Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 16.04, 16.10 Security Advisory: Critical QEMU DoS Issues

ubuntu
Calendar Grey November 9, 2016
Scroller Ubuntu
Multiple vulnerabilities in QEMU have been addressed, impacting Ubuntu releases with the possibility of service disruption and potential arbitrary code execution.
Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

- qemu-kvm: Machine emulator and virtualizer

Details:

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A

privileged attacker inside the guest could use this issue to cause QEMU to

consume resources, resulting in a denial of service. (CVE-2016-5403)

Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network

card emulation support. A privileged attacker inside the guest could use

this issue to cause QEMU to crash, resulting in a denial of service. This

issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.

(CVE-2016-6833, CVE-2016-6834, CVE-2016-6888)

Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network

card emulation support. A privileged attacker inside the guest could use

this issue to cause QEMU to crash, resulting in a denial of service, or

possibly execute arbitrary code ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory critical Ubuntu Denial Of Service QEMU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  qemu-system                     1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-aarch64             1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-arm                 1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-mips                1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-misc                1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-ppc                 1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-s390x               1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-sparc               1:2.6.1+dfsg-0ubuntu5.1
  qemu-system-x86                 1:2.6.1+dfsg-0ubuntu5.1

Ubuntu 16.04 LTS:
  qemu-system                     1:2.5+dfsg-5ubuntu10.6
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.6
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.6
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.6
  qemu-system-misc                1:2.5+dfsg-5ubuntu10.6
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.6
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.6
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.6
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.6

Ubuntu 14.04 LTS:
  qemu-system                     2.0.0+dfsg-2ubuntu1.30
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.30
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.30
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.30
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.30
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.30
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.30
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.30

Ubuntu 12.04 LTS:
  qemu-kvm                        1.0+noroms-0ubuntu14.31

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3125-1

CVE-2016-5403, CVE-2016-6833, CVE-2016-6834, CVE-2016-6835,

CVE-2016-6836, CVE-2016-6888, CVE-2016-7116, CVE-2016-7155,

CVE-2016-7156, CVE-2016-7157, CVE-2016-7161, CVE-2016-7170,

CVE-2016-7421, CVE-2016-7422, CVE-2016-7423, CVE-2016-7466,

CVE-2016-7908, CVE-2016-7909, CVE-2016-7994, CVE-2016-7995,

CVE-2016-8576, CVE-2016-8577, CVE-2016-8578, CVE-2016-8668,

CVE-2016-8909, CVE-2016-8910, CVE-2016-9101, CVE-2016-9102,

CVE-2016-9103, CVE-2016-9104, CVE-2016-9105, CVE-2016-9106

Severity
critical
Lowest
Low
Medium
High
Critical

November 09, 2016

Topics%20covered

Topics Covered

security advisory critical Ubuntu Denial Of Service QEMU

Package Information

https://launchpad.net/ubuntu/+source/qemu/1:2.6.1+dfsg-0ubuntu5.1
https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.6
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.30
https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.31

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.