Package        : qemu
Version        : 1:2.1+dfsg-12+deb8u8
CVE ID         : CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841
                 CVE-2016-2857 CVE-2016-2858 CVE-2016-4001 CVE-2016-4002
                 CVE-2016-4020 CVE-2016-4037 CVE-2016-4439 CVE-2016-4441
                 CVE-2016-4453 CVE-2016-4454 CVE-2016-4952 CVE-2016-5105
                 CVE-2016-5106 CVE-2016-5107 CVE-2016-5238 CVE-2016-5337
                 CVE-2016-5338 CVE-2016-6351 CVE-2016-6834 CVE-2016-6836
                 CVE-2016-6888 CVE-2016-7116 CVE-2016-7155 CVE-2016-7156
                 CVE-2016-7161 CVE-2016-7170 CVE-2016-7421 CVE-2016-7908
                 CVE-2016-7909 CVE-2016-8577 CVE-2016-8578 CVE-2016-8909
                 CVE-2016-8910 CVE-2016-9101 CVE-2016-9102 CVE-2016-9103
                 CVE-2016-9104 CVE-2016-9105 CVE-2016-9106 CVE-2017-10664
                 CVE-2018-10839 CVE-2018-17962 CVE-2018-17963
Debian Bug     : 815008 815009 815680 817181 817182 817183 821038 821061
                 821062 822344 824856 825210 825614 825615 825616 826152
                 827024 827026 832621 834902 834905 834944 836502 837174
                 837316 837339 838147 838850 839834 839835 840340 840341
                 841950 841955 842455 866674 910431 911468 911469


Several vulnerabilities were found in QEMU, a fast processor emulator:

CVE-2016-2391

    Zuozhi Fzz discovered that eof_times in USB OHCI emulation support
    could be used to cause a denial of service, via a null pointer
    dereference.

CVE-2016-2392 / CVE-2016-2538

    Qinghao Tang found a NULL pointer dereference and multiple integer
    overflows in the USB Net device support that could allow local guest
    OS administrators to cause a denial of service. These issues related
    to remote NDIS control message handling.

CVE-2016-2841

    Yang Hongke reported an infinite loop vulnerability in the NE2000 NIC
    emulation support.

CVE-2016-2857

    Liu Ling found a flaw in QEMU IP checksum routines. Attackers could
    take advantage of this issue to cause QEMU to crash.

CVE-2016-2858

    Arbitrary stack based allocation in the Pseudo Random Number Generator
    (PRNG) back-end support.

CVE-2016-4001 / CVE-2016-4002

    Oleksandr Bazhaniuk reported buffer overflows in the Stellaris and the
    MIPSnet ethernet controllers emulation. Remote malicious users could
    use these issues to cause QEMU to crash.

CVE-2016-4020

    Donghai Zdh reported that QEMU incorrectly handled the access to the
    Task Priority Register (TPR), allowing local guest OS administrators    to obtain sensitive information from host stack memory.

CVE-2016-4037

    Du Shaobo found an infinite loop vulnerability in the USB EHCI
    emulation support.

CVE-2016-4439 / CVE-2016-4441 / CVE-2016-5238 / CVE-2016-5338 / CVE-2016-6351

    Li Qiang found different issues in the QEMU 53C9X Fast SCSI Controller
    (FSC) emulation support, that made it possible for local guest OS
    privileged users to cause denials of service or potentially execute
    arbitrary code.

CVE-2016-4453 / CVE-2016-4454

    Li Qiang reported issues in the QEMU VMWare VGA module handling, that
    may be used to cause QEMU to crash, or to obtain host sensitive
    information.

CVE-2016-4952 / CVE-2016-7421 / CVE-2016-7156

    Li Qiang reported flaws in the VMware paravirtual SCSI bus emulation
    support. These issues concern an out-of-bounds access and infinite
    loops, that allowed local guest OS privileged users to cause a denial
    of service.

CVE-2016-5105 / CVE-2016-5106 / CVE-2016-5107 / CVE-2016-5337

    Li Qiang discovered several issues in the MegaRAID SAS 8708EM2 Host
    Bus Adapter emulation support. These issues include stack information
    leakage while reading configuration and out-of-bounds write and read.

CVE-2016-6834

    Li Qiang reported an infinite loop vulnerability during packet
    fragmentation in the network transport abstraction layer support.
    Local guest OS privileged users could made use of this flaw to cause a
    denial of service.

CVE-2016-6836 / CVE-2016-6888

    Li Qiang found issues in the VMWare VMXNET3 network card emulation
    support, relating to information leak and integer overflow in packet
    initialisation.

CVE-2016-7116

    Felix Wilhel discovered a directory traversal flaw in the Plan 9 File
    System (9pfs), exploitable by local guest OS privileged users.

CVE-2016-7155

    Tom Victor and Li Qiang reported an out-of-bounds read and an infinite
    loop in the VMware paravirtual SCSI bus emulation support.

CVE-2016-7161

    Hu Chaojian reported a heap overflow in the xlnx.xps-ethernetlite
    emulation support. Privileged users in local guest OS could made use
    of this to cause QEMU to crash.

CVE-2016-7170

    Qinghao Tang and Li Qiang reported a flaw in the QEMU VMWare VGA
    module, that could be used by privileged user in local guest OS to
    cause QEMU to crash via an out-of-bounds stack memory access.

CVE-2016-7908 /  CVE-2016-7909

    Li Qiang reported infinite loop vulnerabilities in the ColdFire Fast
    Ethernet Controller and the AMD PC-Net II (Am79C970A) emulations.
    These flaws allowed local guest OS administrators to cause a denial of
    service.

CVE-2016-8909

    Huawei PSIRT found an infinite loop vulnerability in the Intel HDA
    emulation support, relating to DMA buffer stream processing.
    Privileged users in local guest OS could made use of this to cause a
    denial of service.

CVE-2016-8910

    Andrew Henderson reported an infinite loop in the RTL8139 ethernet
    controller emulation support. Privileged users inside a local guest OS
    could made use of this to cause a denial of service.

CVE-2016-9101

    Li Qiang reported a memory leakage in the i8255x (PRO100) ethernet
    controller emulation support.

CVE-2016-9102 / CVE-2016-9103 / CVE-2016-9104 / CVE-2016-9105 /
CVE-2016-9106 / CVE-2016-8577 / CVE-2016-8578

    Li Qiang reported various Plan 9 File System (9pfs) security issues,
    including host memory leakage and denial of service.

CVE-2017-10664

    Denial of service in the qemu-nbd (QEMU Disk Network Block Device)
    Server.

CVE-2018-10839 / CVE-2018-17962 / CVE-2018-17963

    Daniel Shapira reported several integer overflows in the packet
    handling in ethernet controllers emulated by QEMU. These issues could
    lead to denial of service.

For Debian 8 "Jessie", these problems have been fixed in version
1:2.1+dfsg-12+deb8u8.

We recommend that you upgrade your qemu packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Debian LTS: DLA-1599-1: qemu security update

November 30, 2018
Several vulnerabilities were found in QEMU, a fast processor emulator: CVE-2016-2391

Summary

CVE-2016-2391

Zuozhi Fzz discovered that eof_times in USB OHCI emulation support
could be used to cause a denial of service, via a null pointer
dereference.

CVE-2016-2392 / CVE-2016-2538

Qinghao Tang found a NULL pointer dereference and multiple integer
overflows in the USB Net device support that could allow local guest
OS administrators to cause a denial of service. These issues related
to remote NDIS control message handling.

CVE-2016-2841

Yang Hongke reported an infinite loop vulnerability in the NE2000 NIC
emulation support.

CVE-2016-2857

Liu Ling found a flaw in QEMU IP checksum routines. Attackers could
take advantage of this issue to cause QEMU to crash.

CVE-2016-2858

Arbitrary stack based allocation in the Pseudo Random Number Generator
(PRNG) back-end support.

CVE-2016-4001 / CVE-2016-4002

Oleksandr Bazhaniuk reported buffer overflows in the Stellaris and the
MIPSnet ethernet controllers emulation. Remote malicious users could
use...

Read the Full Advisory


Severity 
Package        : qemu
Version : 1:2.1+dfsg-12+deb8u8
CVE ID : CVE-2016-2391 CVE-2016-2392 CVE-2016-2538 CVE-2016-2841
Debian Bug : 815008 815009 815680 817181 817182 817183 821038 821061

Related News

The End of the Road for Linux 6.11: A Call to Upgrade to Kernel 6.12
3 - 5 min read
The Linux kernel community recently issued an EOL announcement regarding the 6.11 kernel series, urging sysadmins to upgrade quickly to 6.12 . This
A Linux Admin
3 - 6 min read
As 2025 approaches, we Linux admins are facing new and often unseen cloud-native security obstacles. While skilled at mitigating known risks,
Leveraging Insights from the Linux Foundation
3 - 5 min read
The Linux Foundation's recent Census III report provides critical insights for Linux administrators, information security professionals, and anyone
Chrome 131 Released: Emergency Security Update Fixes Over a Dozen Significant Vulns
3 - 6 min read
Google recently unveiled a critical security update to their popular web browser, Google Chrome, addressing over a dozen significant security
From Wayland Fixes to Security Boosts: Examining Qt 6.8.1
3 - 6 min read
The recent Qt 6.8.1 release brings significant updates and improvements, strengthening its reputation as a secure and reliable application
Exploring Arch Linux 2024.12.01: Security Implications & Notable Enhancements for Linux Admins
3 - 6 min read
The Arch Linux 2024.12.01 ISO release marks an impressive milestone, offering cutting-edge updates that enhance functionality, streamline
Deck the Halls with Enhanced Security: Linux Kernel 6.13
3 - 5 min read
As Linux admins and infosec professionals prepare for the holiday season, there's much cause for celebration this year! Linus Torvalds recently made
Lessons from Bootkitty: Securing Linux Systems Against UEFI Intrusions
3 - 5 min read
New Linux security threats mark critical junctures that challenge existing policies and test security protocols to their limit. One such milestone

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved