Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.2707
QEMU vulnerabilities
11 November 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: qemu-system
Publisher: Ubuntu
Operating System: Ubuntu
Impact/Access: Execute Arbitrary Code/Commands -- Existing Account
Denial of Service -- Existing Account
Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2016-9106 CVE-2016-9105 CVE-2016-9104
CVE-2016-9103 CVE-2016-9102 CVE-2016-9101
CVE-2016-8910 CVE-2016-8909 CVE-2016-8668
CVE-2016-8578 CVE-2016-8577 CVE-2016-8576
CVE-2016-7995 CVE-2016-7994 CVE-2016-7909
CVE-2016-7908 CVE-2016-7466 CVE-2016-7423
CVE-2016-7422 CVE-2016-7421 CVE-2016-7170
CVE-2016-7161 CVE-2016-7157 CVE-2016-7156
CVE-2016-7155 CVE-2016-7116 CVE-2016-6888
CVE-2016-6836 CVE-2016-6835 CVE-2016-6834
CVE-2016-6833 CVE-2016-5403
Reference: ESB-2016.2652
ESB-2016.2472
ESB-2016.2420
ESB-2016.2401
Original Bulletin:
http://www.ubuntu.com/usn/usn-3125-1
- --------------------------BEGIN INCLUDED TEXT--------------------
==========================================================================
Ubuntu Security Notice USN-3125-1
November 09, 2016
qemu, qemu-kvm vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- - Ubuntu 16.10
- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS
- - Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in QEMU.
Software Description:
- - qemu: Machine emulator and virtualizer
- - qemu-kvm: Machine emulator and virtualizer
Details:
Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. (CVE-2016-5403)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6833, CVE-2016-6834, CVE-2016-6888)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to cause QEMU to crash, resulting in a denial of service, or
possibly execute arbitrary code on the host. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS and Ubuntu 16.10. (CVE-2016-6835)
Li Qiang discovered that QEMU incorrectly handled VMWARE VMXNET3 network
card emulation support. A privileged attacker inside the guest could use
this issue to possibly to obtain sensitive host memory. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-6836)
Felix Wilhelm discovered that QEMU incorrectly handled Plan 9 File System
(9pfs) support. A privileged attacker inside the guest could use this issue
to possibly to obtain sensitive host files. (CVE-2016-7116)
Li Qiang and Tom Victor discovered that QEMU incorrectly handled VMWARE
PVSCSI paravirtual SCSI bus emulation support. A privileged attacker inside
the guest could use this issue to cause QEMU to crash, resulting in a
denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04
LTS and Ubuntu 16.10. (CVE-2016-7155)
Li Qiang discovered that QEMU incorrectly handled VMWARE PVSCSI paravirtual
SCSI bus emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu
16.10. (CVE-2016-7156, CVE-2016-7421)
Tom Victor discovered that QEMU incorrectly handled LSI SAS1068 host bus
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.10. (CVE-2016-7157)
Hu Chaojian discovered that QEMU incorrectly handled xlnx.xps-ethernetlite
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code on the host. In the default installation, when QEMU
is used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. (CVE-2016-7161)
Qinghao Tang and Li Qiang discovered that QEMU incorrectly handled the
VMWare VGA module. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2016-7170)
Qinghao Tang and Zhenhao Hong discovered that QEMU incorrectly handled the
Virtio module. A privileged attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 16.10. (CVE-2016-7422)
Li Qiang discovered that QEMU incorrectly handled LSI SAS1068 host bus
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.10. (CVE-2016-7423)
Li Qiang discovered that QEMU incorrectly handled USB xHCI controller
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7466)
Li Qiang discovered that QEMU incorrectly handled ColdFire Fast Ethernet
Controller emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2016-7908)
Li Qiang discovered that QEMU incorrectly handled AMD PC-Net II emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2016-7909)
Li Qiang discovered that QEMU incorrectly handled the Virtio GPU support. A
privileged attacker inside the guest could use this issue to cause QEMU to
consume resources, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7994)
Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 16.10. (CVE-2016-7995)
Li Qiang discovered that QEMU incorrectly handled USB xHCI controller
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-8576)
Li Qiang discovered that QEMU incorrectly handled Plan 9 File System (9pfs)
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-8577, CVE-2016-8578)
It was discovered that QEMU incorrectly handled Rocker switch emulation
support. A privileged attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. This issue only
affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8668)
It was discovered that QEMU incorrectly handled Intel HDA controller
emulation support. A privileged attacker inside the guest could use this
issue to cause QEMU to consume resources, resulting in a denial of service.
(CVE-2016-8909)
Andrew Henderson discovered that QEMU incorrectly handled RTL8139 ethernet
controller emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to consume resources, resulting in a denial of
service. (CVE-2016-8910)
Li Qiang discovered that QEMU incorrectly handled Intel i8255x ethernet
controller emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to consume resources, resulting in a denial of
service. (CVE-2016-9101)
Li Qiang discovered that QEMU incorrectly handled Plan 9 File System (9pfs)
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources, resulting in a denial of service.
(CVE-2016-9102, CVE-2016-9104, CVE-2016-9105)
Li Qiang discovered that QEMU incorrectly handled Plan 9 File System (9pfs)
support. A privileged attacker inside the guest could use this issue to
possibly to obtain sensitive host memory. (CVE-2016-9103)
Li Qiang discovered that QEMU incorrectly handled Plan 9 File System (9pfs)
support. A privileged attacker inside the guest could use this issue to
cause QEMU to consume resources, resulting in a denial of service. This
issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10.
(CVE-2016-9106)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.10:
qemu-system 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-aarch64 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-arm 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-mips 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-misc 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-ppc 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-s390x 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-sparc 1:2.6.1+dfsg-0ubuntu5.1
qemu-system-x86 1:2.6.1+dfsg-0ubuntu5.1
Ubuntu 16.04 LTS:
qemu-system 1:2.5+dfsg-5ubuntu10.6
qemu-system-aarch64 1:2.5+dfsg-5ubuntu10.6
qemu-system-arm 1:2.5+dfsg-5ubuntu10.6
qemu-system-mips 1:2.5+dfsg-5ubuntu10.6
qemu-system-misc 1:2.5+dfsg-5ubuntu10.6
qemu-system-ppc 1:2.5+dfsg-5ubuntu10.6
qemu-system-s390x 1:2.5+dfsg-5ubuntu10.6
qemu-system-sparc 1:2.5+dfsg-5ubuntu10.6
qemu-system-x86 1:2.5+dfsg-5ubuntu10.6
Ubuntu 14.04 LTS:
qemu-system 2.0.0+dfsg-2ubuntu1.30
qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.30
qemu-system-arm 2.0.0+dfsg-2ubuntu1.30
qemu-system-mips 2.0.0+dfsg-2ubuntu1.30
qemu-system-misc 2.0.0+dfsg-2ubuntu1.30
qemu-system-ppc 2.0.0+dfsg-2ubuntu1.30
qemu-system-sparc 2.0.0+dfsg-2ubuntu1.30
qemu-system-x86 2.0.0+dfsg-2ubuntu1.30
Ubuntu 12.04 LTS:
qemu-kvm 1.0+noroms-0ubuntu14.31
After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3125-1
CVE-2016-5403, CVE-2016-6833, CVE-2016-6834, CVE-2016-6835,
CVE-2016-6836, CVE-2016-6888, CVE-2016-7116, CVE-2016-7155,
CVE-2016-7156, CVE-2016-7157, CVE-2016-7161, CVE-2016-7170,
CVE-2016-7421, CVE-2016-7422, CVE-2016-7423, CVE-2016-7466,
CVE-2016-7908, CVE-2016-7909, CVE-2016-7994, CVE-2016-7995,
CVE-2016-8576, CVE-2016-8577, CVE-2016-8578, CVE-2016-8668,
CVE-2016-8909, CVE-2016-8910, CVE-2016-9101, CVE-2016-9102,
CVE-2016-9103, CVE-2016-9104, CVE-2016-9105, CVE-2016-9106
Package Information:
https://launchpad.net/ubuntu/+source/qemu/1:2.6.1+dfsg-0ubuntu5.1
https://launchpad.net/ubuntu/+source/qemu/1:2.5+dfsg-5ubuntu10.6
https://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.30
https://launchpad.net/ubuntu/+source/qemu-kvm/1.0+noroms-0ubuntu14.31
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWCUjSox+lLeg9Ub1AQioqg//fLqd6XYE/Kt3WcO3DA2C9VJjvkSGWYNo
ty0QJLdx+9+PotQh5gahy2hXASLQY1Jgv+VHQBMRIp4AVKh2srdD/1mC/4xWyIn4
0tQQ16/VY3BiVYjgK6RoFIKyUu1BvZNmsV/wN6szVcNPvVnwAFGqVUkNy9KBxGCG
Pwk/BmNucOS+eS8wFxevnzpd4Vy4IcpDq2dK60+RyXzAupPrIYvLMtdw2GPAvVs7
nfzPJQinuyVianBR2rPbQ3l4aPNjMg1e2AevVaAefJspg9vBWuX1CJ0LNkhJy8p/
sOKn8lG0HwpCK2VLExMJJrSdl5BuB+0m74Vif1fHMIClrDqK8WrAkXF3Qd/L1AbR
zk4SEb6g13rYJZE3eEyUe1R9SxJrjdcp3jBOgRpODxYnBV7F6ks+6tvxRxI4eeOT
xF4Zt+aWuVaAHLQXHkcKYLvVFs9tMUsIK0Fvj8d2rbJFoZf0vIEKx9xG5f+U5M3O
jTco6sJlvLRslbyH+g+3WOeKZbfFO87tOSsAD6Ck4/WShFBqasIsEPzVIhJj+AVS
0ZYG47oMa/3yLJMqSKmAbFJU02r5sZov2otUlwXUASPeg9wWRoZ2xeLJ9/8oj9vN
ZglDRd4s6vpjzogYMDM8xShgtsHUot9970oEHM+pfxlBPvz6w3T7Sx8wybMXERiS
aS1KOIn7g+w=
=V6TQ
-----END PGP SIGNATURE-----