Summary
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. A remote attacker could possibly use this issue to cause QEMU
to consume resources, resulting in a denial of service. This issue only
affected Ubuntu 14.04 LTS. (CVE-2019-20382)
It was discovered that QEMU incorrectly handled certain memory copy
operations when loading ROM contents. If a user were tricked into running
an untrusted kernel image, a remote attacker could possibly use this issue
to run arbitrary code. This issue only affected Ubuntu 14.04 LTS.
(CVE-2020-13765)
Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A
remote attacker could use this issue to cause QEMU to crash, resulting in a
denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 14.04 LTS. (CVE-2020-1983)
It was discovered that the SLiRP networking implementation of the QEMU
emulator did not properly manage memory under certain circumstances. An
attacker could use this to cause a heap-based buffer overflow or other out-
of-bounds access, which can lead to a denial of service (application crash)
or potential execute arbitrary code. This issue only affected
Ubuntu 14.04 LTS. (CVE-2020-7039)
It was discovered that the SLiRP networking implementation of the QEMU
emulator misuses snprintf return values. An attacker could use this to
cause a denial of service (application crash) or potentially execute
arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-8608)
It was discovered that QEMU SLiRP networking incorrectly handled certain
udp packets. An attacker inside a guest could possibly use this issue to
leak sensitive information from the host. This issue only affected
Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-3592, CVE-2021-3594)
It was discovered that QEMU had a DMA reentrancy issue, leading to a
use-after-free vulnerability. An attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-3019)
It was discovered that QEMU had a flaw in Virtio PCI Bindings, leading
to a triggerable crash via vhost_net_stop. An attacker inside a guest
could possibly use this issue to cause a denial of service. This issue
only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-4693)
It was discovered that QEMU incorrectly handled memory in virtio-sound,
leading to a heap-based buffer overflow. An attacker could possibly use
this issue to cause a denial of service or execute arbitrary code. This
issue only affected Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2024-7730)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | qemu | 1:4.2-3ubuntu6.30 |
| Ubuntu · 22.04 LTS 22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.24 |
| Ubuntu · 24.04 LTS 24.04:LTS | qemu | 1:8.2.2+ds-0ubuntu1.4 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | qemu | 2.0.0+dfsg-2ubuntu1.47+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | qemu | 1:2.5+dfsg-5ubuntu10.51+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | qemu | 1:2.11+dfsg-1ubuntu7.42+esm2 |
Vulnerabilities 10
-
High 7.5
libslirp: use after free vulnerability cause a denial of service.
A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.
-
High 7.4
Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()
A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds wri…
-
Medium 6.0
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
-
Medium 5.5
Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the Q…
-
Unscored —
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz …
-
Unscored —
rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which al…
-
Unscored —
tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands …
-
Unscored —
In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in la…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
References
-
report
https://ubuntu.com/security/CVE-2019-20382
-
report
https://ubuntu.com/security/CVE-2020-1983
-
report
https://ubuntu.com/security/CVE-2020-7039
-
report
https://ubuntu.com/security/CVE-2020-8608
-
report
https://ubuntu.com/security/CVE-2020-13765
-
report
https://ubuntu.com/security/CVE-2021-3592
-
report
https://ubuntu.com/security/CVE-2021-3594
-
report
https://ubuntu.com/security/CVE-2023-3019
-
report
https://ubuntu.com/security/CVE-2024-4693
-
report
https://ubuntu.com/security/CVE-2024-7730
-
report
https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2084210