KVM (Kernel-based Virtual Machine) is a full virtualization solution forLinux on AMD64 and Intel 64 systems. The qemu-kvm package provides theuser-space component for running virtual machines using KVM.A flaw was found in the way QEMU's AMD PCnet Ethernet emulation handledmulti-TMD packets with a length above 4096 bytes. A privileged guest userin a guest with an AMD PCNet ethernet card enabled could potentially usethis flaw to execute arbitrary code on the host with the privileges of thehosting QEMU process. (CVE-2015-3209)Red Hat would like to thank Matt Tait of Google's Project Zero securityteam for reporting this issue.All qemu-kvm users are advised to upgrade to these updated packages, whichcontain a backported patch to correct this issue. After installing thisupdate, shut down all running virtual machines. Once all virtual machineshave shut down, start them again for this update to take effect.