Ubuntu update for qemu

1) NULL pointer dereference

EUVDB-ID: #VU63775

Risk: Low

CVSSv3.1: 2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20196

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the floppy disk emulator of QEMU. A privileged guest can trigger a NULL pointer dereference error and cause a denial of service. 

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Integer overflow

EUVDB-ID: #VU63776

Risk: Low

CVSSv3.1: 2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20203

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to integer overflow in the vmxnet3 NIC emulator of the QEMU. A privileged guest user can pass invalid values for the rx/tx queue size or other NIC parameters and perform a denial of service attack.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory leak

EUVDB-ID: #VU53679

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3544

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due to multiple memory leaks in the vhost-user-gpu/vhost-user-gpu.c. A remote authenticated user of the guest operating system can force the application to leak memory and perform denial of service attack.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Information disclosure

EUVDB-ID: #VU53680

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3545

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to uninitialized memory disclosure within the virgl_cmd_get_capset_info() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

EUVDB-ID: #VU53681

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3546

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a boundary error when processing untrusted input within the virgl_cmd_get_capset() function in vhost-user-gpu/virgl.c. A remote authenticated user of the guest operating system can trigger an out-of-bounds write and escalate privileges.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Release of invalid pointer or reference

EUVDB-ID: #VU63778

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3682

CWE-ID: CWE-763 - Release of invalid pointer or reference

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists in the USB redirector device emulation of QEMU when dropping packets during a bulk transfer from a SPICE client. A remote user can make QEMU call free() with faked heap chunk metadata to perform a denial of service or escalate privileges on the system.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds write

EUVDB-ID: #VU63779

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3713

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in the UAS (USB Attached SCSI) device emulation of QEMU. A local user can perform a denial of service or escalate privileges on the system.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

EUVDB-ID: #VU58813

Risk: High

CVSSv3.1: 7.8 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3748

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote guest to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when in the virtio-net device of QEMU. A malicious guest can trigger the use-after-free error and execute arbitrary code on the host system with QEMU privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Off-by-one

EUVDB-ID: #VU58812

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3930

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error in the SCSI device emulation in QEMU. A remote user on the guest OS can can trigger an off-by-one error while processing MODE SELECT commands in mode_sense_page() if the 'page' argument is set to MODE_PAGE_ALLS (0x3f). Successful exploitation of the vulnerability may result in QEMU crash.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) NULL pointer dereference

EUVDB-ID: #VU63781

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4158

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the ACPI code of QEMU when handling certain values. A privileged user can crash the QEMU process on the host, resulting in a denial of service condition.

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Incorrect default permissions

EUVDB-ID: #VU61492

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0358

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect QEMU virtio-fs shared file system daemon (virtiofsd) implementation. An attacker on the guest OS can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This can lead to privilege escalation within the guest OS.

The vulnerability exists due to incomplete fox for #VU13631 (CVE-2018-13405).

Mitigation

Update the affected package qemu to the latest version.

Vulnerable software versions

Ubuntu: 18.04 - 21.10

qemu-system-x86-xen (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-mips (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-ppc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-arm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-sparc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86 (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-s390x (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-misc (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

qemu-system-x86-microvm (Ubuntu package): before 1:6.0+dfsg-2expubuntu1.2

External links

http://ubuntu.com/security/notices/USN-5307-1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.