Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 15.04, 14.04 LTS Security Advisory: Critical QEMU Denial of Service

ubuntu
Calendar Grey September 24, 2015
Scroller Ubuntu
=========================================================================Ubuntu Security Notice USN-
Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

- qemu-kvm: Machine emulator and virtualizer

Details:

Lian Yihan discovered that QEMU incorrectly handled certain payload

messages in the VNC display driver. A malicious guest could use this issue

to cause the QEMU process to hang, resulting in a denial of service. This

issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)

Qinghao Tang discovered that QEMU incorrectly handled receiving certain

packets in the NE2000 network driver. A malicious guest could use this

issue to cause the QEMU process to hang, resulting in a denial of service.

(CVE-2015-5278)

Qinghao Tang discovered that QEMU incorrectly handled receiving certain

packets in the NE2000 network driver. A malicious guest could use this

issue to cause a denial of service, or possibly execute arbitrary code on

the host as the user running the QEMU process. In the default ins...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu update instructions qemu-kvm qemu

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  qemu-system                     1:2.2+dfsg-5expubuntu9.5
  qemu-system-aarch64             1:2.2+dfsg-5expubuntu9.5
  qemu-system-arm                 1:2.2+dfsg-5expubuntu9.5
  qemu-system-mips                1:2.2+dfsg-5expubuntu9.5
  qemu-system-misc                1:2.2+dfsg-5expubuntu9.5
  qemu-system-ppc                 1:2.2+dfsg-5expubuntu9.5
  qemu-system-sparc               1:2.2+dfsg-5expubuntu9.5
  qemu-system-x86                 1:2.2+dfsg-5expubuntu9.5

Ubuntu 14.04 LTS:
  qemu-system                     2.0.0+dfsg-2ubuntu1.19
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.19
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.19
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.19
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.19
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.19
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.19
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.19

Ubuntu 12.04 LTS:
  qemu-kvm                        1.0+noroms-0ubuntu14.25

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2745-1

CVE-2015-5239, CVE-2015-5278, CVE-2015-5279, CVE-2015-6815,

CVE-2015-6855

Severity
critical
Lowest
Low
Medium
High
Critical

September 24, 2015

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu update instructions qemu-kvm qemu

Package Information

https://launchpad.net/ubuntu/+source/qemu/1:2.2+dfsg-5expubuntu9.5
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.19
https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.25

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.