Security Bulletin: Vulnerabilities in QEMU affect PowerKVM

Vulnerability Details

CVEID: CVE-2016-5105
DESCRIPTION: QEMU, built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, is vulnerable to a denial of service, caused by a stack information leakage in megasas_dcmd_cfg_read. By processing MegaRAID Firmware Interface(MFI) command to read device configuration, an authenticated attacker could exploit this vulnerability to leak host memory bytes.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113528 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-5106
DESCRIPTION: QEMU, built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, is vulnerable to a denial of service, caused by an out of bounds write error in megasas_dcmd_set_properties. By processing MegaRAID Firmware Interface(MFI) command to set controller properties, an authenticated attacker could exploit this vulnerability to cause the QEMU process to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113529 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-5107
DESCRIPTION: QEMU, built with the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, is vulnerable to a denial of service, caused by an out of bounds read error in megasas_lookup_frame routine. By looking up MegaRAID Firmware Interface(MFI) command frames, an authenticated attacker could exploit this vulnerability to cause the QEMU process to crash on the host.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/113530 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-6351
DESCRIPTION: QEMU, with ESP/NCR53C9x controller emulation support, could allow a local authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds write in the esp_do_dma function in hw/scsi/esp.c. An attacker could exploit this vulnerability using attack vectors to execute arbitrary code on QEMU host and cause the QEMU process to crash.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116795 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)

CVEID: CVE-2016-7161
DESCRIPTION: QEMU is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by xlnx.xps-ethernetlite. By sending an overly large ethlite packet, a remote attacker could overflow a buffer and execute arbitrary code on the QEMU host.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117719 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-7908
DESCRIPTION: QEMU is vulnerable to a denial of service, caused by the failure to properly limit the buffer descriptor count when transmitting packets in mcf_fec_do_tx function in mcf_fec.c. By sending a specially-crafted buffer descriptor and bd.flags, an attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117585 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)

CVEID: CVE-2016-7909
DESCRIPTION: QEMU is vulnerable to a denial of service, caused by an error in the pcnet_rdra_addr function in hw/net/pcnet.c. By setting the receive or transmit descriptor ring length to 0, a local guest OS administrator could exploit this vulnerability to cause the QEMU process to enter into an infinite loop and crash.
CVSS Base Score: 3.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/117717 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-8576
DESCRIPTION: QEMU, (aka Quick Emulator), is vulnerable to a denial of service, caused by an error in the xhci_ring_fetch function. By failing to limit the number of link Transfer Request Blocks (TRB) to process, a local attacker with admin privileges could exploit this vulnerability to cause the application to enter into an infinite loop and the QEMU process to crash.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119186 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

CVEID: CVE-2016-8577
DESCRIPTION: QEMU, (aka Quick Emulator), is vulnerable to a denial of service, caused by multiple memory leaks in the v9fs_read function. By using vectors related to an I/O read operation, a local attacker with admin privileges could exploit this vulnerability to consume all available memory resources.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119187 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

CVEID: CVE-2016-8578
DESCRIPTION: QEMU, (aka Quick Emulator), is vulnerable to a denial of service, caused by a NULL pointer dereference in the v9fs_iov_vunmarshal function. By sending an empty string parameter to a 9P operation, a local attacker with admin privileges could exploit this vulnerability to cause the QEMU process to crash.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/119188 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

CVEID: CVE-2016-8669
DESCRIPTION: QEMU is vulnerable to a denial of service, caused by a divide-by-zero error in the serial_update_parameters function in hw/char/serial.c. By using vectors involving a value of divider greater than baud base, a local authenticated attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118989 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

CVEID: CVE-2016-8909
DESCRIPTION: QEMU is vulnerable to a denial of service, caused by an error in the intel_hda_xfer function in hw/audio/intel-hda.c. By using an entry with the same value for buffer length and pointer position, a local authenticated attacker could exploit this vulnerability to cause the application to enter into an infinite loop and consume all available CPU resources.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118998 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)

CVEID: CVE-2016-8910
DESCRIPTION: QEMU is vulnerable to a denial of service, caused by an error in the rtl8139_cplus_transmit function in hw/net/rtl8139.c. By leveraging failure to limit the ring descriptor count, a local authenticated attacker could exploit this vulnerability to cause the application to enter into an infinite loop and consume all available CPU resources.
CVSS Base Score: 6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/118999 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)