Summary
It was discovered that QEMU incorrectly handled certain virtio devices. A
privileged guest attacker could use this issue to cause QEMU to crash,
leading to a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3446)
It was discovered that QEMU incorrectly handled SDHCI device emulation. A
guest attacker could possibly use this issue to cause QEMU to crash,
leading to a denial of service. This issue only affected Ubuntu 22.04 LTS
and Ubuntu 24.04 LTS. (CVE-2024-3447)
It was discovered that QEMU incorrectly handled calculating the checksum
of a short-sized fragmented packet. A guest attacker could possibly use
this issue to cause QEMU to crash, leading to a denial of service. This
issue only affected Ubuntu 24.04 LTS. (CVE-2024-3567)
It was discovered that the QEMU qemu-img utility incorrectly handled
certain crafted image files. An attacker could use this issue to cause QEMU
to consume resources, leading to a denial of service, or possibly read and
write to an existing external file. This issue only affected Ubuntu 22.04
LTS and Ubuntu 24.04 LTS. (CVE-2024-4467)
It was discovered that QEMU incorrectly handled the RSS feature on
virtio-net devices. A privileged guest attacker could possibly use this
issue to cause QEMU to crash, leading to a denial of service. This
issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-6505)
It was discovered that QEMU incorrectly handled the NBD server. An attacker
could use this issue to cause QEMU to consume resources, leading to a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
24.04 LTS. (CVE-2024-7409)
It was discovered that QEMU incorrectly handled certain USB devices. A
guest attacker could possibly use this issue to cause QEMU to crash,
leading to a denial of service. This issue only affected Ubuntu 22.04 LTS
and Ubuntu 24.04 LTS. (CVE-2024-8354)
It was discovered that the QEMU package incorrectly set up a binfmt_misc
registration with the C (Credential) flag. A local attacker could use this
with a suid/sgid binary to escalate privileges. This update will no longer
run foreign-architecture binaries with suid/sgid with elevated privileges.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.27 |
| Ubuntu · 24.04 LTS 24.04:LTS | qemu | 1:8.2.2+ds-0ubuntu1.10 |
Vulnerabilities 7
-
High 8.2
Qemu: virtio: dma reentrancy issue leads to double free vulnerability
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to…
-
High 7.8
Qemu-kvm: 'qemu-img info' leads to host file read/write
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time,…
-
High 7.5
Qemu: denial of service via improper synchronization in qemu nbd server during socket closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
-
Medium 6.8
Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss
A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially …
-
Medium 6.0
Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()
A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash t…
-
Medium 5.5
Qemu-kvm: net: assertion failure in update_sctp_checksum()
A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a den…
-
Medium 5.5
Qemu-kvm: usb: assertion failure in usb_ep_get()
A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and c…
References
-
report
https://ubuntu.com/security/CVE-2024-3446
-
report
https://ubuntu.com/security/CVE-2024-3447
-
report
https://ubuntu.com/security/CVE-2024-3567
-
report
https://ubuntu.com/security/CVE-2024-4467
-
report
https://ubuntu.com/security/CVE-2024-6505
-
report
https://ubuntu.com/security/CVE-2024-7409
-
report
https://ubuntu.com/security/CVE-2024-8354
-
report
https://bugs.launchpad.net/bugs/2120814