ArchLinux: 201606-9: qemu-arch-extra: multiple issues
Summary
- CVE-2015-8558 (denial of service)
An infinite-loop issue was found in the QEMU emulator built with USB
EHCI emulation support. The flaw occurred during communication between
the host controller interface(EHCI) and a respective device driver.
These two communicate using an isochronous transfer descriptor
list(iTD); an infinite loop unfolded if there was a closed loop in the
list. A privileged user inside a guest could use this flaw to consume
excessive resources and cause denial of service.
- CVE-2016-3710 (arbitrary code execution)
An out-of-bounds read/write access flaw was found in the way QEMU's VGA
emulation with VESA BIOS Extensions (VBE) support performed read/write
operations using I/O port methods. A privileged guest user could use
this flaw to execute arbitrary code on the host with the privileges of
the host's QEMU process.
- CVE-2016-3712 (denial of service)
Qemu emulator built with the VGA Emulator support is vulnerable to an
integer overflow and OOB read access issues. This occurs because Qemu
allows certain VGA registers to be set while in VBE mode. A privileged
guest user could use this flaw to crash the Qemu process instance
resulting in DoS.
- CVE-2016-5105 (information leakage)
Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an information leakage issue.
It could occur while processing MegaRAID Firmware Interface(MFI) command
to read device configuration in 'megasas_dcmd_cfg_read'. A privileged
user inside guest could use this flaw to leak host memory bytes.
- CVE-2016-5106 (denial of service)
Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an out-of-bounds write access
issue. It could occur while processing MegaRAID Firmware Interface(MFI)
command to set controller properties in 'megasas_dcmd_set_properties'.
A privileged user inside guest could use this flaw to crash the Qemu
process on the host resulting in DoS.
- CVE-2016-5107 (denial of service)
Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an out-of-bounds read access
issue. It could occur while looking up MegaRAID Firmware Interface(MFI)
command frames in 'megasas_lookup_frame' routine. A privileged user
inside guest could use this flaw to read invalid memory leading to crash
the Qemu process on the host.
Resolution
Upgrade to 2.6.0-1.
# pacman -Syu "qemu-arch-extra>=2.6.0-1"
The problems have been fixed upstream in version 2.6.0.
References
https://access.redhat.com/security/cve/CVE-2015-8558 https://access.redhat.com/security/cve/CVE-2016-3710 https://access.redhat.com/security/cve/CVE-2016-3712 https://access.redhat.com/security/cve/CVE-2016-5105 https://access.redhat.com/security/cve/CVE-2016-5106 https://access.redhat.com/security/cve/CVE-2016-5107
Workaround
None.
