Security Update for qemu-kvm
Summary
DLA-842-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u20. Fixed in 1.1.2+dfsg-6+deb7u20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qemu-kvm is a full virtualization solution for Linux hosts on x86 hardware with x86 guests. It provides a platform for running virtual machines with various operating systems. However, several vulnerabilities have been discovered in qemu-kvm that could potentially be exploited by privileged users inside guest systems to crash the Qemu process or execute arbitrary code on the host with the privileges of the qemu-kvm process.
Vulnerability Detail
The vulnerabilities in qemu-kvm include:
-
CVE-2017-2615: The Cirrus CLGD 54xx VGA Emulator is vulnerable to an out-of-bounds access issue while copying VGA data via bitblt copy in backward mode. This could allow a privileged user inside the guest to crash the Qemu process or execute arbitrary code on the host.
-
CVE-2017-2620: The Cirrus CLGD 54xx VGA Emulator is vulnerable to an out-of-bounds access issue while copying VGA data in cirrus_bitblt_cputovideo. Similar to CVE-2017-2615, this vulnerability could lead to a crash of the Qemu process or execution of arbitrary code on the host.
-
CVE-2017-5898: The CCID Card device emulator support is vulnerable to an integer overflow flaw while passing messages via command/responses packets to and from the host. Exploiting this vulnerability could result in a crash of the qemu-kvm process on the host, causing a denial of service (DoS).
-
CVE-2017-5973: The USB xHCI controller emulator support is vulnerable to an infinite loop issue while processing control transfer descriptors' sequence in xhci_kick_epctx. A privileged user inside the guest could exploit this flaw to crash the qemu-kvm process, leading to a DoS.
Additionally, this update also addresses the fix for CVE-2016-9921, which was too strict and caused issues with certain guests.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u20
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for these vulnerabilities.
Conclusion
qemu-kvm is a full virtualization solution for Linux hosts on x86 hardware with x86 guests. However, several vulnerabilities have been discovered that could allow privileged users inside guest systems to crash the Qemu process or execute arbitrary code on the host. It is recommended to upgrade the qemu-kvm packages to version 1.1.2+dfsg-6+deb7u20 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for qemu-kvm →
FAQ
qemu-kvm is a full virtualization solution for Linux hosts on x86 hardware with x86 guests. It allows users to run virtual machines with various operating systems.
The vulnerabilities in qemu-kvm could allow privileged users inside guest systems to crash the Qemu process or execute arbitrary code on the host with the privileges of the qemu-kvm process.
To fix these vulnerabilities, it is recommended to upgrade the qemu-kvm packages to version 1.1.2+dfsg-6+deb7u20 or later.
No specific workarounds have been mentioned for these vulnerabilities.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at the following link: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
