Ubuntu alert USN-8172-1 (kvmtool)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8172-1] kvmtool vulnerabilities
Date:
             
 
Mon, 13 Apr 2026 19:09:58 +0000
Message-ID:
             
 
<E1wCMfW-0003Ev-NH@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8172-1
April 13, 2026

kvmtool vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in kvmtool.

Software Description:
- kvmtool: Native Linux KVM tool

Details:

It was discovered that kvmtool did not properly manage memory under certain
circumstances. A malicious guest attacker could use this issue to cause
kvmtool to crash, leading to a denial of service, or possibly execute
arbitrary code on the host system. (CVE-2021-45464)

It was discovered that kvmtool incorrectly handled the 9p passthrough file
system. A malicious guest attacker could possibly use this issue to open
special files, escape the exported 9p tree, and execute arbitrary code on
the host system. (CVE-2023-2861)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  kvmtool                         0.20170904-1.1ubuntu0.1~esm2
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  kvmtool                         0.20170904-1ubuntu0.20.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  kvmtool                         0.20170904-1ubuntu0.18.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  kvmtool                         0.20151104-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8172-1
  CVE-2021-45464, CVE-2023-2861


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmndPzoACgkQcpJm3tlz
hgFhIQ/+KTSDKoU7PZNNTUcKTQGTsyeVB4SWJoCU2FK2IFeRO/bYhDAzEQTQXJo6
O2Fu860hOTiNgQoZDal9ghijgGrUFk1zfyYinN0zK2CsVTBcysN599EzbLy9kJVv
1aHq/uGhpQ+xnHCnvrWWdUYeED1+7SIMqhUrbWg/hLrfKgCHIaav9o4mMuy0xnFC
QWAbsLvvKKfEvgHBThoBf50om7lD7ih3mqEBKBKH0jkPd28Ozjm0rs5D0f/A7aI3
6g9TB93HySEX95XrxOXeuOdOKlA5ryMf0aYyqHn0HDQc+eLBZrbBmkf8WO/+QV2V
+befwdHQ3dv/87edTDIg0nAp/sbuS1B7yFJ/UIw8GYU4ywSpmosW91m82T44uJOP
0euiNFgThCwmpMBDnL/SCtAxyl/TGk5GHXA1kE4oFvGu6cEibeNm1i3ltUZH56a9
ylk5QMlWeduuryTgOMK67kOJ8d9Za3jnLaOtVcdC7UB9d598FD3oBcMrTBS3PZLq
Cmjlc5y7bOx0bxphwZCvg6IFemezAel9g0Yk1lg8iFushcRlHdWhnGxto9Yuhkfk
f55T+cs1N22q3mhhXZlkZNMRm0/ZRn8HVEQx1FKlaT/eYbC7JnDwJk1pk+G4/IGA
NlwX3x7deGcn3tloszwxKqHnYPDqMZkqQVWA608q90myz2P2OMU=
=5YwI
-----END PGP SIGNATURE-----