PublicDateAtUSN: 2016-02-23
Candidate: CVE-2016-2538
PublicDate: 2016-06-16 18:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2538
 https://lists.gnu.org/archive/html/qemu-devel/2016-02/msg03658.html
 http://www.openwall.com/lists/oss-security/2016/02/22/3
 https://ubuntu.com/security/notices/USN-2974-1
Description:
 Multiple integer overflows in the USB Net device emulator
 (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS
 administrators to cause a denial of service (QEMU process crash) or obtain
 sensitive host memory information via a remote NDIS control message packet
 that is mishandled in the (1) rndis_query_response, (2) rndis_set_response,
 or (3) usb_net_handle_dataout function.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815680
 https://bugzilla.redhat.com/show_bug.cgi?id=1303120
Priority: low
Discovered-by: Qinghao Tang
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H [7.1 HIGH]

Patches_qemu-kvm:
upstream_qemu-kvm: needed
precise_qemu-kvm: released (1.0+noroms-0ubuntu14.28)
trusty_qemu-kvm: DNE
trusty/esm_qemu-kvm: DNE
vivid_qemu-kvm: DNE
vivid/ubuntu-core_qemu-kvm: DNE
vivid/stable-phone-overlay_qemu-kvm: DNE
wily_qemu-kvm: DNE
xenial_qemu-kvm: DNE
devel_qemu-kvm: DNE

Patches_qemu:
 upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=fe3c546c5ff2a6210f9a4d8561cc64051ca8603e
upstream_qemu: needed
precise_qemu: DNE
trusty_qemu: released (2.0.0+dfsg-2ubuntu1.24)
trusty/esm_qemu: released (2.0.0+dfsg-2ubuntu1.24)
vivid_qemu: needed
vivid/ubuntu-core_qemu: DNE
vivid/stable-phone-overlay_qemu: DNE
wily_qemu: released (1:2.3+dfsg-5ubuntu9.4)
xenial_qemu: released (1:2.5+dfsg-5ubuntu10.1)
esm-infra/xenial_qemu: released (1:2.5+dfsg-5ubuntu10.1)
devel_qemu: not-affected (1:2.6+dfsg-3ubuntu1)