Уязвимости qemu · Страница 4

UBUNTU-CVE-2026-41435

hw/uefi: fix buffer overruns

• Обновитесь до 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-6502

hw/display: don't accidentally autofree existing virgl resources

• Обновитесь до 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-5763

[virtio-scsi request size mismatch]

• Обновитесь до 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-5761

[virtio-blk: zone report buffer out-of-memory]

• Обновитесь до 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-5744

[hw/uefi: heap overflow]

• Обновитесь до 1:10.0.10+ds-0+deb13u1

UBUNTU-CVE-2026-3890

[hcd-ohci: infinite loop]

• Обновитесь до 1:10.0.10+ds-0+deb13u1

Qemu-kvm: heap buffer out-of-bounds read in vmdk compressed grain parsing

A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service condition (DoS).

• Обновитесь до 1:10.0.10+ds-0+deb13u1

Qemu-kvm: heap off-by-one in kvm xen physdevop_map_pirq

An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.

• Обновитесь до 1:10.0.8+ds-0+deb13u1

Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.

• Обновитесь до 1:10.0.3+ds-4

Qemu-kvm: unbounded allocation in virtio-crypto

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

• Обновитесь до 1:10.0.8+ds-0+deb13u1

Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.

• Обновитесь до 1:10.0.7+ds-0+deb13u1

Qemu-kvm: vnc websocket handshake use-after-free

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

• Обновитесь до 1:10.0.7+ds-0+deb13u1

qemu - security update

qemu - security update

• Обновитесь до 1:10.0.2+ds-2+deb13u1

CVE-2025-54567

hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.

• Обновитесь до 1:10.0.2+ds-2+deb13u1

CVE-2025-54566

hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.

• Обновитесь до 1:10.0.2+ds-2+deb13u1

Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()

A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero.

• Обновитесь до 1:9.1.0+ds-1

Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()

A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

• Обновитесь до 1:8.2.3+ds-1

Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

• Обновитесь до 1:10.0.10+ds-0+deb13u1

Qemu-kvm: information leak in virtio devices

A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak.

Qemu-kvm: usb: assertion failure in usb_ep_get()

A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.