Hash: SHA256

             AUSCERT External Security Bulletin Redistribution

                     [DLA 1599-1] qemu security update
                              3 December 2018


        AusCERT Security Bulletin Summary

Product:           qemu
Publisher:         Debian
Operating System:  Debian GNU/Linux 8
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account      
                   Denial of Service               -- Remote/Unauthenticated
                   Access Confidential Data        -- Existing Account      
                   Unauthorised Access             -- Existing Account      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-17963 CVE-2018-17962 CVE-2018-10839
                   CVE-2017-10664 CVE-2016-9106 CVE-2016-9105
                   CVE-2016-9104 CVE-2016-9103 CVE-2016-9102
                   CVE-2016-9101 CVE-2016-8910 CVE-2016-8909
                   CVE-2016-8578 CVE-2016-8577 CVE-2016-7909
                   CVE-2016-7908 CVE-2016-7421 CVE-2016-7170
                   CVE-2016-7161 CVE-2016-7156 CVE-2016-7155
                   CVE-2016-7116 CVE-2016-6888 CVE-2016-6836
                   CVE-2016-6834 CVE-2016-6351 CVE-2016-5338
                   CVE-2016-5337 CVE-2016-5238 CVE-2016-5107
                   CVE-2016-5106 CVE-2016-5105 CVE-2016-4952
                   CVE-2016-4454 CVE-2016-4453 CVE-2016-4441
                   CVE-2016-4439 CVE-2016-4037 CVE-2016-4020
                   CVE-2016-4002 CVE-2016-4001 CVE-2016-2858
                   CVE-2016-2857 CVE-2016-2841 CVE-2016-2538
                   CVE-2016-2392 CVE-2016-2391 

Reference:         ESB-2017.3002

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Package        : qemu
Version        : 1:2.1+dfsg-12+deb8u8
CVE ID         : CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841
                 CVE-2016-2857 CVE-2016-2858 CVE-2016-4001 CVE-2016-4002
                 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441
                 CVE-2016-4453 CVE-2016-4454 CVE-2016-4952 CVE-2016-5105
                 CVE-2016-5106 CVE-2016-5107 CVE-2016-5238 CVE-2016-5337
                 CVE-2016-5338 CVE-2016-6351 CVE-2016-6834 CVE-2016-6836
                 CVE-2016-6888 CVE-2016-7116 CVE-2016-7155 CVE-2016-7156
                 CVE-2016-7161 CVE-2016-7170 CVE-2016-7421 CVE-2016-7908
                 CVE-2016-7909 CVE-2016-8577 CVE-2016-8578 CVE-2016-8909
                 CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103
                 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 CVE-2017-10664
                 CVE-2018-10839 CVE-2018-17962 CVE-2018-17963
Debian Bug     : 815008 815009 815680 817181 817182 817183 821038 821061
                 821062 822344 824856 825210 825614 825615 825616 826152
                 827024 827026 832621 834902 834905 834944 836502 837174
                 837316 837339 838147 838850 839834 839835 840340 840341
                 841950 841955 842455 866674 910431 911468 911469

Several vulnerabilities were found in QEMU, a fast processor emulator:


    Zuozhi Fzz discovered that eof_times in USB OHCI emulation support
    could be used to cause a denial of service, via a null pointer

CVE-2016-2392 / CVE-2016-2538

    Qinghao Tang found a NULL pointer dereference and multiple integer
    overflows in the USB Net device support that could allow local guest
    OS administrators to cause a denial of service. These issues related
    to remote NDIS control message handling.


    Yang Hongke reported an infinite loop vulnerability in the NE2000 NIC
    emulation support.


    Liu Ling found a flaw in QEMU IP checksum routines. Attackers could
    take advantage of this issue to cause QEMU to crash.


    Arbitrary stack based allocation in the Pseudo Random Number Generator
    (PRNG) back-end support.

CVE-2016-4001 / CVE-2016-4002

    Oleksandr Bazhaniuk reported buffer overflows in the Stellaris and the
    MIPSnet ethernet controllers emulation. Remote malicious users could
    use these issues to cause QEMU to crash.


    Donghai Zdh reported that QEMU incorrectly handled the access to the
    Task Priority Register (TPR), allowing local guest OS administrators
    to obtain sensitive information from host stack memory.


    Du Shaobo found an infinite loop vulnerability in the USB EHCI
    emulation support.

CVE-2016-4439 / CVE-2016-4441 / CVE-2016-5238 / CVE-2016-5338 / CVE-2016-6351

    Li Qiang found different issues in the QEMU 53C9X Fast SCSI Controller
    (FSC) emulation support, that made it possible for local guest OS
    privileged users to cause denials of service or potentially execute
    arbitrary code.

CVE-2016-4453 / CVE-2016-4454

    Li Qiang reported issues in the QEMU VMWare VGA module handling, that
    may be used to cause QEMU to crash, or to obtain host sensitive

CVE-2016-4952 / CVE-2016-7421 / CVE-2016-7156

    Li Qiang reported flaws in the VMware paravirtual SCSI bus emulation
    support. These issues concern an out-of-bounds access and infinite
    loops, that allowed local guest OS privileged users to cause a denial
    of service.

CVE-2016-5105 / CVE-2016-5106 / CVE-2016-5107 / CVE-2016-5337

    Li Qiang discovered several issues in the MegaRAID SAS 8708EM2 Host
    Bus Adapter emulation support. These issues include stack information
    leakage while reading configuration and out-of-bounds write and read.


    Li Qiang reported an infinite loop vulnerability during packet
    fragmentation in the network transport abstraction layer support.
    Local guest OS privileged users could made use of this flaw to cause a
    denial of service.

CVE-2016-6836 / CVE-2016-6888

    Li Qiang found issues in the VMWare VMXNET3 network card emulation
    support, relating to information leak and integer overflow in packet


    Felix Wilhel discovered a directory traversal flaw in the Plan 9 File
    System (9pfs), exploitable by local guest OS privileged users.


    Tom Victor and Li Qiang reported an out-of-bounds read and an infinite
    loop in the VMware paravirtual SCSI bus emulation support.


    Hu Chaojian reported a heap overflow in the xlnx.xps-ethernetlite
    emulation support. Privileged users in local guest OS could made use
    of this to cause QEMU to crash.


    Qinghao Tang and Li Qiang reported a flaw in the QEMU VMWare VGA
    module, that could be used by privileged user in local guest OS to
    cause QEMU to crash via an out-of-bounds stack memory access.

CVE-2016-7908 /  CVE-2016-7909

    Li Qiang reported infinite loop vulnerabilities in the ColdFire Fast
    Ethernet Controller and the AMD PC-Net II (Am79C970A) emulations.
    These flaws allowed local guest OS administrators to cause a denial of


    Huawei PSIRT found an infinite loop vulnerability in the Intel HDA
    emulation support, relating to DMA buffer stream processing.
    Privileged users in local guest OS could made use of this to cause a
    denial of service.


    Andrew Henderson reported an infinite loop in the RTL8139 ethernet
    controller emulation support. Privileged users inside a local guest OS
    could made use of this to cause a denial of service.


    Li Qiang reported a memory leakage in the i8255x (PRO100) ethernet
    controller emulation support.

CVE-2016-9102 / CVE-2016-9103 / CVE-2016-9104 / CVE-2016-9105 /
CVE-2016-9106 / CVE-2016-8577 / CVE-2016-8578

    Li Qiang reported various Plan 9 File System (9pfs) security issues,
    including host memory leakage and denial of service.


    Denial of service in the qemu-nbd (QEMU Disk Network Block Device)

CVE-2018-10839 / CVE-2018-17962 / CVE-2018-17963

    Daniel Shapira reported several integer overflows in the packet
    handling in ethernet controllers emulated by QEMU. These issues could
    lead to denial of service.

For Debian 8 "Jessie", these problems have been fixed in version

We recommend that you upgrade your qemu packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967