QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qemu | Qemu | * | 2.5.1.1 (including) |
| Qemu | Qemu | 2.6.0-rc0 (including) | 2.6.0-rc0 (including) |
| Qemu | Qemu | 2.6.0-rc1 (including) | 2.6.0-rc1 (including) |
| Qemu | Qemu | 2.6.0-rc2 (including) | 2.6.0-rc2 (including) |
| Qemu | Qemu | 2.6.0-rc3 (including) | 2.6.0-rc3 (including) |
| Qemu | Qemu | 2.6.0-rc4 (including) | 2.6.0-rc4 (including) |
| Qemu | Ubuntu | devel | * |
| Qemu | Ubuntu | esm-infra-legacy/trusty | * |
| Qemu | Ubuntu | trusty | * |
| Qemu | Ubuntu | trusty/esm | * |
| Qemu | Ubuntu | upstream | * |
| Qemu | Ubuntu | vivid | * |
| Qemu | Ubuntu | wily | * |
Potential Mitigations
References
- http://www.openwall.com/lists/oss-security/2016/01/29/6
- http://www.openwall.com/lists/oss-security/2016/01/30/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1301643
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html
- https://security.gentoo.org/glsa/201604-01
- http://www.openwall.com/lists/oss-security/2016/01/29/6
- http://www.openwall.com/lists/oss-security/2016/01/30/2
- https://bugzilla.redhat.com/show_bug.cgi?id=1301643
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg05899.html
- https://security.gentoo.org/glsa/201604-01