Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

USN-3414-1: QEMU vulnerabilities

13 September 2017

Several security issues were fixed in QEMU.

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Releases

Packages

  • qemu - Machine emulator and virtualizer

Details

Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control.
A guest attacker could use this issue to elevate privileges inside the
guest. (CVE-2017-7493)

Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation.
A privileged attacker inside the guest could use this issue to cause QEMU
to consume resources or crash, resulting in a denial of service.
(CVE-2017-8112)

It was discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host
Bus Adapter emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service, or
possibly to obtain sensitive host memory. This issue only affected Ubuntu
16.04 LTS and Ubuntu 17.04. (CVE-2017-8380)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An
attacker inside the guest could use this issue to cause QEMU to consume
resources and crash, resulting in a denial of service. This issue only
affected Ubuntu 17.04. (CVE-2017-9060)

Li Qiang discovered that QEMU incorrectly handled the e1000e device. A
privileged attacker inside the guest could use this issue to cause QEMU to
hang, resulting in a denial of service. This issue only affected Ubuntu
17.04. (CVE-2017-9310)

Li Qiang discovered that QEMU incorrectly handled USB OHCI emulation
support. An attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. (CVE-2017-9330)

Li Qiang discovered that QEMU incorrectly handled IDE AHCI emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources and crash, resulting in a denial of
service. (CVE-2017-9373)

Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources and crash, resulting in a denial of
service. (CVE-2017-9374)

Li Qiang discovered that QEMU incorrectly handled USB xHCI emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to hang, resulting in a denial of service. (CVE-2017-9375)

Zhangyanyu discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2
Host Bus Adapter emulation support. A privileged attacker inside the guest
could use this issue to cause QEMU to crash, resulting in a denial of
service. (CVE-2017-9503)

It was discovered that the QEMU qemu-nbd server incorrectly handled
initialization. A remote attacker could use this issue to cause the server
to crash, resulting in a denial of service. (CVE-2017-9524)

It was discovered that the QEMU qemu-nbd server incorrectly handled
signals. A remote attacker could use this issue to cause the server to
crash, resulting in a denial of service. (CVE-2017-10664)

Li Qiang discovered that the QEMU USB redirector incorrectly handled
logging debug messages. An attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service. (CVE-2017-10806)

Anthony Perard discovered that QEMU incorrectly handled Xen block-interface
responses. An attacker inside the guest could use this issue to cause QEMU
to leak contents of host memory. (CVE-2017-10911)

Reno Robert discovered that QEMU incorrectly handled certain DHCP options
strings. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. (CVE-2017-11434)

Ryan Salsamendi discovered that QEMU incorrectly handled empty CDROM device
drives. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-12809)

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Learn more about Ubuntu Pro

Related notices

  • USN-3468-2: linux-image-4.10.0-38-lowlatency, linux-hwe, linux-image-extra-4.10.0-38-generic, linux-image-4.10.0-38-generic, linux-image-4.10.0-38-generic-lpae
  • USN-3468-3: linux-image-4.10.0-1008-gcp, linux-image-extra-4.10.0-1008-gcp, linux-gcp
  • USN-3469-1: linux-image-4.4.0-1009-kvm, linux-image-4.4.0-98-generic, linux-image-4.4.0-1078-snapdragon, linux-image-4.4.0-98-powerpc64-smp, linux-raspi2, linux-gke, linux-snapdragon, linux-image-4.4.0-98-powerpc-smp, linux-image-extra-4.4.0-98-generic, linux-image-extra-4.4.0-1033-gke, linux-image-4.4.0-98-generic-lpae, linux-image-4.4.0-1039-aws, linux-kvm, linux-image-4.4.0-98-powerpc-e500mc, linux, linux-aws, linux-image-4.4.0-1076-raspi2, linux-image-4.4.0-98-powerpc64-emb, linux-image-4.4.0-1033-gke, linux-image-4.4.0-98-lowlatency
  • USN-3469-2: linux-lts-xenial, linux-image-4.4.0-98-powerpc64-emb, linux-image-4.4.0-98-generic, linux-image-4.4.0-98-powerpc-smp, linux-image-4.4.0-98-powerpc-e500mc, linux-image-4.4.0-98-lowlatency, linux-image-extra-4.4.0-98-generic, linux-image-4.4.0-98-generic-lpae, linux-image-4.4.0-98-powerpc64-smp
  • USN-3470-2: linux-image-3.13.0-135-generic, linux-image-generic-lpae-lts-trusty, linux-image-generic-lts-trusty, linux-lts-trusty, linux-image-3.13.0-135-generic-lpae
  • USN-3470-1: linux-image-3.13.0-135-generic, linux, linux-image-3.13.0-135-powerpc64-smp, linux-image-3.13.0-135-powerpc-smp, linux-image-3.13.0-135-powerpc-e500mc, linux-image-extra-3.13.0-135-generic, linux-image-3.13.0-135-powerpc-e500, linux-image-3.13.0-135-generic-lpae, linux-image-3.13.0-135-powerpc64-emb, linux-image-3.13.0-135-lowlatency
  • USN-3468-1: linux-image-generic-lpae, linux-image-raspi2, linux-image-4.10.0-38-lowlatency, linux-raspi2, linux-image-4.10.0-38-generic, linux-image-generic, linux-image-4.10.0-1020-raspi2, linux-image-lowlatency, linux-image-4.10.0-38-generic-lpae, linux