Lucene search

K
debianDebianDEBIAN:DLA-842-1:6B5AC
HistoryFeb 28, 2017 - 10:09 p.m.

[SECURITY] [DLA 842-1] qemu-kvm security update

2017-02-2822:09:32
lists.debian.org
39

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

51.0%

Package : qemu-kvm
Version : 1.1.2+dfsg-6+deb7u20
CVE ID : CVE-2017-2615 CVE-2017-2620 CVE-2017-5898 CVE-2017-5973

Several vulnerabilities were discovered in qemu-kvm, a full
virtualization solution for Linux hosts on x86 hardware with x86 guests.

CVE-2017-2615

The Cirrus CLGD 54xx VGA Emulator in qemu-kvm is vulnerable to an
out-of-bounds access issue. It could occur while copying VGA data
via bitblt copy in backward mode.

A privileged user inside guest could use this flaw to crash the
Qemu process resulting in DoS OR potentially execute arbitrary
code on the host with privileges of qemu-kvm process on the host.

CVE-2017-2620

The Cirrus CLGD 54xx VGA Emulator in qemu-kvm is vulnerable to an
out-of-bounds access issue. It could occur while copying VGA data
in cirrus_bitblt_cputovideo.

A privileged user inside guest could use this flaw to crash the
Qemu process resulting in DoS OR potentially execute arbitrary
code on the host with privileges of qemu-kvm process on the host.

CVE-2017-5898

The CCID Card device emulator support is vulnerable to an integer
overflow flaw. It could occur while passing message via
command/responses packets to and from the host.

A privileged user inside guest could use this flaw to crash the
qemu-kvm process on the host resulting in a DoS.

This issue does not affect the qemu-kvm binaries in Debian but we
apply the patch to the sources to stay in sync with the qemu
package.

CVE-2017-5973

The USB xHCI controller emulator support in qemu-kvm is vulnerable
to an infinite loop issue. It could occur while processing control
transfer descriptors' sequence in xhci_kick_epctx.

A privileged user inside guest could use this flaw to crash the
qemu-kvm process resulting in a DoS.

This update also updates the fix CVE-2016-9921 since it was too strict
and broke certain guests.

For Debian 7 "Wheezy", these problems have been fixed in version
1.1.2+dfsg-6+deb7u20.

We recommend that you upgrade your qemu-kvm packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

CVSS2

9

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

51.0%