QEMU-KVM Security Update
Summary
DLA-574-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u14. Fixed in 1.1.2+dfsg-6+deb7u14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU-KVM is a full virtualization solution designed for x86 hardware. It provides a platform for running virtual machines on a host system. QEMU-KVM allows users to create and manage virtual environments, enabling the execution of multiple operating systems simultaneously. However, several vulnerabilities have been discovered in QEMU-KVM, which could potentially lead to denial of service attacks, memory leaks, and out-of-bound access issues.
Vulnerability Detail
The following vulnerabilities have been identified in QEMU-KVM:
-
CVE-2015-5239: This vulnerability allows a malicious guest to cause the QEMU process to hang, resulting in a denial of service.
-
CVE-2016-2857: An attacker inside the guest can exploit this vulnerability to crash QEMU, leading to a denial of service or potential host memory leakage.
-
CVE-2016-4020: A privileged attacker within the guest can exploit this vulnerability to potentially leak host memory bytes.
-
CVE-2016-4439 / CVE-2016-6351: The emulation of the 53C9X Fast SCSI Controller is affected by out-of-bound access issues.
-
CVE-2016-5403: A malicious guest administrator can cause unbounded memory allocation in QEMU, resulting in an out-of-memory condition.
These vulnerabilities pose a significant risk to the stability and security of QEMU-KVM environments.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for these vulnerabilities. It is essential to apply the recommended fix by upgrading the qemu-kvm packages to the latest version.
Conclusion
QEMU-KVM is susceptible to multiple vulnerabilities that can lead to denial of service attacks, memory leaks, and potential leakage of host memory bytes. To mitigate these risks, it is crucial to upgrade the qemu-kvm packages to version 1.1.2+dfsg-6+deb7u14 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qemu-kvm →
FAQ
QEMU-KVM is a full virtualization solution that allows users to create and manage virtual machines on x86 hardware.
These vulnerabilities can lead to denial of service attacks, memory leaks, and potential leakage of host memory bytes.
To fix these vulnerabilities, it is recommended to upgrade your qemu-kvm packages to version 1.1.2+dfsg-6+deb7u14 or later.
No specific workaround has been mentioned for these vulnerabilities. It is essential to apply the recommended fix by upgrading the qemu-kvm packages to the latest version.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
