Ubuntu update for qemu
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2020-13253 CVE-2020-13361 CVE-2020-13362 CVE-2020-13659 CVE-2020-13754 CVE-2020-14364 |
| CWE-ID | CWE-125 CWE-787 CWE-476 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #6 is available. |
| Vulnerable software |
Ubuntu Operating systems & Components / Operating system qemu-system-mips (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-ppc (Ubuntu package) Operating systems & Components / Operating system package or component qemu (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-x86 (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-aarch64 (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-arm (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-misc (Ubuntu package) Operating systems & Components / Operating system package or component qemu-system-sparc (Ubuntu package) Operating systems & Components / Operating system package or component |
| Vendor | Canonical Ltd. |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Out-of-bounds read
EUVDB-ID: #VU28283
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-13253
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the SD Memory Card emulator while performing block write commands via sdhci_write() in QEMU. A remote user of guest operating system can trigger out-of-bounds read error and crash the QEMU process.
Update the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Out-of-bounds write
EUVDB-ID: #VU31801
Risk: Medium
CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-13361
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing frame count in es1370_transfer_audio in hw/audio/es1370.c. A local user on the guest operating system can send a specially crafted request and execute arbitrary code on the host operating system.
Update the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Out-of-bounds read
EUVDB-ID: #VU31802
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-13362
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in megasas_lookup_frame in hw/scsi/megasas.c. A local user on the guest operating system can pass specially crafted message with reply_queue_head field, trigger out-of-bounds read error and read contents of memory on the system.
MitigationUpdate the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) NULL pointer dereference
EUVDB-ID: #VU31804
Risk: Medium
CVSSv4.0: 4.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-13659
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in exec.c, related to BounceBuffer. A local user on the guest operating system can perform a denial of service (DoS) attack against the host system.
MitigationUpdate the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Out-of-bounds write
EUVDB-ID: #VU31803
Risk: Medium
CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2020-13754
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in hw/pci/msix.c. A local user on the guest operating system can send specially crafted address in an msi-x mmio operation, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code.
MitigationUpdate the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Out-of-bounds write
EUVDB-ID: #VU45985
Risk: Medium
CVSSv4.0: 7.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2020-14364
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: Yes
DescriptionThe vulnerability allows a remote user to compromise vulnerable system.
The vulnerability exists due to a boundary error within the USB emulator in QEMU. A remote user with access to guest operating system on the guest operating system can send specially crafted USB packets, trigger out-of-bounds write and execute arbitrary code on the host system.
MitigationUpdate the affected package qemu to the latest version.
Vulnerable software versionsUbuntu: 14.04
qemu-system-mips (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-ppc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-x86 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-aarch64 (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-arm (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-misc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
qemu-system-sparc (Ubuntu package): before 2.0.0+dfsg-2ubuntu1.47+esm1
CPE2.3- cpe:2.3:o:canonical:ubuntu:14.04:*:*:*:*:*:*:*
- cpe:2.3:a:canonical:qemu-system-mips_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-ppc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-x86_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-aarch64_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-arm_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-misc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
- cpe:2.3:a:canonical:qemu-system-sparc_ubuntu_package:*:*:*:*:*:ubuntu:*:*
https://ubuntu.com/security/notices/USN-4467-2
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
