Debian Security Advisory

DLA-2560-1 qemu -- LTS security update

Date Reported:
18 Feb 2021
Affected Packages:
qemu
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 970253, Bug 965978, Bug 970539, Bug 974687, Bug 976388.
In Mitre's CVE dictionary: CVE-2020-15469, CVE-2020-15859, CVE-2020-25084, CVE-2020-28916, CVE-2020-29130, CVE-2020-29443, CVE-2021-20181, CVE-2021-20221.
More information:

Several vulnerabilities were discovered in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization). An attacker could trigger a denial-of-service (DoS), information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host.

  • CVE-2020-15469

    A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

  • CVE-2020-15859

    QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

  • CVE-2020-25084

    QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

  • CVE-2020-28916

    hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address.

  • CVE-2020-29130

    slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

  • CVE-2020-29443

    ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated.

  • CVE-2021-20181

    9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability.

  • CVE-2021-20221

    aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field.

For Debian 9 stretch, these problems have been fixed in version 1:2.8+dfsg-6+deb9u13.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to its security tracker page at: https://security-tracker.debian.org/tracker/qemu

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS