Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 569
Alerts This Week
Warning Icon 1 569

Ubuntu 15.04 & 14.04 LTS: USN-2692-1 Critical: QEMU Denial Of Service

ubuntu
Calendar Grey July 28, 2015
Scroller Ubuntu
Ubuntu 15.04 and 14.04 LTS have addressed QEMU security flaws to mitigate risks of service interruption and unauthorized invasions.
Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

Details:

Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a

non-default configuration, a malicious guest could use this issue to cause

a denial of service, or possibly execute arbitrary code on the host as the

user running the QEMU process. In the default installation, when QEMU is

used with libvirt, attackers would be isolated by the libvirt AppArmor

profile. (CVE-2015-3214)

Kevin Wolf discovered that QEMU incorrectly handled processing ATAPI

commands. A malicious guest could use this issue to cause a denial of

service, or possibly execute arbitrary code on the host as the user running

the QEMU process. In the default installation, when QEMU is used with

libvirt, attackers would be isolated by the libvirt AppArmor profile.

(CVE-2015-5154)

Zhu Donghai discovered that QEMU incorrectly handled the SCSI driver. A

malicious guest cou...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service software fix update instructions ubuntu security issues qemu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  qemu-system                     1:2.2+dfsg-5expubuntu9.3
  qemu-system-aarch64             1:2.2+dfsg-5expubuntu9.3
  qemu-system-arm                 1:2.2+dfsg-5expubuntu9.3
  qemu-system-mips                1:2.2+dfsg-5expubuntu9.3
  qemu-system-misc                1:2.2+dfsg-5expubuntu9.3
  qemu-system-ppc                 1:2.2+dfsg-5expubuntu9.3
  qemu-system-sparc               1:2.2+dfsg-5expubuntu9.3
  qemu-system-x86                 1:2.2+dfsg-5expubuntu9.3

Ubuntu 14.04 LTS:
  qemu-system                     2.0.0+dfsg-2ubuntu1.15
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.15
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.15
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.15
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.15
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.15
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.15
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.15

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2692-1

CVE-2015-3214, CVE-2015-5154, CVE-2015-5158

Severity
critical
Lowest
Low
Medium
High
Critical

July 28, 2015

Topics%20covered

Topics Covered

security advisory denial of service software fix update instructions ubuntu security issues qemu

Package Information

https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.3
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.15

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.