Package "qemu-system-misc"

Name: qemu-system-misc


QEMU full system emulation binaries (miscelaneous)

Latest version: 1:2.5+dfsg-5ubuntu10.51
Release: xenial (16.04)
Level: updates
Repository: main
Head package: qemu
Homepage: http://www.qemu.org/


Download "qemu-system-misc"

Other versions of "qemu-system-misc" in Xenial

Repository Area Version
base main 1:2.5+dfsg-5ubuntu10
security main 1:2.5+dfsg-5ubuntu10.51


Version: 1:2.5+dfsg-5ubuntu10.51 2021-02-22 18:06:20 UTC

  qemu (1:2.5+dfsg-5ubuntu10.51) xenial-security; urgency=medium

  * SECURITY REGRESSION: fix multiple regressions caused by CVE-2020-13754
    security update (LP: #1914883)
    - debian/patches/CVE-2020-13754-5.patch: allow 64-bit accesses in
    - debian/patches/CVE-2020-13754-9.patch: fix valid.max_access_size to
      access address registers in hw/usb/hcd-xhci.c.

 -- Marc Deslauriers <email address hidden> Wed, 10 Feb 2021 08:40:41 -0500

Source diff to previous version
1914883 hart0: trap handler failed (error -2) (Needs cherry-pick ab3d207f)
CVE-2020-13754 hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.

Version: 1:2.5+dfsg-5ubuntu10.49 2021-02-08 15:07:29 UTC

  qemu (1:2.5+dfsg-5ubuntu10.49) xenial-security; urgency=medium

  * SECURITY UPDATE: heap overread in iscsi_aio_ioctl_cb
    - debian/patches/CVE-2020-11947.patch: fix heap-buffer-overflow in
    - CVE-2020-11947
  * SECURITY UPDATE: use-after-free in e1000e
    - debian/patches/CVE-2020-15859.patch: forbid the reentrant RX in
    - CVE-2020-15859
  * SECURITY UPDATE: out of bounds read in atapi
    - debian/patches/CVE-2020-29443-1.patch: assert that the buffer pointer
      is in range in hw/ide/atapi.c.
    - debian/patches/CVE-2020-29443-2.patch: check logical block address
      and read size in hw/ide/atapi.c.
    - CVE-2020-29443
  * SECURITY UPDATE: use after free in 9p
    - debian/patches/CVE-2021-20181.patch: fully restart unreclaim loop in
    - CVE-2021-20181

 -- Marc Deslauriers <email address hidden> Wed, 03 Feb 2021 12:56:37 -0500

Source diff to previous version
CVE-2020-11947 iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an
CVE-2020-15859 QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000
CVE-2020-29443 ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
CVE-2021-20181 9pfs: Fully restart unreclaim loop

Version: 1:2.5+dfsg-5ubuntu10.48 2020-11-30 16:06:20 UTC

  qemu (1:2.5+dfsg-5ubuntu10.48) xenial-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in sdhci_sdma_transfer_multi_blocks()
    - debian/patches/CVE-2020-17380.patch: fix DMA Transfer Block Size
      field in hw/sd/sdhci.c.
    - CVE-2020-17380
    - CVE-2020-25085
  * SECURITY UPDATE: use-after-free via unchecked return value
    - debian/patches/CVE-2020-25084.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-xhci.c.
    - CVE-2020-25084
  * SECURITY UPDATE: out-of-bound access issue
    - debian/patches/CVE-2020-25624.patch: check len and frame_number
      variables in hw/usb/hcd-ohci.c.
    - CVE-2020-25624
  * SECURITY UPDATE: infinite loop when a TD list has a loop
    - debian/patches/CVE-2020-25625.patch: check for processed TD before
      retire in hw/usb/hcd-ohci.c.
    - CVE-2020-25625
  * SECURITY UPDATE: assertion failure through usb_packet_unmap()
    - debian/patches/CVE-2020-25723.patch: check return value of
      'usb_packet_map' in hw/usb/hcd-ehci.c.
    - CVE-2020-25723
  * SECURITY UPDATE: assertion failure
    - debian/patches/CVE-2020-27617.patch: remove an assert call in
      eth_get_gso_type in net/eth.c.
    - CVE-2020-27617

 -- Marc Deslauriers <email address hidden> Fri, 20 Nov 2020 08:19:16 -0500

Source diff to previous version
CVE-2020-17380 heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c
CVE-2020-25085 QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZ
CVE-2020-25084 QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
CVE-2020-25624 hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via ...
CVE-2020-25625 hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop.
CVE-2020-25723 assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c
CVE-2020-27617 eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data

Version: 1:2.5+dfsg-5ubuntu10.47 2020-11-05 12:06:16 UTC

  qemu (1:2.5+dfsg-5ubuntu10.47) xenial; urgency=medium

  * d/p/u/lp-1894942-*: fix virtio-ccw host/guest notification (LP: #1894942)

 -- Christian Ehrhardt <email address hidden> Mon, 21 Sep 2020 15:50:56 +0200

Source diff to previous version
1894942 [UBUNTU 20.04] Lost virtio host --\u003e guest notifications cause devices to cease normal operation

Version: 1:2.5+dfsg-5ubuntu10.46 2020-09-17 13:06:21 UTC

  qemu (1:2.5+dfsg-5ubuntu10.46) xenial-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds read/write in USB emulator
    - debian/patches/CVE-2020-14364-pre.patch: check RNDIS message length
      in hw/usb/core.c.
    - debian/patches/CVE-2020-14364.patch: fix setup_len init in
    - CVE-2020-14364

 -- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:09:45 -0400

CVE-2020-14364 An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa

About   -   Send Feedback to @ubuntu_updates