Security Update for qemu-kvm
Summary
DLA-965-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u22. Fixed in 1.1.2+dfsg-6+deb7u22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qemu-kvm is a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick Emulator (Qemu). It provides a platform for running virtual machines and emulating various hardware devices. However, several vulnerabilities have been discovered in qemu-kvm that could potentially lead to privilege escalation and denial of service attacks.
Vulnerability Detail
The vulnerabilities in qemu-kvm include:
-
CVE-2016-9602: This vulnerability allows a privileged user inside a guest to access the host file system beyond the shared folder, potentially escalating their privileges on the host.
-
CVE-2017-7377: A memory leakage issue in the virtio-9p back-end support could be exploited by a privileged user/process inside a guest to leak host memory, resulting in a denial of service.
-
CVE-2017-7471: Another improper access control issue in the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, allows a privileged user inside a guest to access files on a shared host directory, potentially escalating their privileges on the host.
-
CVE-2017-7493: This vulnerability in the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, allows a guest user to escalate their privileges inside the guest by accessing virtfs metadata files in mapped-file security mode.
-
CVE-2017-8086: Similar to CVE-2017-7377, this vulnerability in the virtio-9p back-end support allows a privileged user/process inside a guest to leak host memory by querying file system extended attributes.
These vulnerabilities pose a significant risk to the security and stability of systems running qemu-kvm.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u22
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the recommended fix by upgrading the qemu-kvm packages.
Conclusion
qemu-kvm is a virtualization solution for Linux hosts that has been found to have several vulnerabilities. These vulnerabilities could allow privileged users to access the host file system, leak host memory, and potentially escalate their privileges. It is crucial to upgrade the qemu-kvm packages to the recommended version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for qemu-kvm →
FAQ
qemu-kvm is a full virtualization solution for Linux hosts on x86 hardware with x86 guests. It allows users to run virtual machines and emulate various hardware devices.
These vulnerabilities could allow a privileged user inside a guest to access the host file system beyond the shared folder, potentially escalating their privileges on the host. They could also result in memory leakage and denial of service attacks.
To fix these vulnerabilities, it is recommended to upgrade the qemu-kvm packages to version 1.1.2+dfsg-6+deb7u22 or later. Follow the instructions provided by Debian LTS security advisories to apply the updates.
No specific workarounds have been mentioned for these vulnerabilities. It is advised to apply the recommended fix by upgrading the qemu-kvm packages.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
