Debian Security Advisory

DLA-1927-1 qemu -- LTS security update

Date Reported:
20 Sep 2019
Affected Packages:
qemu
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 826151, Bug 832619, Bug 864219, Bug 929353, Bug 931351, Bug 933741, Bug 933742, Bug 939868, Bug 939869.
In Mitre's CVE dictionary: CVE-2016-5126, CVE-2016-5403, CVE-2017-9375, CVE-2019-12068, CVE-2019-12155, CVE-2019-13164, CVE-2019-14378, CVE-2019-15890.
More information:

Several vulnerabilities were found in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization).

  • CVE-2016-5126

    Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

  • CVE-2016-5403

    The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

  • CVE-2017-9375

    QEMU, when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.

  • CVE-2019-12068

    QEMU scsi disk backend: lsi: exit infinite loop while executing script

  • CVE-2019-12155

    interface_release_resource in hw/display/qxl.c in QEMU has a NULL pointer dereference.

  • CVE-2019-13164

    qemu-bridge-helper.c in QEMU does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

  • CVE-2019-14378

    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

  • CVE-2019-15890

    libslirp 4.0.0, as used in QEMU, has a use-after-free in ip_reass in ip_input.c.

For Debian 8 Jessie, these problems have been fixed in version 1:2.1+dfsg-12+deb8u12.

We recommend that you upgrade your qemu packages.

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS