USN-3679-1: QEMU update
Ken Johnson and Jann Horn independently discovered that microprocessors utilizing speculative execution of a memory read may allow unauthorized memory reads via sidechannel attacks. An attacker in the guest could use this to expose sensitive guest information, including kernel memory. This update allows QEMU to expose new CPU features added by AMD microcode updates to guests on amd64 and i386.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:2.11+dfsg-1ubuntu7.3 - Upgrade
Upgrade
ubuntu/qemu-systemto a version that resolves this vulnerability.Fixed in 1:2.11+dfsg-1ubuntu7.3 - Upgrade
Upgrade
ubuntu/qemu-system-x86to a version that resolves this vulnerability.Fixed in 1:2.11+dfsg-1ubuntu7.3 - Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:2.10+dfsg-0ubuntu3.8 - Upgrade
Upgrade
ubuntu/qemu-systemto a version that resolves this vulnerability.Fixed in 1:2.10+dfsg-0ubuntu3.8 - Upgrade
Upgrade
ubuntu/qemu-system-x86to a version that resolves this vulnerability.Fixed in 1:2.10+dfsg-0ubuntu3.8 - Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 1:2.5+dfsg-5ubuntu10.30 - Upgrade
Upgrade
ubuntu/qemu-systemto a version that resolves this vulnerability.Fixed in 1:2.5+dfsg-5ubuntu10.30 - Upgrade
Upgrade
ubuntu/qemu-system-x86to a version that resolves this vulnerability.Fixed in 1:2.5+dfsg-5ubuntu10.30 - Upgrade
Upgrade
ubuntu/qemuto a version that resolves this vulnerability.Fixed in 2.0.0+dfsg-2ubuntu1.43 - Upgrade
Upgrade
ubuntu/qemu-systemto a version that resolves this vulnerability.Fixed in 2.0.0+dfsg-2ubuntu1.43 - Upgrade
Upgrade
ubuntu/qemu-system-x86to a version that resolves this vulnerability.Fixed in 2.0.0+dfsg-2ubuntu1.43 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch USN-3679-1
Event History
Frequently Asked Questions
What is the vulnerability addressed in USN-3679-1?
The vulnerability addressed in USN-3679-1 is CVE-2018-3639, which allows for unauthorized memory reads via sidechannel attacks in microprocessors utilizing speculative execution of a memory read.
How does the vulnerability in USN-3679-1 affect the guest?
An attacker in the guest could use the vulnerability in USN-3679-1 to expose sensitive guest information, including kernel memory.
Which versions of QEMU are affected by USN-3679-1?
USN-3679-1 affects QEMU versions 1:2.11+dfsg-1ubuntu7.3, 1:2.10+dfsg-0ubuntu3.8, 1:2.5+dfsg-5ubuntu10.30, and 2.0.0+dfsg-2ubuntu1.43.
How can I fix the vulnerability in USN-3679-1?
To fix the vulnerability in USN-3679-1, update QEMU to version 1:2.11+dfsg-1ubuntu7.3, 1:2.10+dfsg-0ubuntu3.8, 1:2.5+dfsg-5ubuntu10.30, or 2.0.0+dfsg-2ubuntu1.43, depending on the affected version.
Where can I find more information about USN-3679-1?
More information about USN-3679-1 can be found at the following references: [CVE-2018-3639](https://ubuntu.com/security/CVE-2018-3639), [USN-3653-1](https://ubuntu.com/security/notices/USN-3653-1), [USN-3655-1](https://ubuntu.com/security/notices/USN-3655-1).