USN-3261-1: QEMU vulnerabilities

Ubuntu Security Notice USN-3261-1

20th April, 2017

qemu vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

• Ubuntu 16.10



• Ubuntu 16.04 LTS



• Ubuntu 14.04 LTS

Summary

Several security issues were fixed in QEMU.

Software description

• qemu
  - Machine emulator and virtualizer
  
  

Details

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU
device. An attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 16.10. ()

Li Qiang discovered that QEMU incorrectly handled the 6300esb watchdog. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. ()

It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. ()

It was discovered that QEMU incorrectly handled the shared rings when used
with Xen. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service, or possibly execute
arbitrary code on the host. ()

Gerd Hoffmann discovered that QEMU incorrectly handled the Cirrus VGA
device when being used with a VNC connection. A privileged attacker inside
the guest could use this issue to cause QEMU to crash, resulting in a
denial of service, or possibly execute arbitrary code on the host. In the
default installation, when QEMU is used with libvirt, attackers would be
isolated by the libvirt AppArmor profile. ()

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An
attacker inside the guest could use this issue to cause QEMU to leak
contents of host memory. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 16.10. ()

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS
and Ubuntu 16.10. (, , )

Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. (, , , )

It was discovered that QEMU incorrectly handled the Cirrus VGA device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service, or possibly execute arbitrary code
on the host. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile.
()

Li Qiang discovered that QEMU incorrectly handled the ac97 audio device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. ()

Li Qiang discovered that QEMU incorrectly handled the 16550A UART device. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. ()

Li Qiang discovered that QEMU incorrectly handled the MegaRAID SAS device.
A privileged attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. ()

Li Qiang discovered that QEMU incorrectly handled USB xHCI controller
emulation. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. ()

Li Qiang discovered that QEMU incorrectly handled USB OHCI controller
emulation. A privileged attacker inside the guest could use this issue to
cause QEMU to hang, resulting in a denial of service. (



















































.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

,

CVE-2017-6505