Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6567.2
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6567-2)
Summary:	The remote host is missing an update for the 'qemu' package(s) announced via the USN-6567-2 advisory.
Description:	Summary: The remote host is missing an update for the 'qemu' package(s) announced via the USN-6567-2 advisory. Vulnerability Insight: USN-6567-1 fixed vulnerabilities QEMU. The fix for CVE-2023-2861 was too restrictive and introduced a behaviour change leading to a regression in certain environments. This update fixes the problem. Original advisory details: Gaoning Pan and Xingwei Li discovered that QEMU incorrectly handled the USB xHCI controller device. A privileged guest attacker could possibly use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2020-14394) It was discovered that QEMU incorrectly handled the TCG Accelerator. A local attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code and esclate privileges. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-24165) It was discovered that QEMU incorrectly handled the Intel HD audio device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-3611) It was discovered that QEMU incorrectly handled the ATI VGA device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-3638) It was discovered that QEMU incorrectly handled the VMWare paravirtual RDMA device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. (CVE-2023-1544) It was discovered that QEMU incorrectly handled the 9p passthrough filesystem. A malicious guest attacker could possibly use this issue to open special files and escape the exported 9p tree. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-2861) It was discovered that QEMU incorrectly handled the virtual crypto device. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. (CVE-2023-3180) It was discovered that QEMU incorrectly handled the built-in VNC server. A remote authenticated attacker could possibly use this issue to cause QEMU to stop responding, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3255) It was discovered that QEMU incorrectly handled net device hot-unplugging. A malicious guest attacker could use this issue to cause QEMU to crash, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3301) It was discovered that QEMU incorrectly handled the built-in VNC server. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.04. ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'qemu' package(s) on Ubuntu 20.04, Ubuntu 22.04. Solution: Please install the updated package(s). CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-14394 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/ https://bugzilla.redhat.com/show_bug.cgi?id=1908004 https://gitlab.com/qemu-project/qemu/-/issues/646 https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html Common Vulnerability Exposure (CVE) ID: CVE-2020-24165 https://bugs.launchpad.net/qemu/+bug/1863025 https://pastebin.com/iqCbjdT8 https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html Common Vulnerability Exposure (CVE) ID: CVE-2021-3611 GLSA-202208-27 https://security.gentoo.org/glsa/202208-27 https://bugzilla.redhat.com/show_bug.cgi?id=1973784 https://gitlab.com/qemu-project/qemu/-/issues/542 https://security.netapp.com/advisory/ntap-20220624-0001/ Common Vulnerability Exposure (CVE) ID: CVE-2021-3638 FEDORA-2022-22b1f8dae2 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/ FEDORA-2023-c8a60f6f80 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTVPHLLXJ65BUMFBUUZ35F3J632SLFRK/ https://bugzilla.redhat.com/show_bug.cgi?id=1979858 https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html https://security.netapp.com/advisory/ntap-20220407-0003/ https://ubuntu.com/security/CVE-2021-3638 Common Vulnerability Exposure (CVE) ID: CVE-2023-1544 https://access.redhat.com/security/cve/CVE-2023-1544 https://bugzilla.redhat.com/show_bug.cgi?id=2180364 https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html https://security.netapp.com/advisory/ntap-20230511-0005/ Common Vulnerability Exposure (CVE) ID: CVE-2023-2861 RHBZ#2219266 https://bugzilla.redhat.com/show_bug.cgi?id=2219266 https://access.redhat.com/security/cve/CVE-2023-2861 https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html https://security.netapp.com/advisory/ntap-20240125-0005/ https://security.netapp.com/advisory/ntap-20240229-0002/ Common Vulnerability Exposure (CVE) ID: CVE-2023-3180 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R/ RHBZ#2222424 https://bugzilla.redhat.com/show_bug.cgi?id=2222424 https://access.redhat.com/security/cve/CVE-2023-3180 Common Vulnerability Exposure (CVE) ID: CVE-2023-3255 RHBZ#2218486 https://bugzilla.redhat.com/show_bug.cgi?id=2218486 RHSA-2024:2135 https://access.redhat.com/errata/RHSA-2024:2135 RHSA-2024:2962 https://access.redhat.com/errata/RHSA-2024:2962 https://access.redhat.com/security/cve/CVE-2023-3255 https://security.netapp.com/advisory/ntap-20231020-0008/ Common Vulnerability Exposure (CVE) ID: CVE-2023-3301 RHBZ#2215784 https://bugzilla.redhat.com/show_bug.cgi?id=2215784 https://access.redhat.com/security/cve/CVE-2023-3301
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.