=========================================================================Ubuntu Security Notice USN-6167-1
June 19, 2023

qemu vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in QEMU.

Software Description:
- qemu: Machine emulator and virtualizer

Details:

It was discovered that QEMU did not properly manage the guest drivers when
shared buffers are not allocated. A malicious guest driver could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 22.10. (CVE-2022-1050)

It was discovered that QEMU did not properly check the size of the
structure pointed to by the guest physical address pqxl. A malicious guest
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10.
(CVE-2022-4144)

It was discovered that QEMU did not properly manage memory in the ACPI
Error Record Serialization Table (ERST) device. A malicious guest attacker
could use this issue to cause QEMU to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.10. (CVE-2022-4172)

It was discovered that QEMU did not properly manage memory when DMA memory
writes happen repeatedly in the lsi53c895a device. A malicious guest
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service. (CVE-2023-0330)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
  qemu-guest-agent                1:7.2+dfsg-5ubuntu2.2
  qemu-system                     1:7.2+dfsg-5ubuntu2.2
  qemu-system-arm                 1:7.2+dfsg-5ubuntu2.2
  qemu-system-common              1:7.2+dfsg-5ubuntu2.2
  qemu-system-data                1:7.2+dfsg-5ubuntu2.2
  qemu-system-gui                 1:7.2+dfsg-5ubuntu2.2
  qemu-system-mips                1:7.2+dfsg-5ubuntu2.2
  qemu-system-misc                1:7.2+dfsg-5ubuntu2.2
  qemu-system-ppc                 1:7.2+dfsg-5ubuntu2.2
  qemu-system-s390x               1:7.2+dfsg-5ubuntu2.2
  qemu-system-sparc               1:7.2+dfsg-5ubuntu2.2
  qemu-system-x86                 1:7.2+dfsg-5ubuntu2.2
  qemu-system-x86-xen             1:7.2+dfsg-5ubuntu2.2
  qemu-system-xen                 1:7.2+dfsg-5ubuntu2.2

Ubuntu 22.10:
  qemu-guest-agent                1:7.0+dfsg-7ubuntu2.6
  qemu-system                     1:7.0+dfsg-7ubuntu2.6
  qemu-system-arm                 1:7.0+dfsg-7ubuntu2.6
  qemu-system-common              1:7.0+dfsg-7ubuntu2.6
  qemu-system-data                1:7.0+dfsg-7ubuntu2.6
  qemu-system-gui                 1:7.0+dfsg-7ubuntu2.6
  qemu-system-mips                1:7.0+dfsg-7ubuntu2.6
  qemu-system-misc                1:7.0+dfsg-7ubuntu2.6
  qemu-system-ppc                 1:7.0+dfsg-7ubuntu2.6
  qemu-system-s390x               1:7.0+dfsg-7ubuntu2.6
  qemu-system-sparc               1:7.0+dfsg-7ubuntu2.6
  qemu-system-x86                 1:7.0+dfsg-7ubuntu2.6
  qemu-system-x86-xen             1:7.0+dfsg-7ubuntu2.6
  qemu-system-xen                 1:7.0+dfsg-7ubuntu2.6

Ubuntu 22.04 LTS:
  qemu                            1:6.2+dfsg-2ubuntu6.11
  qemu-guest-agent                1:6.2+dfsg-2ubuntu6.11
  qemu-system                     1:6.2+dfsg-2ubuntu6.11
  qemu-system-arm                 1:6.2+dfsg-2ubuntu6.11
  qemu-system-common              1:6.2+dfsg-2ubuntu6.11
  qemu-system-data                1:6.2+dfsg-2ubuntu6.11
  qemu-system-gui                 1:6.2+dfsg-2ubuntu6.11
  qemu-system-mips                1:6.2+dfsg-2ubuntu6.11
  qemu-system-misc                1:6.2+dfsg-2ubuntu6.11
  qemu-system-ppc                 1:6.2+dfsg-2ubuntu6.11
  qemu-system-s390x               1:6.2+dfsg-2ubuntu6.11
  qemu-system-sparc               1:6.2+dfsg-2ubuntu6.11
  qemu-system-x86                 1:6.2+dfsg-2ubuntu6.11
  qemu-system-x86-microvm         1:6.2+dfsg-2ubuntu6.11
  qemu-system-x86-xen             1:6.2+dfsg-2ubuntu6.11

Ubuntu 20.04 LTS:
  qemu                            1:4.2-3ubuntu6.27
  qemu-guest-agent                1:4.2-3ubuntu6.27
  qemu-kvm                        1:4.2-3ubuntu6.27
  qemu-system                     1:4.2-3ubuntu6.27
  qemu-system-arm                 1:4.2-3ubuntu6.27
  qemu-system-common              1:4.2-3ubuntu6.27
  qemu-system-data                1:4.2-3ubuntu6.27
  qemu-system-gui                 1:4.2-3ubuntu6.27
  qemu-system-mips                1:4.2-3ubuntu6.27
  qemu-system-misc                1:4.2-3ubuntu6.27
  qemu-system-ppc                 1:4.2-3ubuntu6.27
  qemu-system-s390x               1:4.2-3ubuntu6.27
  qemu-system-sparc               1:4.2-3ubuntu6.27
  qemu-system-x86                 1:4.2-3ubuntu6.27
  qemu-system-x86-microvm         1:4.2-3ubuntu6.27
  qemu-system-x86-xen             1:4.2-3ubuntu6.27

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  qemu                            1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-guest-agent                1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-kvm                        1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system                     1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-arm                 1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-common              1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-mips                1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-misc                1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-ppc                 1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-s390x               1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-sparc               1:2.11+dfsg-1ubuntu7.42+esm1
  qemu-system-x86                 1:2.11+dfsg-1ubuntu7.42+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  qemu                            1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-guest-agent                1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-kvm                        1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system                     1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-aarch64             1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-arm                 1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-common              1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-mips                1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-misc                1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-ppc                 1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-s390x               1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-sparc               1:2.5+dfsg-5ubuntu10.51+esm2
  qemu-system-x86                 1:2.5+dfsg-5ubuntu10.51+esm2

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  qemu                            2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-common                     2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-guest-agent                2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-kvm                        2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system                     2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-aarch64             2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-arm                 2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-common              2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-mips                2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-misc                2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-ppc                 2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-sparc               2.0.0+dfsg-2ubuntu1.47+esm3
  qemu-system-x86                 2.0.0+dfsg-2ubuntu1.47+esm3

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6167-1
  CVE-2022-1050, CVE-2022-4144, CVE-2022-4172, CVE-2023-0330

Package Information:
  https://launchpad.net/ubuntu/+source/qemu/1:7.2+dfsg-5ubuntu2.2
  https://launchpad.net/ubuntu/+source/qemu/1:7.0+dfsg-7ubuntu2.6
  https://launchpad.net/ubuntu/+source/qemu/1:6.2+dfsg-2ubuntu6.11
  https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.27

Ubuntu 6167-1: QEMU vulnerabilities

June 19, 2023
Several security issues were fixed in QEMU.

Summary

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: qemu-guest-agent 1:7.2+dfsg-5ubuntu2.2 qemu-system 1:7.2+dfsg-5ubuntu2.2 qemu-system-arm 1:7.2+dfsg-5ubuntu2.2 qemu-system-common 1:7.2+dfsg-5ubuntu2.2 qemu-system-data 1:7.2+dfsg-5ubuntu2.2 qemu-system-gui 1:7.2+dfsg-5ubuntu2.2 qemu-system-mips 1:7.2+dfsg-5ubuntu2.2 qemu-system-misc 1:7.2+dfsg-5ubuntu2.2 qemu-system-ppc 1:7.2+dfsg-5ubuntu2.2 qemu-system-s390x 1:7.2+dfsg-5ubuntu2.2 qemu-system-sparc 1:7.2+dfsg-5ubuntu2.2 qemu-system-x86 1:7.2+dfsg-5ubuntu2.2 qemu-system-x86-xen 1:7.2+dfsg-5ubuntu2.2 qemu-system-xen 1:7.2+dfsg-5ubuntu2.2 Ubuntu 22.10: qemu-guest-agent 1:7.0+dfsg-7ubuntu2.6 qemu-system 1:7.0+dfsg-7ubuntu2.6 qemu-system-arm 1:7.0+dfsg-7ubuntu2.6 qemu-system-common 1:7.0+dfsg-7ubuntu2.6 qemu-system-data 1:7.0+dfsg-7ubuntu2.6 qemu-system-gui 1:7.0+dfsg-7ubuntu2.6 qemu-system-mips 1:7.0+dfsg-7ubuntu2.6 qemu-system-misc 1:7.0+dfsg-7ubuntu2.6 qemu-system-ppc 1:7.0+dfsg-7ubuntu2.6 qemu-system-s390x 1:7.0+dfsg-7ubuntu2.6 qemu-system-sparc 1:7.0+dfsg-7ubuntu2.6 qemu-system-x86 1:7.0+dfsg-7ubuntu2.6 qemu-system-x86-xen 1:7.0+dfsg-7ubuntu2.6 qemu-system-xen 1:7.0+dfsg-7ubuntu2.6 Ubuntu 22.04 LTS: qemu 1:6.2+dfsg-2ubuntu6.11 qemu-guest-agent 1:6.2+dfsg-2ubuntu6.11 qemu-system 1:6.2+dfsg-2ubuntu6.11 qemu-system-arm 1:6.2+dfsg-2ubuntu6.11 qemu-system-common 1:6.2+dfsg-2ubuntu6.11 qemu-system-data 1:6.2+dfsg-2ubuntu6.11 qemu-system-gui 1:6.2+dfsg-2ubuntu6.11 qemu-system-mips 1:6.2+dfsg-2ubuntu6.11 qemu-system-misc 1:6.2+dfsg-2ubuntu6.11 qemu-system-ppc 1:6.2+dfsg-2ubuntu6.11 qemu-system-s390x 1:6.2+dfsg-2ubuntu6.11 qemu-system-sparc 1:6.2+dfsg-2ubuntu6.11 qemu-system-x86 1:6.2+dfsg-2ubuntu6.11 qemu-system-x86-microvm 1:6.2+dfsg-2ubuntu6.11 qemu-system-x86-xen 1:6.2+dfsg-2ubuntu6.11 Ubuntu 20.04 LTS: qemu 1:4.2-3ubuntu6.27 qemu-guest-agent 1:4.2-3ubuntu6.27 qemu-kvm 1:4.2-3ubuntu6.27 qemu-system 1:4.2-3ubuntu6.27 qemu-system-arm 1:4.2-3ubuntu6.27 qemu-system-common 1:4.2-3ubuntu6.27 qemu-system-data 1:4.2-3ubuntu6.27 qemu-system-gui 1:4.2-3ubuntu6.27 qemu-system-mips 1:4.2-3ubuntu6.27 qemu-system-misc 1:4.2-3ubuntu6.27 qemu-system-ppc 1:4.2-3ubuntu6.27 qemu-system-s390x 1:4.2-3ubuntu6.27 qemu-system-sparc 1:4.2-3ubuntu6.27 qemu-system-x86 1:4.2-3ubuntu6.27 qemu-system-x86-microvm 1:4.2-3ubuntu6.27 qemu-system-x86-xen 1:4.2-3ubuntu6.27 Ubuntu 18.04 LTS (Available with Ubuntu Pro): qemu 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-guest-agent 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-kvm 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-arm 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-common 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-mips 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-misc 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-ppc 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-s390x 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-sparc 1:2.11+dfsg-1ubuntu7.42+esm1 qemu-system-x86 1:2.11+dfsg-1ubuntu7.42+esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): qemu 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-guest-agent 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-kvm 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-aarch64 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-arm 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-common 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-mips 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-misc 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-ppc 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-s390x 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-sparc 1:2.5+dfsg-5ubuntu10.51+esm2 qemu-system-x86 1:2.5+dfsg-5ubuntu10.51+esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro): qemu 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-common 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-guest-agent 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-kvm 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-aarch64 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-arm 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-common 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-mips 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-misc 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-ppc 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-sparc 2.0.0+dfsg-2ubuntu1.47+esm3 qemu-system-x86 2.0.0+dfsg-2ubuntu1.47+esm3 After a standard system update you need to restart all QEMU virtual machines to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6167-1

CVE-2022-1050, CVE-2022-4144, CVE-2022-4172, CVE-2023-0330

Severity
June 19, 2023

Package Information

https://launchpad.net/ubuntu/+source/qemu/1:7.2+dfsg-5ubuntu2.2 https://launchpad.net/ubuntu/+source/qemu/1:7.0+dfsg-7ubuntu2.6 https://launchpad.net/ubuntu/+source/qemu/1:6.2+dfsg-2ubuntu6.11 https://launchpad.net/ubuntu/+source/qemu/1:4.2-3ubuntu6.27

Related News

Google Releases Chrome 130 with Critical Security Fixes for 17 Flaws
3 - 5 min read
Google recently unveiled Chrome 130 , an update that addresses several security vulnerabilities to ensure the web browser's safety and reliability.
U.S. Investigation into China-Backed Telecom Companies Hack: The Role & Risks of Encryption Backdoors
3 - 5 min read
U.S. authorities are on high alert as they investigate an alleged Chinese state-sponsored hack targeting major U.S. telecommunications companies.
FASTCash Linux Malware: A New Cybercrime Menace Targeting Payment Switch Systems
3 - 5 min read
As malware threats evolve to increasingly target Linux systems, admins and organizations must stay up-to-date on the latest Linux malware variants
Optimizing CWPP on Linux Servers: Best Practices and Configurations
3 - 6 min read
Cloud Workload Protection Platforms are now essential for securing virtual environments. These provide a robust security layer vital for addressing
The Infiltration of Supply Chain Attacks in Open-Source Software Management
3 - 6 min read
Open-source projects are renowned for their collaborative nature and widespread adoption, yet more sophisticated supply chain attacks target them
Strengthen Your Linux Software Development Pipeline with Code Security Scanners
3 - 6 min read
Developers recognize the critical nature of protecting software systems as cyberattacks grow more sophisticated, thus necessitating robust security
Everything You Need to Know About Cloud Security Posture Management
3 - 5 min read
Many companies are transitioning from physical servers to cloud operations, but this transformation brings new challenges. Cloud Security Posture
Understanding the Critical Oath-Toolkit Vulnerability and Its Implications for Admins
3 - 5 min read
As Linux security threats advance and evolve, vulnerabilities often surface unexpectedly, exposing systems to potential exploitation. SUSE

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved