Stay Secure with the Latest Linux Advisories

security advisorydenial of servicesoftware patch

Ubuntu 20.10: USN-4467-3 Critical: QEMU Denial of Service Risk

USN-4467-1 introduced a regression in QEMU.. =========================================================================Ubuntu Security Notice USN-4467-3 February 22, 2021 qemu regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: USN-4467-1 introduced a regression in QEMU. Software Description: - qemu: Machine emulator and virtualizer Details: USN-4467-1 fixed vulnerabilities in QEMU. The fix for CVE-2020-13754 introduced a regression in certain environments. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Ren Ding, Hanqing Zhao, Alexander Bulekov, and Anatoly Trosinenko discovered that the QEMU incorrectly handled certain msi-x mmio operations. An attacker inside a guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-13754) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 20.10: qemu 1:5.0-5ubuntu9.6 qemu-system 1:5.0-5ubuntu9.6 qemu-system-arm 1:5.0-5ubuntu9.6 qemu-system-mips 1:5.0-5ubuntu9.6 qemu-system-misc 1:5.0-5ubuntu9.6 qemu-system-ppc 1:5.0-5ubuntu9.6 qemu-system-s390x 1:5.0-5ubuntu9.6 qemu-system-sparc 1:5.0-5ubuntu9.6 qemu-system-x86 1:5.0-5ubuntu9.6 qemu-system-x86-microvm 1:5.0-5ubuntu9.6 qemu-system-x86-xen 1:5.0-5ubuntu9.6 Ubuntu 20.04 LTS: qemu 1:4.2-3ubuntu6.14 qemu-system 1:4.2-3ubuntu6.14 qemu-system-arm 1:4.2-3ubuntu6.14 qemu-system-mips 1:4.2-3ubuntu6.14 qemu-system-misc 1:4.2-3ubuntu6.14 qemu-system-ppc 1:4.2-3ubuntu6.14 qemu-system-s390x 1:4.2-3ubuntu6.14 qemu-system-sparc 1:4.2-3ubuntu6.14 qemu-system-x86 1:4.2-3ubuntu6.14 qemu-system-x86-microvm 1:4.2-3ubuntu6.14 qemu-system-x86-xen 1:4.2-3ubuntu6.14 Ubuntu 18.04 LTS: qemu 1:2.11+dfsg-1ubuntu7.36 qemu-system 1:2.11+dfsg-1ubuntu7.36 qemu-system-arm 1:2.11+dfsg-1ubuntu7.36 qemu-system-mips 1:2.11+dfsg-1ubuntu7.36 qemu-system-misc 1:2.11+dfsg-1ubuntu7.36 qemu-system-ppc 1:2.11+dfsg-1ubuntu7.36 qemu-system-s390x 1:2.11+dfsg-1ubuntu7.36 qemu-system-sparc 1:2.11+dfsg-1ubuntu7.36 qemu-system-x86 1:2.11+dfsg-1ubuntu7.36 Ubuntu 16.04 LTS: qemu 1:2.5+dfsg-5ubuntu10.51 qemu-system 1:2.5+dfsg-5ubuntu10.51 qemu-system-aarch64 1:2.5+dfsg-5ubuntu10.51 qemu-system-arm 1:2.5+dfsg-5ubuntu10.51 qemu-system-mips 1:2.5+dfsg-5ubuntu10.51 qemu-system-misc 1:2.5+dfsg-5ubuntu10.51 qemu-system-ppc 1:2.5+dfsg-5ubuntu10.51 qemu-system-s390x 1:2.5+dfsg-5ubuntu10.51 qemu-system-sparc 1:2.5+dfsg-5ubuntu10.51 qemu-system-x86 1:2.5+dfsg-5ubuntu10.51 After a standard system update you need to restart all QEMU virtual machines to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-4467-3 https://ubuntu.com/security/notices/USN-4467-1 https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1914883 Package Information: https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.6 https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.14 https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.36 https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.51 . A critical announcement for Ubuntu focusing on a fix for QEMU issues and vulnerabilities linked to Denial-of-Service attacks. Refer to the update guidelines.. QEMU Update, Ubuntu Security Notice, Regression Fixes, Denial of Service. . Severity: Critical. LinuxSecurity.com Team

Feb 22, 2021 •Critical Ubuntu