[arch-security] [ASA-201606-8] qemu: multiple issues

[Christian Rebischke]

Arch Linux Security Advisory ASA-201606-8
=========================================

Severity: Critical
Date    : 2016-06-08
CVE-ID  : CVE-2015-8558 CVE-2016-3710 CVE-2016-3712 CVE-2016-5105
          CVE-2016-5106 CVE-2016-5107 
Package : qemu
Type    : multiple issues
Remote  : No
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package qemu before version 2.6.0-1 is vulnerable to multiple issues
including denial of service and arbitrary code execution.

Resolution
==========

Upgrade to 2.6.0-1.

# pacman -Syu "qemu>=2.6.0-1"

The problems have been fixed upstream in version 2.6.0.

Workaround
==========

None.

Description
===========

- CVE-2015-8558 (denial of service)

An infinite-loop issue was found in the QEMU emulator built with USB
EHCI emulation support. The flaw occurred during communication between
the host controller interface(EHCI) and a respective device driver.
These two communicate using an isochronous transfer descriptor
list(iTD); an infinite loop unfolded if there was a closed loop in the
list. A privileged user inside a guest could use this flaw to consume
excessive resources and cause denial of service.

- CVE-2016-3710 (arbitrary code execution)

An out-of-bounds read/write access flaw was found in the way QEMU's VGA
emulation with VESA BIOS Extensions (VBE) support performed read/write
operations using I/O port methods. A privileged guest user could use
this flaw to execute arbitrary code on the host with the privileges of
the host's QEMU process.

- CVE-2016-3712 (denial of service)

Qemu emulator built with the VGA Emulator support is vulnerable to an
integer overflow and OOB read access issues. This occurs because Qemu
allows certain VGA registers to be set while in VBE mode. A privileged
guest user could use this flaw to crash the Qemu process instance
resulting in DoS.

- CVE-2016-5105 (information leakage)

Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an information leakage issue.
It could occur while processing MegaRAID Firmware Interface(MFI) command
to read device configuration in 'megasas_dcmd_cfg_read'.  A privileged
user inside guest could use this flaw to leak host memory bytes.

- CVE-2016-5106 (denial of service)

Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an out-of-bounds write access
issue.  It could occur while processing MegaRAID Firmware Interface(MFI)
command to set controller properties in 'megasas_dcmd_set_properties'.
A privileged user inside guest could use this flaw to  crash the Qemu
process on the host resulting in DoS.

- CVE-2016-5107 (denial of service)

Quick Emulator(Qemu) built with the MegaRAID SAS 8708EM2 Host Bus
Adapter emulation support is vulnerable to an out-of-bounds read access
issue. It could occur while looking up MegaRAID Firmware Interface(MFI)
command frames in 'megasas_lookup_frame' routine.  A privileged user
inside guest could use this flaw to read invalid memory leading to crash
the Qemu process on the host.


Impact
======

An attacker inside of the guest system is able to cause excessive
resource consumption, crash the qemu process, execute arbitrary code on
the host system and leak information from the host system.

References
==========

https://access.redhat.com/security/cve/CVE-2015-8558
https://access.redhat.com/security/cve/CVE-2016-3710
https://access.redhat.com/security/cve/CVE-2016-3712
https://access.redhat.com/security/cve/CVE-2016-5105
https://access.redhat.com/security/cve/CVE-2016-5106
https://access.redhat.com/security/cve/CVE-2016-5107
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160608/06f4c7a8/attachment.asc>