This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============2705958736210929888==
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="cHYGTDxrwfvnNN8qOdwREDGlBX8lbbXsQ"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--cHYGTDxrwfvnNN8qOdwREDGlBX8lbbXsQ
Content-Type: multipart/mixed;
boundary="DCLJkWzjayedWBIZMYireuEBS3FQjRABf";
protected-headers="v1"
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: "ubuntu-security-announce@lists.ubuntu.com"
<ubuntu-security-announce@lists.ubuntu.com>
Message-ID: <ffdef40a-f4a7-1a55-03a9-caaa7ac5d01b@canonical.com>
Subject: [USN-4650-1] QEMU vulnerabilities
--DCLJkWzjayedWBIZMYireuEBS3FQjRABf
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable
==========================================================================
Ubuntu Security Notice USN-4650-1
November 30, 2020
qemu vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in QEMU.
Software Description:
- qemu: Machine emulator and virtualizer
Details:
Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code on the host. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2020-17380)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU
incorrectly handled USB device emulation. An attacker inside the guest
could use this issue to cause QEMU to crash, resulting in a denial of
service. (CVE-2020-25084)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU
incorrectly handled SDHCI device emulation. An attacker inside the guest
could use this issue to cause QEMU to crash, resulting in a denial of
service. (CVE-2020-25085)
Gaoning Pan, Yongkang Jia, and Yi Ren discovered that QEMU incorrectly
handled USB device emulation. An attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2020-25624)
It was discovered that QEMU incorrectly handled USB device emulation. An
attacker inside the guest could use this issue to cause QEMU to hang,
resulting in a denial of service. (CVE-2020-25625)
Cheolwoo Myung discovered that QEMU incorrectly handled USB device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. (CVE-2020-25723)
Gaoning Pan discovered that QEMU incorrectly handled ATI graphics device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 20.10. (CVE-2020-27616)
Gaoning Pan discovered that QEMU incorrectly handled networking. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. (CVE-2020-27617)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
qemu-system 1:5.0-5ubuntu9.2
qemu-system-arm 1:5.0-5ubuntu9.2
qemu-system-mips 1:5.0-5ubuntu9.2
qemu-system-misc 1:5.0-5ubuntu9.2
qemu-system-ppc 1:5.0-5ubuntu9.2
qemu-system-s390x 1:5.0-5ubuntu9.2
qemu-system-sparc 1:5.0-5ubuntu9.2
qemu-system-x86 1:5.0-5ubuntu9.2
qemu-system-x86-microvm 1:5.0-5ubuntu9.2
qemu-system-x86-xen 1:5.0-5ubuntu9.2
Ubuntu 20.04 LTS:
qemu-system 1:4.2-3ubuntu6.10
qemu-system-arm 1:4.2-3ubuntu6.10
qemu-system-mips 1:4.2-3ubuntu6.10
qemu-system-misc 1:4.2-3ubuntu6.10
qemu-system-ppc 1:4.2-3ubuntu6.10
qemu-system-s390x 1:4.2-3ubuntu6.10
qemu-system-sparc 1:4.2-3ubuntu6.10
qemu-system-x86 1:4.2-3ubuntu6.10
qemu-system-x86-microvm 1:4.2-3ubuntu6.10
qemu-system-x86-xen 1:4.2-3ubuntu6.10
Ubuntu 18.04 LTS:
qemu-system 1:2.11+dfsg-1ubuntu7.34
qemu-system-arm 1:2.11+dfsg-1ubuntu7.34
qemu-system-mips 1:2.11+dfsg-1ubuntu7.34
qemu-system-misc 1:2.11+dfsg-1ubuntu7.34
qemu-system-ppc 1:2.11+dfsg-1ubuntu7.34
qemu-system-s390x 1:2.11+dfsg-1ubuntu7.34
qemu-system-sparc 1:2.11+dfsg-1ubuntu7.34
qemu-system-x86 1:2.11+dfsg-1ubuntu7.34
Ubuntu 16.04 LTS:
qemu-system 1:2.5+dfsg-5ubuntu10.48
qemu-system-aarch64 1:2.5+dfsg-5ubuntu10.48
qemu-system-arm 1:2.5+dfsg-5ubuntu10.48
qemu-system-mips 1:2.5+dfsg-5ubuntu10.48
qemu-system-misc 1:2.5+dfsg-5ubuntu10.48
qemu-system-ppc 1:2.5+dfsg-5ubuntu10.48
qemu-system-s390x 1:2.5+dfsg-5ubuntu10.48
qemu-system-sparc 1:2.5+dfsg-5ubuntu10.48
qemu-system-x86 1:2.5+dfsg-5ubuntu10.48
After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.
References:
https://usn.ubuntu.com/4650-1
CVE-2020-17380, CVE-2020-25084, CVE-2020-25085, CVE-2020-25624,
CVE-2020-25625, CVE-2020-25723, CVE-2020-27616, CVE-2020-27617
Package Information:
https://launchpad.net/ubuntu/+source/qemu/1:5.0-5ubuntu9.2
https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.10
https://launchpad.net/ubuntu/+source/qemu/1:2.11+dfsg-1ubuntu7.34
https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.48
--DCLJkWzjayedWBIZMYireuEBS3FQjRABf--
--cHYGTDxrwfvnNN8qOdwREDGlBX8lbbXsQ
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl/E/osACgkQZWnYVadE
vpP2xA//UvSgGe3O1ALhtLNMqoHboPN5B4iYL7DN0MoqYYzsNny3iCpWiQ5yxs4p
syGS7seAYGTw7JtzoLoOwbe+esMiMJgQwKFe8fDJPhoqotR5L2PzqMEnY/qff3b4
f325M8jJZqndlwZDoIfDqetEqrEcs8Orto93ENdobp96cSNyLkbmOCf2kW7Us+4E
RJEmj41DYJrNGHaBrjgvGpEP6XVzPtGLMFD4z38/3LWzwB5wJ/xQW/Oo+Ac4lgPE
FS5TaS3IdOYcuVcNlP2qV5PYVlcFdY0+xFDxs0eTw09g3uJoSX27KHXb0KaoD7R8
kMcmqGxZRK0iLL/VDgse4ey7IsriBNV5VcEPmbZn1acwiV/PCLW2yfHJranvHTq5
rb7TLHSVzpnX9L0Qlm13WLKmywsgZxBQKOZ5BgAmj6I8IFovVyXxdxcb0eTIt7vY
bx6Owwvtcohza7SvZz9XzsH7LtrCc17E0+1SQ1pkLdO3P9GDBciaQVceG2wuTu9D
6+dLYW5chA5MXg6AmuxqrfzPBERUlQyo3Jg3yvdKMbGqTfVBoqvm9JzP5n8WOIkU
KEsYnMQE2nUuS2CS/VC2mJppnIqys6IEscQ16A807bZsC6/CrPtlaO5sRSZAfHCI
NPXgpvOKyhp0IOQozXoYyYesK81fRFVEj7rIzQXTx3Qj9CWli8s=
=zqaX
-----END PGP SIGNATURE-----
--cHYGTDxrwfvnNN8qOdwREDGlBX8lbbXsQ--
--===============2705958736210929888==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK
--===============2705958736210929888==--
|
