Description
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | QEMU: | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:3.1+dfsg-2 | — |
| Debian 13 | qemu | 1:3.1+dfsg-2 | — |
| Debian 12 | qemu | 1:3.1+dfsg-2 | — |
| Debian 9 | qemu | 1:2.8+dfsg-6+deb9u6 | DSA-4454-1 |
| Debian 8 | qemu | 1:2.1+dfsg-12+deb8u10 | DLA-1694-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | qemu | 1:2.11+dfsg-1ubuntu7.12 | USN-3923-1 |
| Ubuntu 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.36 | USN-3923-1 |
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.45 | USN-3923-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | qemu | 2.11.2-9.20.1 | SUSE-SU-2019:0423-1 |
| SLES 12 SP4 | qemu | 2.11.2-5.8.1 | SUSE-SU-2019:0435-1 |
| SLES 12 SP3 | qemu | 2.9.1-6.28.1 | SUSE-SU-2019:0582-1 |
| SLES 12 SP2 | qemu | 2.6.2-41.49.1 | SUSE-SU-2019:0489-1 |
| SLES 12 SP1 | qemu | 2.3.1-33.20.1 | SUSE-SU-2019:0471-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | qemu | 2.11.2-5.8.1 | SUSE-SU-2019:0435-1 |
| SLES for SAP 12 SP3 | qemu | 2.9.1-6.28.1 | SUSE-SU-2019:0582-1 |
| SLES for SAP 12 SP2 | qemu | 2.6.2-41.49.1 | SUSE-SU-2019:0489-1 |
| SLES for SAP 12 SP1 | qemu | 2.3.1-33.20.1 | SUSE-SU-2019:0471-2 |
| SUSE OpenStack Cloud 7 | qemu | 2.6.2-41.49.1 | SUSE-SU-2019:0489-1 |
| SUSE Enterprise Storage 4 | qemu | 2.6.2-41.49.1 | SUSE-SU-2019:0489-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | ivshmem-tools +2 | 15:3.0.0-4.el7 | ELSA-2019-4585, ELSA-2019-4518 |
| Oracle Linux 7 | qemu +9 | 12:2.9.0-20.el7 | ELSA-2019-4585, ELSA-2019-4556, ELSA-2019-4518 |
Advisories 14
- DSA-4454-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1694-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3923-1 qemu vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2019:0471-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0423-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0471-2 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0489-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0435-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2019:0582-1 Security update for qemu SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2024-1995 QEMU: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2024
- ELSA-2019-4585 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 15, 2019
- ELSA-2019-4556 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 22, 2019
- ELSA-2019-4518 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jan 25, 2019
References
- [debian-lts-announce] 20190228 [SECURITY] [DLA 1694-1] qemu security update mailing-list
- 106212 vdb-entry
- FEDORA-2019-88a98ce795 vendor-advisory
- USN-3923-1 vendor-advisory
- FEDORA-2019-0664c7724d vendor-advisory
- openSUSE-SU-2019:1074 vendor-advisory
- DSA-4454 vendor-advisory
- 20190531 [SECURITY] [DSA 4454-1] qemu security update mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872