UbuntuUSN-4650-1QEMU vulnerabilities
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.4 High
AI Score
Confidence
Low
4.7 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:N/I:N/A:C
0.002 Low
EPSS
Percentile
56.7%
Releases
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
Packages
- qemu - Machine emulator and virtualizer
Details
Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code on the host. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2020-17380)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU
incorrectly handled USB device emulation. An attacker inside the guest
could use this issue to cause QEMU to crash, resulting in a denial of
service. (CVE-2020-25084)
Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU
incorrectly handled SDHCI device emulation. An attacker inside the guest
could use this issue to cause QEMU to crash, resulting in a denial of
service. (CVE-2020-25085)
Gaoning Pan, Yongkang Jia, and Yi Ren discovered that QEMU incorrectly
handled USB device emulation. An attacker inside the guest could use this
issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2020-25624)
It was discovered that QEMU incorrectly handled USB device emulation. An
attacker inside the guest could use this issue to cause QEMU to hang,
resulting in a denial of service. (CVE-2020-25625)
Cheolwoo Myung discovered that QEMU incorrectly handled USB device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. (CVE-2020-25723)
Gaoning Pan discovered that QEMU incorrectly handled ATI graphics device
emulation. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. This issue only affected Ubuntu
20.04 LTS and Ubuntu 20.10. (CVE-2020-27616)
Gaoning Pan discovered that QEMU incorrectly handled networking. An
attacker inside the guest could use this issue to cause QEMU to crash,
resulting in a denial of service. (CVE-2020-27617)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 20.10 | noarch | qemu-system | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-block-extra | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-block-extra-dbgsym | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-guest-agent | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-guest-agent-dbgsym | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-kvm | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-system-arm | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-system-arm-dbgsym | < 1:5.0-5ubuntu9.2 | UNKNOWN |
| Ubuntu | 20.10 | noarch | qemu-system-common | < 1:5.0-5ubuntu9.2 | UNKNOWN |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.4 High
AI Score
Confidence
Low
4.7 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:N/I:N/A:C
0.002 Low
EPSS
Percentile
56.7%