RHSA-2015:1044: Important: virtio-win security and bug fix update

The virtio-win package provides paravirtualized network drivers for mostMicrosoft Windows operating systems. Paravirtualized drivers arevirtualization-aware drivers used by fully virtualized guests running onRed Hat Enterprise Linux. Fully virtualized guests using theparavirtualized drivers gain significantly better I/O performance thanfully virtualized guests running without the drivers.It was found that the Windows Virtio NIC driver did not sufficientlysanitize the length of the incoming IP packets, as demonstrated by a packetwith IP options present but the overall packet length not being adjusted toreflect the length of those options. A remote attacker able to send aspecially crafted IP packet to the guest could use this flaw to crash thatguest. (CVE-2015-3215)Red Hat would like to thank Google Project Zero for reporting this issue.This update also fixes the following bugs: When creating a Windows guest using virtio drivers and direct Logical Unit Number (LUN) access with more than 4 SCSI disks under onevirtio-scsi-pci controller, the guest terminated unexpectedly with a stoperror, also known as the blue screen of death. This update increases themaximum amount of LUNs per a single virtio-scsi-pci controller has beenincreased to 254, which prevents the described crash from occurring.(BZ#1207546) The license.txt file in the virtio-win build has been updated to include the correct year number in the copyright information section. (BZ#1183427)All virtio-win users are advised to upgrade to this updated package, whichcontains backported patches to correct these issues.