🛡️ USN-5489-1 — qemu

qemu vulnerabilities

Alexander Bulekov discovered that QEMU incorrectly handled floppy disk

emulation. A privileged attacker inside the guest could use this issue to

cause QEMU to crash, resulting in a denial of service, or possibly leak

sensitive information. (CVE-2021-3507)

It was discovered that QEMU incorrectly handled NVME controller emulation.

An attacker inside the guest could use this issue to cause QEMU to crash,

resulting in a denial of service, or possibly execute arbitrary code. This

issue only affected Ubuntu 22.04 LTS. (CVE-2021-3929)

It was discovered that QEMU incorrectly handled QXL display device

emulation. A privileged attacker inside the guest could use this issue to

cause QEMU to crash, resulting in a denial of service, or possibly execute

arbitrary code. (CVE-2021-4206, CVE-2021-4207)

Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that QEMU

incorrectly handled the virtiofsd shared file system daemon. An attacker

inside the guest could use this issue to create files with incorrect

ownership, possibly leading to privilege escalation. This issue only

affected Ubuntu 22.04 LTS. (CVE-2022-0358)

It was discovered that QEMU incorrectly handled virtio-net devices. A

privileged attacker inside the guest could use this issue to cause QEMU to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2022-26353)

It was discovered that QEMU incorrectly handled vhost-vsock devices. A

privileged attacker inside the guest could use this issue to cause QEMU to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2022-26354)