Package "qemu-user"
| Name: |
qemu-user
|
Description: |
QEMU user mode emulation binaries
|
| Latest version: |
1:4.2-3ubuntu6.14 |
| Release: |
focal (20.04) |
| Level: |
security |
| Repository: |
universe |
| Head package: |
qemu |
| Homepage: |
http://www.qemu.org/ |
Links
Download "qemu-user"
Other versions of "qemu-user" in Focal
Changelog
|
qemu (1:4.2-3ubuntu6.14) focal-security; urgency=medium
* SECURITY REGRESSION: fix multiple regressions caused by CVE-2020-13754
security update (LP: #1914883)
- debian/patches/ubuntu/CVE-2020-13754-3.patch: log invalid memory
accesses in memory.c.
- debian/patches/ubuntu/CVE-2020-13754-4.patch: allow 16-bit writes to
memory region in hw/riscv/sifive_test.c.
- debian/patches/ubuntu/CVE-2020-13754-5.patch: allow 64-bit accesses
in hw/timer/slavio_timer.c.
- debian/patches/ubuntu/CVE-2020-13754-6.patch: allow less than 32-bit
accesses in hw/char/bcm2835_aux.c.
- debian/patches/ubuntu/CVE-2020-13754-9.patch: fix
valid.max_access_size to access address registers in
hw/usb/hcd-xhci.c.
-- Marc Deslauriers <email address hidden> Wed, 10 Feb 2021 08:17:08 -0500
|
| Source diff to previous version |
| 1914883 |
hart0: trap handler failed (error -2) (Needs cherry-pick ab3d207f) |
| CVE-2020-13754 |
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. |
|
|
qemu (1:4.2-3ubuntu6.12) focal-security; urgency=medium
* SECURITY UPDATE: heap overread in iscsi_aio_ioctl_cb
- debian/patches/ubuntu/CVE-2020-11947.patch: fix heap-buffer-overflow
in block/iscsi.c.
- CVE-2020-11947
* SECURITY UPDATE: use-after-free in e1000e
- debian/patches/ubuntu/CVE-2020-15859.patch: forbid the reentrant RX
in net/queue.c.
- CVE-2020-15859
* SECURITY UPDATE: OOB write to MSI-X table
- debian/patches/ubuntu/CVE-2020-27821.patch: clamp cached translation
in case it points to an MMIO region in exec.c.
- CVE-2020-27821
* SECURITY UPDATE: infinite loop in e1000e
- debian/patches/ubuntu/CVE-2020-28916.patch: advance desc_offset in
case of null descriptor in hw/net/e1000e_core.c.
- CVE-2020-28916
* SECURITY UPDATE: out of bounds read in atapi
- debian/patches/ubuntu/CVE-2020-29443-1.patch: assert that the buffer
pointer is in range in hw/ide/atapi.c.
- debian/patches/ubuntu/CVE-2020-29443-2.patch: check logical block
address and read size in hw/ide/atapi.c.
- CVE-2020-29443
* SECURITY UPDATE: use after free in 9p
- debian/patches/ubuntu/CVE-2021-20181.patch: fully restart unreclaim
loop in hw/9pfs/9p.c.
- CVE-2021-20181
-- Marc Deslauriers <email address hidden> Wed, 03 Feb 2021 10:56:08 -0500
|
| Source diff to previous version |
| CVE-2020-11947 |
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an |
| CVE-2020-15859 |
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000 |
| CVE-2020-27821 |
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds w |
| CVE-2020-28916 |
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address. |
| CVE-2020-29443 |
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. |
| CVE-2021-20181 |
9pfs: Fully restart unreclaim loop |
|
|
qemu (1:4.2-3ubuntu6.10) focal-security; urgency=medium
* SECURITY UPDATE: heap buffer overflow in sdhci_sdma_transfer_multi_blocks()
- debian/patches/ubuntu/CVE-2020-17380.patch: fix DMA Transfer Block
Size field in hw/sd/sdhci.c.
- CVE-2020-17380
- CVE-2020-25085
* SECURITY UPDATE: use-after-free via unchecked return value
- debian/patches/ubuntu/CVE-2020-25084.patch: check return value of
'usb_packet_map' in hw/usb/hcd-xhci.c.
- CVE-2020-25084
* SECURITY UPDATE: out-of-bound access issue
- debian/patches/ubuntu/CVE-2020-25624.patch: check len and
frame_number variables in hw/usb/hcd-ohci.c.
- CVE-2020-25624
* SECURITY UPDATE: infinite loop when a TD list has a loop
- debian/patches/ubuntu/CVE-2020-25625.patch: check for processed TD
before retire in hw/usb/hcd-ohci.c.
- CVE-2020-25625
* SECURITY UPDATE: assertion failure through usb_packet_unmap()
- debian/patches/ubuntu/CVE-2020-25723.patch: check return value of
'usb_packet_map' in hw/usb/hcd-ehci.c.
- CVE-2020-25723
* SECURITY UPDATE: bounds issue in ati_2d_blt
- debian/patches/ubuntu/CVE-2020-27616.patch: check x y display
parameter values in hw/display/ati_2d.c.
- CVE-2020-27616
* SECURITY UPDATE: assertion failure
- debian/patches/ubuntu/CVE-2020-27617.patch: remove an assert call in
eth_get_gso_type in net/eth.c.
- CVE-2020-27617
-- Marc Deslauriers <email address hidden> Fri, 20 Nov 2020 08:12:00 -0500
|
| Source diff to previous version |
| CVE-2020-17380 |
heap buffer overflow in sdhci_sdma_transfer_multi_blocks() in hw/sd/sdhci.c |
| CVE-2020-25085 |
QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c mishandles a write operation in the SDHC_BLKSIZ |
| CVE-2020-25084 |
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked. |
| CVE-2020-25624 |
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via ... |
| CVE-2020-25625 |
hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. |
| CVE-2020-25723 |
assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c |
| CVE-2020-27616 |
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. |
| CVE-2020-27617 |
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data |
|
|
qemu (1:4.2-3ubuntu6.6) focal-security; urgency=medium
* SECURITY UPDATE: out-of-bounds read/write in USB emulator
- debian/patches/ubuntu/CVE-2020-14364.patch: fix setup_len init in
hw/usb/core.c.
- CVE-2020-14364
-- Marc Deslauriers <email address hidden> Tue, 15 Sep 2020 10:02:08 -0400
|
| Source diff to previous version |
| CVE-2020-14364 |
An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processing USB pa |
|
|
qemu (1:4.2-3ubuntu6.4) focal-security; urgency=medium
* SECURITY UPDATE: assert failure in nbd
- debian/patches/ubuntu/CVE-2020-10761.patch: avoid long error message
assertions in nbd/server.c, tests/qemu-iotests/143,
tests/qemu-iotests/143.out.
- CVE-2020-10761
* SECURITY UPDATE: out-of-bounds read and write in sm501
- debian/patches/ubuntu/CVE-2020-12829-pre1.patch: convert printf +
abort to qemu_log_mask.
- debian/patches/ubuntu/CVE-2020-12829-pre2.patch: shorten long
variable names in sm501_2d_operation.
- debian/patches/ubuntu/CVE-2020-12829-pre3.patch: use BIT(x) macro to
shorten constant.
- debian/patches/ubuntu/CVE-2020-12829-pre4.patch: clean up local
variables in sm501_2d_operation.
- debian/patches/ubuntu/CVE-2020-12829.patch: replace hand written
implementation with pixman where possible.
- debian/patches/ubuntu/CVE-2020-12829-2.patch: optimize small
overlapping blits.
- debian/patches/ubuntu/CVE-2020-12829-3.patch: fix bounds checks.
- debian/patches/ubuntu/CVE-2020-12829-4.patch: drop unneded variable.
- debian/patches/ubuntu/CVE-2020-12829-5.patch: do not allow guest to
set invalid format.
- debian/patches/ubuntu/CVE-2020-12829-6.patch: introduce variable for
commonly used value for better readability.
- debian/patches/ubuntu/CVE-2020-12829-7.patch: fix and optimize
overlap check.
- CVE-2020-12829
* SECURITY UPDATE: out-of-bounds read during sdhci_write() operations
- debian/patches/ubuntu/CVE-2020-13253.patch: do not switch to
ReceivingData if address is invalid in hw/sd/sd.c.
- CVE-2020-13253
* SECURITY UPDATE: out-of-bounds access during es1370_write() operation
- debian/patches/ubuntu/CVE-2020-13361.patch: check total frame count
against current frame in hw/audio/es1370.c.
- CVE-2020-13361
* SECURITY UPDATE: out-of-bounds read via crafted reply_queue_head
- debian/patches/ubuntu/CVE-2020-13362-1.patch: use unsigned type for
reply_queue_head and check index in hw/scsi/megasas.c.
- debian/patches/ubuntu/CVE-2020-13362-2.patch: avoid NULL pointer
dereference in hw/scsi/megasas.c.
- debian/patches/ubuntu/CVE-2020-13362-3.patch: use unsigned type for
positive numeric fields in hw/scsi/megasas.c.
- CVE-2020-13362
* SECURITY UPDATE: NULL pointer dereference related to BounceBuffer
- debian/patches/ubuntu/CVE-2020-13659.patch: set map length to zero
when returning NULL in exec.c, include/exec/memory.h.
- CVE-2020-13659
* SECURITY UPDATE: out-of-bounds access via msi-x mmio operation
- debian/patches/ubuntu/CVE-2020-13754-1.patch: revert accepting
mismatching sizes in memory_region_access_valid in memory.c.
- debian/patches/ubuntu/CVE-2020-13754-2.patch: accept byte and word
access to core ACPI registers in hw/acpi/core.c.
- CVE-2020-13754
* SECURITY UPDATE: infinite recursion in ati-vga
- debian/patches/ubuntu/CVE-2020-13800.patch: check mm_index before
recursive call in hw/display/ati.c.
- CVE-2020-13800
* SECURITY UPDATE: division by zero in oss_write()
- debian/patches/ubuntu/CVE-2020-14415.patch: fix buffer pos
calculation in audio/ossaudio.c.
- CVE-2020-14415
* SECURITY UPDATE: buffer overflow in XGMAC Ethernet controller
- debian/patches/ubuntu/CVE-2020-15863.patch: check bounds in
hw/net/xgmac.c.
- CVE-2020-15863
* SECURITY UPDATE: reachable assertion failure
- debian/patches/ubuntu/CVE-2020-16092.patch: fix assertion failure in
hw/net/net_tx_pkt.c.
- CVE-2020-16092
-- Marc Deslauriers <email address hidden> Tue, 11 Aug 2020 12:30:06 -0400
|
| CVE-2020-10761 |
An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before QEMU 5.0.1. This flaw occurs when an nbd-cli |
| CVE-2020-13253 |
sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS |
| CVE-2020-13361 |
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trig |
| CVE-2020-13362 |
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS u |
| CVE-2020-13659 |
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer. |
| CVE-2020-13754 |
hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation. |
| CVE-2020-13800 |
ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index value during an ati_mm_read or a |
| CVE-2020-14415 |
division by zero in oss_write() in audio/ossaudio.c |
| CVE-2020-15863 |
hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects t |
| CVE-2020-16092 |
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A |
|
About
-
Send Feedback to @ubuntu_updates
