Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 20.04 LTS: USN-4511-1 Critical: QEMU Denial of Service

ubuntu
Calendar Grey September 17, 2020
Dist Ubuntu Esm H88
=========================================================================Ubuntu Security Notice USN-
QEMU could be made to crash or run programs.

Summary

QEMU could be made to crash or run programs.

Software Description:

- qemu: Machine emulator and virtualizer

Details:

Ziming Zhang, Xiao Wei, Gonglei Arei, and Yanyu Zhang discovered that QEMU

incorrectly handled certain USB packets. An attacker inside the guest could

use this issue to cause QEMU to crash, resulting in a denial of service, or

possibly execute arbitrary code on the host. In the default installation,

when QEMU is used with libvirt, attackers would be isolated by the libvirt

AppArmor profile.

Topics%20covered

Topics Covered

security advisory security issue arbitrary code execution Ubuntu system update Denial of Service QEMU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
  qemu                            1:4.2-3ubuntu6.6
  qemu-system                     1:4.2-3ubuntu6.6
  qemu-system-arm                 1:4.2-3ubuntu6.6
  qemu-system-mips                1:4.2-3ubuntu6.6
  qemu-system-ppc                 1:4.2-3ubuntu6.6
  qemu-system-s390x               1:4.2-3ubuntu6.6
  qemu-system-sparc               1:4.2-3ubuntu6.6
  qemu-system-x86                 1:4.2-3ubuntu6.6
  qemu-system-x86-microvm         1:4.2-3ubuntu6.6
  qemu-system-x86-xen             1:4.2-3ubuntu6.6

Ubuntu 18.04 LTS:
  qemu                            1:2.11+dfsg-1ubuntu7.32
  qemu-system                     1:2.11+dfsg-1ubuntu7.32
  qemu-system-arm                 1:2.11+dfsg-1ubuntu7.32
  qemu-system-mips                1:2.11+dfsg-1ubuntu7.32
  qemu-system-ppc                 1:2.11+dfsg-1ubuntu7.32
  qemu-system-s390x               1:2.11+dfsg-1ubuntu7.32
  qemu-system-sparc               1:2.11+dfsg-1ubuntu7.32
  qemu-system-x86                 1:2.11+dfsg-1ubuntu7.32

Ubuntu 16.04 LTS:
  qemu                            1:2.5+dfsg-5ubuntu10.46
  qemu-block-extra                1:2.5+dfsg-5ubuntu10.46
  qemu-guest-agent                1:2.5+dfsg-5ubuntu10.46
  qemu-kvm                        1:2.5+dfsg-5ubuntu10.46
  qemu-system                     1:2.5+dfsg-5ubuntu10.46
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.46
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.46
  qemu-system-common              1:2.5+dfsg-5ubuntu10.46
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.46
  qemu-system-misc                1:2.5+dfsg-5ubuntu10.46
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.46
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.46
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.46
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.46
  qemu-user                       1:2.5+dfsg-5ubuntu10.46
  qemu-user-binfmt                1:2.5+dfsg-5ubuntu10.46
  qemu-user-static                1:2.5+dfsg-5ubuntu10.46
  qemu-utils                      1:2.5+dfsg-5ubuntu10.46

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4511-1

CVE-2020-14364

Severity
critical
Lowest
Low
Medium
High
Critical

September 17, 2020

Topics%20covered

Topics Covered

security advisory security issue arbitrary code execution Ubuntu system update Denial of Service QEMU

Package Information

https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.6
https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.32
https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.46

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here