ESB-2018.3670 - [Ubuntu] qemu: Multiple vulnerabilities 2018-11-27

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.3670
                     [USN-3826-1] QEMU vulnerabilities
                             27 November 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           qemu
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account
                   Denial of Service               -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-19364 CVE-2018-18954 CVE-2018-18849
                   CVE-2018-17963 CVE-2018-17962 CVE-2018-17958
                   CVE-2018-16847 CVE-2018-12617 CVE-2018-11806
                   CVE-2018-10839  

Reference:         ESB-2018.3660
                   ESB-2018.3533
                   ESB-2018.2969
                   ESB-2018.2402

Original Bulletin: 
   http://www.ubuntu.com/usn/usn-3826-1

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-3826-1: QEMU vulnerabilities

26 November 2018

qemu vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  o Ubuntu 18.10
  o Ubuntu 18.04 LTS
  o Ubuntu 16.04 LTS
  o Ubuntu 14.04 LTS

Summary

Several security issues were fixed in QEMU.

Software Description

  o qemu - Machine emulator and virtualizer

Details

Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled NE2000
device emulation. An attacker inside the guest could use this issue to cause
QEMU to crash, resulting in a denial of service. (CVE-2018-10839)

It was discovered that QEMU incorrectly handled the Slirp networking back-end.
A privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service, or possibly execute arbitrary code on
the host. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile. This issue only
affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
(CVE-2018-11806)

Fakhri Zulkifli discovered that the QEMU guest agent incorrectly handled
certain QMP commands. An attacker could possibly use this issue to crash the
QEMU guest agent, resulting in a denial of service. (CVE-2018-12617)

Li Qiang discovered that QEMU incorrectly handled NVM Express Controller
emulation. An attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service, or possibly execute arbitrary code on
the host. In the default installation, when QEMU is used with libvirt,
attackers would be isolated by the libvirt AppArmor profile. This issue only
affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16847)

Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled
RTL8139 device emulation. An attacker inside the guest could use this issue to
cause QEMU to crash, resulting in a denial of service. (CVE-2018-17958)

Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled PCNET
device emulation. An attacker inside the guest could use this issue to cause
QEMU to crash, resulting in a denial of service. (CVE-2018-17962)

Daniel Shapira discovered that QEMU incorrectly handled large packet sizes. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. (CVE-2018-17963)

It was discovered that QEMU incorrectly handled LSI53C895A device emulation. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. (CVE-2018-18849)

Moguofang discovered that QEMU incorrectly handled the IPowerNV LPC controller.
An attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and
Ubuntu 18.10. (CVE-2018-18954)

Zhibin Hu discovered that QEMU incorrectly handled the Plan 9 File System
support. An attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. (CVE-2018-19364)

Update instructions

The problem can be corrected by updating your system to the following package
versions:

Ubuntu 18.10
    qemu-system - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-arm - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-mips - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-misc - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-ppc - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-s390x - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-sparc - 1:2.12+dfsg-3ubuntu8.1
    qemu-system-x86 - 1:2.12+dfsg-3ubuntu8.1
Ubuntu 18.04 LTS
    qemu-system - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-arm - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-mips - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-misc - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-ppc - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-s390x - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-sparc - 1:2.11+dfsg-1ubuntu7.8
    qemu-system-x86 - 1:2.11+dfsg-1ubuntu7.8
Ubuntu 16.04 LTS
    qemu-system - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-aarch64 - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-arm - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-mips - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-misc - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-ppc - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-s390x - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-sparc - 1:2.5+dfsg-5ubuntu10.33
    qemu-system-x86 - 1:2.5+dfsg-5ubuntu10.33
Ubuntu 14.04 LTS
    qemu-system - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-aarch64 - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-arm - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-mips - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-misc - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-ppc - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-sparc - 2.0.0+dfsg-2ubuntu1.44
    qemu-system-x86 - 2.0.0+dfsg-2ubuntu1.44

To update your system, please follow these instructions: https://
wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual machines to
make all the necessary changes.

References

  o CVE-2018-10839
  o CVE-2018-11806
  o CVE-2018-12617
  o CVE-2018-16847
  o CVE-2018-17958
  o CVE-2018-17962
  o CVE-2018-17963
  o CVE-2018-18849
  o CVE-2018-18954
  o CVE-2018-19364

(C) 2017 Canonical Ltd. Ubuntu and Canonical are registered trademarks of
Canonical Ltd.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW/yWGWaOgq3Tt24GAQgHwRAAgE++HQAQBkO+U7bgmQac75/qhq2jvwB2
EIz7GO/tvqAiajaRHj6QcoNAkWAduLbc3SJtHRjZPPdJNgmlnOWiMQo4jipCUDOW
HtvJjTpVh127K9XvgWcfuGpBKaLUkI8+h9DH6/HzdTLjfgY3zhzIHKKRSwnFWIxx
N913xRBeLEdnOZ9W0oAnDnmQ6vcoO8Gxc8+B9ujmZ9KGnWki+2LjXt9q2vkAZYqQ
kTYsCD+ZjMhN1kjy0bAeE9mgxsKYGK+1KgmGnobXaEgBst1Aeyqtk9+UBBW4QM5D
Zsdyd41wO2y9X9/z1buKwvdqlyrdePUkmkPhX6d1zhBIMU1/kBANEZr20uXOp0bp
2WopimeOp5u3/iOFjIZ4h261lWadoNNVNHWkTQS4/gK2zc8qxtH2Rub/ywHz8S6H
mVYqQnwljXNZMvWDvESubrr9k2qh0aEU8/jYFCcIjviz+fDI8xh1QvlT26aCiddQ
kRd/N0JwwXrHRWYsJJdnTNuajfhGnWoCHsfa3ZMv8S1bkplMf04INu+hnk2s/4CR
CJ1zPjWV/V3uXO3FJTvbLq9vXBDBjnMgjMrGx7cFHc/ZlFX69mvzF5sxMPYf+CQI
2Ri9jHxR3V5oyFd99gL2Y3ezF84LTlnB/cYtSdMx3FNTgJV7Kd7pSiIMVcSMP1Dv
trA28gyEnRE=
=givZ
-----END PGP SIGNATURE-----

« Back to bulletins