Arch Linux Security Advisory ASA-201606-8 ========================================= Severity: Critical Date : 2016-06-08 CVE-ID : CVE-2015-8558 CVE-2016-3710 CVE-2016-3712 CVE-2016-5105 CVE-2016-5106 CVE-2016-5107 Package : qemu Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.6.0-1 is vulnerable to multiple issues including denial of service and arbitrary code execution. Resolution ========== Upgrade to 2.6.0-1. # pacman -Syu "qemu>=2.6.0-1" The problems have been fixed upstream in version 2.6.0. Workaround ========== None. Description =========== - CVE-2015-8558 (denial of service) An infinite-loop issue was found in the QEMU emulator built with USB EHCI emulation support. The flaw occurred during communication between the host controller interface(EHCI) and a respective device driver. These two communicate using an isochronous transfer descriptor list(iTD); an infinite loop unfolded if there was a closed loop in the list. A privileged user inside a guest could use this flaw to consume excessive resources and cause denial of service. - CVE-2016-3710 (arbitrary code execution) An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process. - CVE-2016-3712 (denial of service) Qemu emulator built with the VGA Emulator support is vulnerable to an integer overflow and OOB read access issues. This occurs because Qemu allows certain VGA registers to be set while in VBE mode. A privileged guest user could use this flaw to crash the Qemu process instance resulting in DoS. - CVE-2016-5105 (information leakage) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an information leakage issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to read device configuration in 'megasas_dcmd_cfg_read'. A privileged user inside guest could use this flaw to leak host memory bytes. - CVE-2016-5106 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds write access issue. It could occur while processing MegaRAID Firmware Interface(MFI) command to set controller properties in 'megasas_dcmd_set_properties'. A privileged user inside guest could use this flaw to crash the Qemu process on the host resulting in DoS. - CVE-2016-5107 (denial of service) Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support is vulnerable to an out-of-bounds read access issue. It could occur while looking up MegaRAID Firmware Interface(MFI) command frames in 'megasas_lookup_frame' routine. A privileged user inside guest could use this flaw to read invalid memory leading to crash the Qemu process on the host. Impact ====== An attacker inside of the guest system is able to cause excessive resource consumption, crash the qemu process, execute arbitrary code on the host system and leak information from the host system. References ========== https://access.redhat.com/security/cve/CVE-2015-8558 https://access.redhat.com/security/cve/CVE-2016-3710 https://access.redhat.com/security/cve/CVE-2016-3712 https://access.redhat.com/security/cve/CVE-2016-5105 https://access.redhat.com/security/cve/CVE-2016-5106 https://access.redhat.com/security/cve/CVE-2016-5107