/SET_VCPU_EVENTS
541731 - kvm: migration: mechanism to make older savevm versions to be emitted on some cases
542923 - Get segmentation fault when running with ide block on kvm-83-136.el5
543137 - time drift in win2k364 KVM guest
543979 - gPXE fails to PXE boot on e1000 virtual NIC
545136 - CVE-2010-0741 whitelist host virtio networking features
545194 - Discrepancy between man page and source code for qcow2 with regards to default value used when no explicit caching is specified
546019 - kvm: use gpxe PXE roms if available
546039 - [FEAT] Supported KVM guests for RHEL5.5
549938 - Maintain barrier state after migration
550053 - require newer etherboot package that is compatible with new pxe ROM paths
550265 - gPXE fails to PXE boot on e1000 virtual NIC
550755 - Hypercall driver doesn't reset device on power-down
552487 - Guest image corruption after RHEV-H update to 5.4-2.1.3.el5_4rhev2_1 using virtio-blk
553187 - Add rhel-5.4.4 support to rhel5.5.0
555780 - iozone test can not finish when using virtio_blk in RHEL5u4 guest.
557327 - migration failed with -M rhel5.4.4 between host 5.5 and host 5.4.4
558195 - kvm: NFS : kvm-qemu-img convert failure on RAW/Sparse template with COW/Sparse snapshot
559163 - migration failed host 5.5 with -M rhel5.5.0 to host 5.5 with -M rhel5.5.0.
559509 - KVM:Wake up from hibernation operation failed ( migration to file )
563141 - qemu-img re-base subcommand got Segmentation fault
569762 - 'qemu-img re-base' broken on block devices
577218 - CVE-2010-0741 qemu: Improper handling of erroneous data provided by Linux virtio-net driver

6. Package List:

RHEL Desktop Multi OS (v. 5 client):



RHEL Virtualization (v. 5 server):



These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from

7. References:

8. Contact:

The Red Hat security contact is <>.  More contact
details at

Copyright 2010 Red Hat, Inc.
Version: GnuPG v1.4.4 (GNU/Linux)


Enterprise-watch-list mailing list

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC