Ubuntu 20.10, 20.04 LTS: USN-4650-1 Critical: QEMU Denial Of Service

ubuntu

November 30, 2020

Several security issues were fixed in QEMU.

Summary

Several security issues were fixed in QEMU.

Software Description:

- qemu: Machine emulator and virtualizer

Details:

Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device

emulation. An attacker inside the guest could use this issue to cause QEMU

to crash, resulting in a denial of service, or possibly execute arbitrary

code on the host. In the default installation, when QEMU is used with

libvirt, attackers would be isolated by the libvirt AppArmor profile.

(CVE-2020-17380)

Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU

incorrectly handled USB device emulation. An attacker inside the guest

could use this issue to cause QEMU to crash, resulting in a denial of

service. (CVE-2020-25084)

Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU

incorrectly handled SDHCI device emulation. An attacker inside the guest

could use this issue to cause QEMU to crash, resulting in a denial of

service. (CV...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue software update Ubuntu update instructions QEMU

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  qemu-system                     1:5.0-5ubuntu9.2
  qemu-system-arm                 1:5.0-5ubuntu9.2
  qemu-system-mips                1:5.0-5ubuntu9.2
  qemu-system-misc                1:5.0-5ubuntu9.2
  qemu-system-ppc                 1:5.0-5ubuntu9.2
  qemu-system-s390x               1:5.0-5ubuntu9.2
  qemu-system-sparc               1:5.0-5ubuntu9.2
  qemu-system-x86                 1:5.0-5ubuntu9.2
  qemu-system-x86-microvm         1:5.0-5ubuntu9.2
  qemu-system-x86-xen             1:5.0-5ubuntu9.2

Ubuntu 20.04 LTS:
  qemu-system                     1:4.2-3ubuntu6.10
  qemu-system-arm                 1:4.2-3ubuntu6.10
  qemu-system-mips                1:4.2-3ubuntu6.10
  qemu-system-misc                1:4.2-3ubuntu6.10
  qemu-system-ppc                 1:4.2-3ubuntu6.10
  qemu-system-s390x               1:4.2-3ubuntu6.10
  qemu-system-sparc               1:4.2-3ubuntu6.10
  qemu-system-x86                 1:4.2-3ubuntu6.10
  qemu-system-x86-microvm         1:4.2-3ubuntu6.10
  qemu-system-x86-xen             1:4.2-3ubuntu6.10

Ubuntu 18.04 LTS:
  qemu-system                     1:2.11+dfsg-1ubuntu7.34
  qemu-system-arm                 1:2.11+dfsg-1ubuntu7.34
  qemu-system-mips                1:2.11+dfsg-1ubuntu7.34
  qemu-system-misc                1:2.11+dfsg-1ubuntu7.34
  qemu-system-ppc                 1:2.11+dfsg-1ubuntu7.34
  qemu-system-s390x               1:2.11+dfsg-1ubuntu7.34
  qemu-system-sparc               1:2.11+dfsg-1ubuntu7.34
  qemu-system-x86                 1:2.11+dfsg-1ubuntu7.34

Ubuntu 16.04 LTS:
  qemu-system                     1:2.5+dfsg-5ubuntu10.48
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.48
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.48
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.48
  qemu-system-misc                1:2.5+dfsg-5ubuntu10.48
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.48
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.48
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.48
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.48

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.