Detections
Analytics

Ubuntu 14.04 LTS / 16.04 LTS : QEMU regression (USN-3414-2)

high Nessus Plugin ID 103372

Language:

Synopsis

The remote Ubuntu host is missing a security update.

Description

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3414-2 advisory.

 USN-3414-1 fixed vulnerabilities in QEMU. The patch backport for CVE-2017-9375 was incomplete and caused a regression in the USB xHCI controller emulation support. This update fixes the problem.

 We apologize for the inconvenience.

 Original advisory details:

 Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control.

 A guest attacker could use this issue to elevate privileges inside the

 guest. (CVE-2017-7493)

 Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation.

 A privileged attacker inside the guest could use this issue to cause QEMU

 to consume resources or crash, resulting in a denial of service.

 (CVE-2017-8112)

 It was discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host

 Bus Adapter emulation support. A privileged attacker inside the guest could

 use this issue to cause QEMU to crash, resulting in a denial of service, or

 possibly to obtain sensitive host memory. This issue only affected Ubuntu

 16.04 LTS and Ubuntu 17.04. (CVE-2017-8380)

 Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An

 attacker inside the guest could use this issue to cause QEMU to consume

 resources and crash, resulting in a denial of service. This issue only

 affected Ubuntu 17.04. (CVE-2017-9060)

 Li Qiang discovered that QEMU incorrectly handled the e1000e device. A

 privileged attacker inside the guest could use this issue to cause QEMU to

 hang, resulting in a denial of service. This issue only affected Ubuntu

 17.04. (CVE-2017-9310)

 Li Qiang discovered that QEMU incorrectly handled USB OHCI emulation

 support. An attacker inside the guest could use this issue to cause QEMU to

 crash, resulting in a denial of service. (CVE-2017-9330)

 Li Qiang discovered that QEMU incorrectly handled IDE AHCI emulation

 support. A privileged attacker inside the guest could use this issue to

 cause QEMU to consume resources and crash, resulting in a denial of

 service. (CVE-2017-9373)

 Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation

 support. A privileged attacker inside the guest could use this issue to

 cause QEMU to consume resources and crash, resulting in a denial of

 service. (CVE-2017-9374)

 Li Qiang discovered that QEMU incorrectly handled USB xHCI emulation

 support. A privileged attacker inside the guest could use this issue to

 cause QEMU to hang, resulting in a denial of service. (CVE-2017-9375)

 Zhangyanyu discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2

 Host Bus Adapter emulation support. A privileged attacker inside the guest

 could use this issue to cause QEMU to crash, resulting in a denial of

 service. (CVE-2017-9503)

 It was discovered that the QEMU qemu-nbd server incorrectly handled

 initialization. A remote attacker could use this issue to cause the server

 to crash, resulting in a denial of service. (CVE-2017-9524)

 It was discovered that the QEMU qemu-nbd server incorrectly handled

 signals. A remote attacker could use this issue to cause the server to

 crash, resulting in a denial of service. (CVE-2017-10664)

 Li Qiang discovered that the QEMU USB redirector incorrectly handled

 logging debug messages. An attacker inside the guest could use this issue

 to cause QEMU to crash, resulting in a denial of service. (CVE-2017-10806)

 Anthony Perard discovered that QEMU incorrectly handled Xen block-interface

 responses. An attacker inside the guest could use this issue to cause QEMU

 to leak contents of host memory. (CVE-2017-10911)

 Reno Robert discovered that QEMU incorrectly handled certain DHCP options

 strings. An attacker inside the guest could use this issue to cause QEMU

 to crash, resulting in a denial of service. (CVE-2017-11434)

 Ryan Salsamendi discovered that QEMU incorrectly handled empty CDROM device

 drives. A privileged attacker inside the guest could use this issue to

 cause QEMU to crash, resulting in a denial of service. This issue only

 affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-12809)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://ubuntu.com/security/notices/USN-3414-2

Plugin Details

Severity: High

ID: 103372

File Name: ubuntu_USN-3414-2.nasl

Version: 3.9

Type: local

Agent: unix

Published: 9/21/2017

Updated: 8/27/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:qemu-system-common, p-cpe:/a:canonical:ubuntu_linux:qemu-keymaps, p-cpe:/a:canonical:ubuntu_linux:qemu-user, p-cpe:/a:canonical:ubuntu_linux:qemu-guest-agent, p-cpe:/a:canonical:ubuntu_linux:qemu-system, p-cpe:/a:canonical:ubuntu_linux:qemu-system-aarch64, p-cpe:/a:canonical:ubuntu_linux:qemu-user-static, p-cpe:/a:canonical:ubuntu_linux:qemu-kvm, p-cpe:/a:canonical:ubuntu_linux:qemu-system-mips, p-cpe:/a:canonical:ubuntu_linux:qemu, p-cpe:/a:canonical:ubuntu_linux:qemu-system-s390x, cpe:/o:canonical:ubuntu_linux:14.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:qemu-system-x86, p-cpe:/a:canonical:ubuntu_linux:qemu-common, p-cpe:/a:canonical:ubuntu_linux:qemu-system-misc, p-cpe:/a:canonical:ubuntu_linux:qemu-system-arm, p-cpe:/a:canonical:ubuntu_linux:qemu-utils, cpe:/o:canonical:ubuntu_linux:16.04:-:lts, p-cpe:/a:canonical:ubuntu_linux:qemu-system-ppc, p-cpe:/a:canonical:ubuntu_linux:qemu-user-binfmt, p-cpe:/a:canonical:ubuntu_linux:qemu-block-extra, p-cpe:/a:canonical:ubuntu_linux:qemu-system-sparc

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 9/20/2017

Vulnerability Publication Date: 5/2/2017

Reference Information

USN: 3414-2