Ubuntu Fixed High-Severity QEMU Vulnerabilities

Rohan Timalsina

January 23, 2024 - TuxCare expert team

QEMU is a widely used open-source emulator for running multiple operating systems within a virtual machine. However, recent discoveries by the Ubuntu security team have shed light on issues within QEMU, addressing a total of 14 vulnerabilities. Critical updates are available for various Ubuntu versions, including 23.10, 23.04, 22.04 LTS, and 20.04 LTS.

This article aims to explore the details of these vulnerabilities, ensuring a comprehensive understanding to fortify your virtual environment.

High-Severity QEMU Vulnerabilities

CVE-2020-24165 (Cvss 3 Severity Score: 8.8 High)

One of the identified vulnerabilities is CVE-2020-24165, which pertains to the mishandling of the TCG Accelerator. This flaw, exclusive to Ubuntu 20.04 LTS, could potentially be exploited by a local attacker to crash QEMU, leading to a denial of service. More critically, it may enable the execution of arbitrary code, escalating privileges and posing a significant security threat.

CVE-2023-2861 (Cvss 3 Severity Score: 7.1 High)

A second vulnerability, CVE-2023-2861, centers around the 9p passthrough filesystem. Afflicting Ubuntu 20.04 LTS, 22.04 LTS, and 23.04, this flaw could be exploited by a malicious guest attacker to access special files and escape the exported 9p tree.

CVE-2023-3354 (Cvss 3 Severity Score: 7.5 High)

This vulnerability involves the mishandling of the built-in VNC server. With implications for Ubuntu 20.04 LTS, 22.04 LTS, and 23.04, a remote attacker could exploit this flaw to crash QEMU, resulting in a denial of service.

CVE-2023-5088 (Cvss 3 Severity Score: 7.0 High)

A malicious guest attacker exploiting this flaw could gain control of the host in specific nested virtualization scenarios. This vulnerability underscores the importance of meticulous disk offset handling within QEMU to prevent security compromises.

Other issues fixed in these security updates include medium-severity vulnerabilities, such as CVE-2023-1544, CVE-2023-3180, CVE-2023-3301, and CVE-2023-40360. For details of all the fixed vulnerabilities, refer to the Ubuntu Security Notice.

Protecting Systems from Vulnerabilities

If you’re using any of the affected Ubuntu versions, it’s crucial to update your system immediately. You can do this by opening a terminal window and running the following command:

sudo apt update && sudo apt upgrade

Additionally, consider these general best practices for minimizing QEMU vulnerabilities:

Run the latest QEMU version: QEMU developers actively address security flaws, so keeping your software up-to-date is essential.
Patch Management: TuxCare’s QEMUCare live patching solution automates security patching for QEMU-based virtualization systems without needing to reboot or disrupt the operation.
Limit privilege access: Restrict who can run QEMU and virtual machines on your system to minimize potential attack surfaces.
Use trusted sources for VM images: Download virtual machine images only from reputable sources to avoid pre-compromised systems.
Monitor security advisories: Stay informed about newly discovered QEMU vulnerabilities and apply patches promptly.

Conclusion

By following these recommendations, you can significantly reduce the risk of attackers exploiting vulnerabilities in QEMU and compromising your virtualized environments. While this article focused on Ubuntu security updates, it’s important to note that QEMU itself is used across various operating systems and platforms. Users of other distributions or platforms should check their respective security advisories and update their QEMU installations accordingly.

Speak to TuxCare security expert to get started with QEMUCare for a secure computing environment,

The sources for this article can be found on USN-6567-1.

Summary