QEMU - Memory Leakage and Divide by Zero Vulnerabilities
Summary
DLA-764-1: qemu - security update. Affects qemu versions < 1.1.2+dfsg-6+deb7u19. Fixed in 1.1.2+dfsg-6+deb7u19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU is a fast and portable open-source machine emulator and virtualizer. It provides support for various hardware devices and architectures, allowing users to run virtual machines on their host systems. QEMU includes USB EHCI Emulation and Cirrus CLGD 54xx VGA Emulator support, which are vulnerable to memory leakage and divide by zero issues, respectively.
Vulnerability Detail
The memory leakage vulnerability (CVE-2016-9911) in QEMU's USB EHCI Emulation support can be exploited by a guest user or process to leak host memory, leading to a denial of service (DoS) on the host system. The divide by zero vulnerability (CVE-2016-9921/CVE-2016-9922) in QEMU's Cirrus CLGD 54xx VGA Emulator support can be exploited by a privileged user within a guest to crash the QEMU process on the host, resulting in a DoS.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u19
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Upgrading the qemu package to the recommended version will address the memory leakage and divide by zero vulnerabilities. If you require further assistance or support in remediating these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for qemu →
FAQ
QEMU is an open-source machine emulator and virtualizer that allows users to run virtual machines on their host systems.
The memory leakage vulnerability in QEMU's USB EHCI Emulation support can be exploited to leak host memory, resulting in a denial of service (DoS) on the host system.
The divide by zero vulnerability in QEMU's Cirrus CLGD 54xx VGA Emulator support can be exploited to crash the QEMU process on the host, resulting in a denial of service (DoS).
To fix these vulnerabilities, upgrade the qemu package to version 1.1.2+dfsg-6+deb7u19 or later.
There are no known workarounds for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
