Ubuntu 15.10 Moderate Advisory: QEMU Denial Of Service Risks

ubuntu

February 3, 2016

Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

- qemu-kvm: Machine emulator and virtualizer

Details:

Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An

attacker inside the guest could use this issue to cause QEMU to crash,

resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS

and Ubuntu 15.10. (CVE-2015-7549)

Lian Yihan discovered that QEMU incorrectly handled the VNC server. A

remote attacker could use this issue to cause QEMU to crash, resulting in a

denial of service. (CVE-2015-8504)

Felix Wilhelm discovered a race condition in the Xen paravirtualized

drivers which can cause double fetch vulnerabilities. An attacker in the

paravirtualized guest could exploit this flaw to cause a denial of service

(crash the host) or potentially execute arbitrary code on the host.

(CVE-2015-8550)

Qinghao Tang discovered that QEMU incorrectly handled USB EHCI emu...

Read the Full Advisory

Topics Covered

security advisory denial of service software update Ubuntu QEMU moderate security issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  qemu-system                     1:2.3+dfsg-5ubuntu9.2
  qemu-system-aarch64             1:2.3+dfsg-5ubuntu9.2
  qemu-system-arm                 1:2.3+dfsg-5ubuntu9.2
  qemu-system-mips                1:2.3+dfsg-5ubuntu9.2
  qemu-system-misc                1:2.3+dfsg-5ubuntu9.2
  qemu-system-ppc                 1:2.3+dfsg-5ubuntu9.2
  qemu-system-sparc               1:2.3+dfsg-5ubuntu9.2
  qemu-system-x86                 1:2.3+dfsg-5ubuntu9.2

Ubuntu 14.04 LTS:
  qemu-system                     2.0.0+dfsg-2ubuntu1.22
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.22
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.22
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.22
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.22
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.22
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.22
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.22

Ubuntu 12.04 LTS:
  qemu-kvm                        1.0+noroms-0ubuntu14.27

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.