Security Update for qemu package
Summary
DLA-1035-1: qemu - security update. Affects qemu versions < 1.1.2+dfsg-6+deb7u22. Fixed in 1.1.2+dfsg-6+deb7u22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qemu package is a fast processor emulator that allows users to run virtual machines on their systems. It provides support for various hardware devices and operating systems. However, several vulnerabilities have been discovered in qemu, which could potentially lead to denial of service (DoS) attacks or the execution of arbitrary code on the host system.
Vulnerability Detail
The identified vulnerabilities in qemu include:
-
CVE-2016-9603: This vulnerability affects qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator and the VNC display driver support. It allows a privileged user/process inside the guest to perform a heap buffer overflow, leading to a crash of the qemu process or potential execution of arbitrary code on the host system.
-
CVE-2017-7718: This vulnerability affects qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator support. It allows a privileged user inside the guest to trigger an out-of-bounds access issue while copying VGA data, resulting in a crash of the qemu process.
-
CVE-2017-7980: This vulnerability affects qemu-kvm built with the Cirrus CLGD 54xx VGA Emulator support. It allows a privileged user inside the guest to trigger out-of-bounds read/write access issues while copying VGA data via various bitblt functions, potentially leading to a crash of the qemu process or execution of arbitrary code on the host system.
-
CVE-2016-9602: This vulnerability affects qemu built with the VirtFS and host directory sharing via Plan 9 File System (9pfs) support. It allows a privileged user inside the guest to access the host file system beyond the shared folder, potentially escalating their privileges on the host system.
-
CVE-2017-7377: This vulnerability affects qemu built with the virtio-9p back-end support. It allows a privileged user/process inside the guest to leak host memory by exploiting a memory leakage issue during I/O operations.
-
CVE-2017-7471: This vulnerability affects qemu built with the VirtFS and host directory sharing via Plan 9 File System (9pfs) support. It allows a privileged user inside the guest to access files on a shared host directory, potentially accessing the host file system beyond the shared folder and escalating their privileges on the host system.
-
CVE-2017-7493: This vulnerability affects qemu built with the VirtFS and host directory sharing via Plan 9 File System (9pfs) support. It allows a guest user to escalate their privileges inside the guest by exploiting an improper access control issue while accessing virtfs metadata files in mapped-file security mode.
-
CVE-2017-8086: This vulnerability affects qemu built with the virtio-9p back-end support. It allows a privileged user/process inside the guest to leak host memory by exploiting a memory leakage issue during the querying of file system extended attributes via the 9pfs_list_xattr() routine.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
In conclusion, the qemu package is vulnerable to multiple security issues that could result in denial of service (DoS) attacks or the execution of arbitrary code on the host system. It is crucial to upgrade to the latest version of the package to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for qemu →
FAQ
Qemu is a fast processor emulator that allows users to run virtual machines on their systems. It provides support for various hardware devices and operating systems.
These vulnerabilities could lead to denial of service (DoS) attacks or the execution of arbitrary code on the host system by a privileged user/process inside the guest.
To fix these vulnerabilities, it is recommended to upgrade the qemu package to version 1.1.2+dfsg-6+deb7u22 or later.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about these vulnerabilities in the Debian LTS security advisories and the Common Vulnerabilities and Exposures (CVE) database.
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
