[SECURITY] [DLA 2753-2] qemu regression update

2021-09-1122:11:35

lists.debian.org

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

3.8 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

6.1 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.3%

JSON

Debian LTS Advisory DLA-2753-2 [email protected]
https://www.debian.org/lts/security/ Markus Koschany
September 11, 2021 https://wiki.debian.org/LTS

Package : qemu
Version : 1:2.8+dfsg-6+deb9u16
CVE ID : CVE-2021-3592
Debian Bug : 994080

It was found that the patch for CVE-2021-3592 introduced a regression which
prevented ssh connections to the host system. Since there is no imminent
solution for the problem, the patch for CVE-2021-3592 has been reverted.
Updated qemu packages are now available to correct this issue.

For Debian 9 stretch, this problem has been fixed in version
1:2.8+dfsg-6+deb9u16.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/qemu

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian10arm64qemu-user-static< 1:3.1+dfsg-8+deb10u10qemu-user-static_1:3.1+dfsg-8+deb10u10_arm64.deb
Debian11amd64libslirp0-dbgsym< 4.4.0-1+deb11u2libslirp0-dbgsym_4.4.0-1+deb11u2_amd64.deb
Debian11mipsellibslirp-dev< 4.4.0-1+deb11u2libslirp-dev_4.4.0-1+deb11u2_mipsel.deb
Debian9amd64qemu-user< 1:2.8+dfsg-6+deb9u16qemu-user_1:2.8+dfsg-6+deb9u16_amd64.deb
Debian9armelqemu-system-ppc< 1:2.8+dfsg-6+deb9u16qemu-system-ppc_1:2.8+dfsg-6+deb9u16_armel.deb
Debian10i386qemu-utils< 1:3.1+dfsg-8+deb10u10qemu-utils_1:3.1+dfsg-8+deb10u10_i386.deb
Debian11i386libslirp0-dbgsym< 4.4.0-1+deb11u2libslirp0-dbgsym_4.4.0-1+deb11u2_i386.deb
Debian10arm64qemu-system< 1:3.1+dfsg-8+deb10u10qemu-system_1:3.1+dfsg-8+deb10u10_arm64.deb
Debian10armhfqemu-block-extra< 1:3.1+dfsg-8+deb10u10qemu-block-extra_1:3.1+dfsg-8+deb10u10_armhf.deb
Debian11mipsellibslirp0-dbgsym< 4.4.0-1+deb11u2libslirp0-dbgsym_4.4.0-1+deb11u2_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	arm64	qemu-user-static	< 1:3.1+dfsg-8+deb10u10	qemu-user-static_1:3.1+dfsg-8+deb10u10_arm64.deb
Debian	11	amd64	libslirp0-dbgsym	< 4.4.0-1+deb11u2	libslirp0-dbgsym_4.4.0-1+deb11u2_amd64.deb
Debian	11	mipsel	libslirp-dev	< 4.4.0-1+deb11u2	libslirp-dev_4.4.0-1+deb11u2_mipsel.deb
Debian	9	amd64	qemu-user	< 1:2.8+dfsg-6+deb9u16	qemu-user_1:2.8+dfsg-6+deb9u16_amd64.deb
Debian	9	armel	qemu-system-ppc	< 1:2.8+dfsg-6+deb9u16	qemu-system-ppc_1:2.8+dfsg-6+deb9u16_armel.deb
Debian	10	i386	qemu-utils	< 1:3.1+dfsg-8+deb10u10	qemu-utils_1:3.1+dfsg-8+deb10u10_i386.deb
Debian	11	i386	libslirp0-dbgsym	< 4.4.0-1+deb11u2	libslirp0-dbgsym_4.4.0-1+deb11u2_i386.deb
Debian	10	arm64	qemu-system	< 1:3.1+dfsg-8+deb10u10	qemu-system_1:3.1+dfsg-8+deb10u10_arm64.deb
Debian	10	armhf	qemu-block-extra	< 1:3.1+dfsg-8+deb10u10	qemu-block-extra_1:3.1+dfsg-8+deb10u10_armhf.deb
Debian	11	mipsel	libslirp0-dbgsym	< 4.4.0-1+deb11u2	libslirp0-dbgsym_4.4.0-1+deb11u2_mipsel.deb