UbuntuUpdates.org

Package "qemu"

Name: qemu

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • extra block backend modules for qemu-system and qemu-utils
  • QEMU Full virtualization on x86 hardware
  • QEMU full system emulation binaries (arm)
  • QEMU full system emulation binaries (common files)

Latest version: 1:2.11+dfsg-1ubuntu7.34
Release: bionic (18.04)
Level: updates
Repository: main

Links



Other versions of "qemu" in Bionic

Repository Area Version
base main 1:2.11+dfsg-1ubuntu7
base universe 1:2.11+dfsg-1ubuntu7
security main 1:2.11+dfsg-1ubuntu7.34
security universe 1:2.11+dfsg-1ubuntu7.34
updates universe 1:2.11+dfsg-1ubuntu7.34

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:2.11+dfsg-1ubuntu7.34 2020-11-30 16:06:22 UTC

  qemu (1:2.11+dfsg-1ubuntu7.34) bionic-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in sdhci_sdma_transfer_multi_blocks()
    - debian/patches/CVE-2020-17380.patch: fix DMA Transfer Block Size
      field in hw/sd/sdhci.c.
    - CVE-2020-17380
    - CVE-2020-25085
  * SECURITY UPDATE: use-after-free via unchecked return value
    - debian/patches/CVE-2020-25084.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-xhci.c.
    - CVE-2020-25084
  * SECURITY UPDATE: out-of-bound access issue
    - debian/patches/CVE-2020-25624.patch: check len and frame_number
      variables in hw/usb/hcd-ohci.c.
    - CVE-2020-25624
  * SECURITY UPDATE: infinite loop when a TD list has a loop
    - debian/patches/CVE-2020-25625.patch: check for processed TD before
      retire in hw/usb/hcd-ohci.c.
    - CVE-2020-25625
  * SECURITY UPDATE: assertion failure through usb_packet_unmap()
    - debian/patches/CVE-2020-25723.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-ehci.c.
    - CVE-2020-25723
  * SECURITY UPDATE: assertion failure
    - debian/patches/CVE-2020-27617.patch: remove an assert call in
      eth_get_gso_type in net/eth.c.
    - CVE-2020-27617

 -- Marc Deslauriers <email address hidden> Fri, 20 Nov 2020 08:15:55 -0500

Source diff to previous version
CVE-2020-17380 heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c
CVE-2020-25085 QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZ
CVE-2020-25084 QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
CVE-2020-25624 hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via ...
CVE-2020-25625 hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
CVE-2020-25723 assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
CVE-2020-27617 eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data

Version: 1:2.11+dfsg-1ubuntu7.33 2020-11-05 12:06:19 UTC

  qemu (1:2.11+dfsg-1ubuntu7.33) bionic; urgency=medium

  * d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)

 -- Christian Ehrhardt <email address hidden> Mon, 21 Sep 2020 15:39:32 +0200

Source diff to previous version
1894942 [UBUNTU 20.04] Lost virtio host --\u003e guest notifications cause devices to cease normal operation

Version: 1:2.11+dfsg-1ubuntu7.32 2020-09-17 13:06:23 UTC

  qemu (1:2.11+dfsg-1ubuntu7.32) bionic-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read/write in USB emulator
    - debian/patches/CVE-2020-14364.patch: fix setup_len init in
      hw/usb/core.c.
    - CVE-2020-14364

 -- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:05:38 -0400

Source diff to previous version
CVE-2020-14364 An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa

Version: 1:2.11+dfsg-1ubuntu7.31 2020-08-19 18:06:21 UTC

  qemu (1:2.11+dfsg-1ubuntu7.31) bionic-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read in slirp networking
    - debian/patches/CVE-2020-10756.patch: drop bogus IPv6 messages in
      slirp/src/ip6_input.c.
    - CVE-2020-10756
  * SECURITY UPDATE: out-of-bounds read and write in sm501
    - debian/patches/CVE-2020-12829-pre1.patch: use values from the pitch
      register for 2D operations.
    - debian/patches/CVE-2020-12829-pre2.patch: implement negated
      destination raster operation mode.
    - debian/patches/CVE-2020-12829-pre3.patch: log unimplemented raster
      operation modes.
    - debian/patches/CVE-2020-12829-pre4.patch: fix support for non-zero
      frame buffer start address.
    - debian/patches/CVE-2020-12829-pre5.patch: set updated region dirty
      after 2D operation.
    - debian/patches/CVE-2020-12829-pre6.patch: adjust endianness of pixel
      value in rectangle fill.
    - debian/patches/CVE-2020-12829-pre7.patch: convert printf +
      abort to qemu_log_mask.
    - debian/patches/CVE-2020-12829-pre8.patch: shorten long
      variable names in sm501_2d_operation.
    - debian/patches/CVE-2020-12829-pre9.patch: use BIT(x) macro to
      shorten constant.
    - debian/patches/CVE-2020-12829-pre10.patch: clean up local
      variables in sm501_2d_operation.
    - debian/patches/CVE-2020-12829.patch: replace hand written
      implementation with pixman where possible.
    - debian/patches/CVE-2020-12829-2.patch: optimize small overlapping
      blits.
    - debian/patches/CVE-2020-12829-3.patch: fix bounds checks.
    - debian/patches/CVE-2020-12829-4.patch: drop unneded variable.
    - debian/patches/CVE-2020-12829-5.patch: do not allow guest to set
      invalid format.
    - debian/patches/CVE-2020-12829-6.patch: introduce variable for
      commonly used value for better readability.
    - debian/patches/CVE-2020-12829-7.patch: fix and optimize overlap
      check.
    - CVE-2020-12829
  * SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
    - debian/patches/CVE-2020-13253.patch: do not switch to ReceivingData
      if address is invalid in hw/sd/sd.c.
    - CVE-2020-13253
  * SECURITY UPDATE: out-of-bounds access during es1370_write() operation
    - debian/patches/CVE-2020-13361.patch: check total frame count against
      current frame in hw/audio/es1370.c.
    - CVE-2020-13361
  * SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
    - debian/patches/CVE-2020-13362-1.patch: use unsigned type for
      reply_queue_head and check index in hw/scsi/megasas.c.
    - debian/patches/CVE-2020-13362-2.patch: avoid NULL pointer dereference
      in hw/scsi/megasas.c.
    - debian/patches/CVE-2020-13362-3.patch: use unsigned type for positive
      numeric fields in hw/scsi/megasas.c.
    - CVE-2020-13362
  * SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
    - debian/patches/CVE-2020-13659.patch: set map length to zero when
      returning NULL in exec.c, include/exec/memory.h.
    - CVE-2020-13659
  * SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
    - debian/patches/CVE-2020-13754-1.patch: revert accepting mismatching
      sizes in memory_region_access_valid in memory.c.
    - debian/patches/CVE-2020-13754-2.patch: accept byte and word access to
      core ACPI registers in hw/acpi/core.c.
    - CVE-2020-13754
  * SECURITY UPDATE: invalid memory copy operation via rom_copy
    - debian/patches/CVE-2020-13765.patch: add extra check to
      hw/core/loader.c.
    - CVE-2020-13765
  * SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
    - debian/patches/CVE-2020-15863.patch: check bounds in hw/net/xgmac.c.
    - CVE-2020-15863
  * SECURITY UPDATE: reachable assertion failure
    - debian/patches/CVE-2020-16092.patch: fix assertion failure in
      hw/net/net_tx_pkt.c.
    - CVE-2020-16092

 -- Marc Deslauriers <email address hidden> Tue, 11 Aug 2020 13:19:33 -0400

Source diff to previous version
CVE-2020-10756 An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occurs in the icmp6_send_echorep
CVE-2020-13253 sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS
CVE-2020-13361 In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trig
CVE-2020-13362 In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS u
CVE-2020-13659 address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
CVE-2020-13754 hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
CVE-2020-13765 rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid m
CVE-2020-15863 hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects t
CVE-2020-16092 In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A

Version: 1:2.11+dfsg-1ubuntu7.29 2020-07-23 19:06:23 UTC

  qemu (1:2.11+dfsg-1ubuntu7.29) bionic; urgency=medium

  * allow vhost-user driver to ignore some unneeded mem regions,
    to stay under its api limit of 8 mem regions (LP: #1887525)
    - d/p/lp1887525/0001-vhost-fix-memslot-limit-check.patch
    - d/p/lp1887525/0002-vhost-allow-backends-to-filter-memory-sections.patch

 -- Dan Streetman <email address hidden> Tue, 14 Jul 2020 09:35:16 -0400

1887525 qemu vhost-user should ignore irrelevant mem regions because it has limit of 8 regions



About   -   Send Feedback to @ubuntu_updates