Ubuntu 16.04 LTS USN-2974-1 Moderate: QEMU Denial of Service Risks

ubuntu

May 12, 2016

Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

- qemu-kvm: Machine emulator and virtualizer

Details:

Zuozhi Fzz discovered that QEMU incorrectly handled USB OHCI emulation

support. A privileged attacker inside the guest could use this issue to

cause QEMU to crash, resulting in a denial of service. (CVE-2016-2391)

Qinghao Tang discovered that QEMU incorrectly handled USB Net emulation

support. A privileged attacker inside the guest could use this issue to

cause QEMU to crash, resulting in a denial of service. (CVE-2016-2392)

Qinghao Tang discovered that QEMU incorrectly handled USB Net emulation

support. A privileged attacker inside the guest could use this issue to

cause QEMU to crash, resulting in a denial of service, or possibly leak

host memory bytes. (CVE-2016-2538)

Hongke Yang discovered that QEMU incorrectly handled NE2000 emulation

support. A privileged attacker inside the guest could us...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue software update security fix Ubuntu QEMU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  qemu-system                     1:2.5+dfsg-5ubuntu10.1
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.1
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.1
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.1
  qemu-system-misc                1:2.5+dfsg-5ubuntu10.1
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.1
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.1
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.1
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.1

Ubuntu 15.10:
  qemu-system                     1:2.3+dfsg-5ubuntu9.4
  qemu-system-aarch64             1:2.3+dfsg-5ubuntu9.4
  qemu-system-arm                 1:2.3+dfsg-5ubuntu9.4
  qemu-system-mips                1:2.3+dfsg-5ubuntu9.4
  qemu-system-misc                1:2.3+dfsg-5ubuntu9.4
  qemu-system-ppc                 1:2.3+dfsg-5ubuntu9.4
  qemu-system-sparc               1:2.3+dfsg-5ubuntu9.4
  qemu-system-x86                 1:2.3+dfsg-5ubuntu9.4

Ubuntu 14.04 LTS:
  qemu-system                     2.0.0+dfsg-2ubuntu1.24
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.24
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.24
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.24
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.24
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.24
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.24
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.24

Ubuntu 12.04 LTS:
  qemu-kvm                        1.0+noroms-0ubuntu14.28

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.