Skip to content
OpenAdvisories
Unscored USN-3047-1 14 CVEs

qemu, qemu-kvm vulnerabilities

Published Aug 4, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Li Qiang discovered that QEMU incorrectly handled 53C9X Fast SCSI
controller emulation. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code on the host. In the default installation, when QEMU
is used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-4439, CVE-2016-4441, CVE-2016-5238, CVE-2016-5338, CVE-2016-6351)

Li Qiang and Qinghao Tang discovered that QEMU incorrectly handled the
VMWare VGA module. A privileged attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
to obtain sensitive host memory. (CVE-2016-4453, CVE-2016-4454)

Li Qiang discovered that QEMU incorrectly handled VMWARE PVSCSI paravirtual
SCSI bus emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service.
This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-4952)

Li Qiang discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host
Bus Adapter emulation support. A privileged attacker inside the guest could
use this issue to cause QEMU to crash, resulting in a denial of service, or
possibly to obtain sensitive host memory. This issue only applied to Ubuntu
14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5105, CVE-2016-5106,
CVE-2016-5107, CVE-2016-5337)

It was discovered that QEMU incorrectly handled certain iSCSI asynchronous
I/O ioctl calls. An attacker inside the guest could use this issue to cause
QEMU to crash, resulting in a denial of service, or possibly execute
arbitrary code on the host. In the default installation, when QEMU is used
with libvirt, attackers would be isolated by the libvirt AppArmor profile.
This issue only applied to Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-5126)

Zhenhao Hong discovered that QEMU incorrectly handled the Virtio module. A
privileged attacker inside the guest could use this issue to cause QEMU to
crash, resulting in a denial of service. (CVE-2016-5403)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS qemu 2.0.0+dfsg-2ubuntu1.26
Ubuntu · 16.04 LTS 16.04:LTS qemu 1:2.5+dfsg-5ubuntu10.3

Vulnerabilities 14

  • Unscored —
    CVE-2016-4439

    The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly c…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-4441

    The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check D…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-4453

    The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-4454

    The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sen…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-4952

    QEMU (aka Quick Emulator), when built with VMWARE PVSCSI paravirtual SCSI bus emulation support, allows local guest OS …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5105

    The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5106

    The megasas_dcmd_set_properties function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Ad…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5107

    The megasas_lookup_frame function in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, all…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5126

    Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to caus…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5238

    The get_cmd function in hw/scsi/esp.c in QEMU might allow local guest OS administrators to cause a denial of service (o…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5337

    The megasas_ctrl_get_info function in hw/scsi/megasas.c in QEMU allows local guest OS administrators to obtain sensitiv…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5338

    The (1) esp_reg_read and (2) esp_reg_write functions in hw/scsi/esp.c in QEMU allow local guest OS administrators to ca…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2016-5403

    The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of serv…

    qemu xen qemu xen Debian Ubuntu Alpine
  • Unscored —
    CVE-2016-6351

    The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulatio…

    qemu qemu Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2016-4439
  • report
    https://ubuntu.com/security/CVE-2016-4441
  • report
    https://ubuntu.com/security/CVE-2016-4453
  • report
    https://ubuntu.com/security/CVE-2016-4454
  • report
    https://ubuntu.com/security/CVE-2016-4952
  • report
    https://ubuntu.com/security/CVE-2016-5105
  • report
    https://ubuntu.com/security/CVE-2016-5106
  • report
    https://ubuntu.com/security/CVE-2016-5107
  • report
    https://ubuntu.com/security/CVE-2016-5126
  • report
    https://ubuntu.com/security/CVE-2016-5238
  • report
    https://ubuntu.com/security/CVE-2016-5337
  • report
    https://ubuntu.com/security/CVE-2016-5338
  • report
    https://ubuntu.com/security/CVE-2016-5403
  • report
    https://ubuntu.com/security/CVE-2016-6351