According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - slirp.c in libslirp through 4.3.1 has a buffer     over-read because it tries to read a certain amount of     header data even if that exceeds the total packet     length.(CVE-2020-29130)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read     because it tries to read a certain amount of header     data even if that exceeds the total packet     length.(CVE-2020-29129)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop     via an RX descriptor with a NULL buffer     address.(CVE-2020-28916)

  - ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can     encounter an outside-limits situation in a calculation.
    A guest can crash the QEMU process.(CVE-2020-27616)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows     guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a     valid Layer 3 protocol.(CVE-2020-27617)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based     buffer over-read via values obtained from the host     controller driver.(CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop     when a TD list has a loop.(CVE-2020-25625)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - A flaw was found in the memory management API of QEMU     during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access     to the MSI-X table while performing MMIO operations. A     guest user may abuse this flaw to crash the QEMU     process on the host, resulting in a denial of service.
    This flaw affects QEMU versions prior to     5.2.0.(CVE-2020-27821)

  - QEMU: reachable assertion failure in     net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c     (CVE-2020-16092)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to     trigger an out-of-bounds access by providing an address     near the end of the PCI configuration     space(CVE-2020-13791)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an     unvalidated address, which leads to an out-of-bounds     read during sdhci_write() operations. A guest OS user     can crash the QEMU process.(CVE-2020-13253)

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in     ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where     memory allocated in deflateInit2 is not freed in     deflateEnd.(CVE-2019-20382)

  - An integer overflow was found in QEMU 4.0.1 through     4.2.0 in the way it implemented ATI VGA emulation. This     flaw occurs in the ati_2d_blt() routine in     hw/display/ati-2d.c while handling MMIO write     operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-11869)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2020-13659)

  - A flaw was found in QEMU in the implementation of the     Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A     general failure of the signature generation process     caused every PAuth-enforced pointer to be signed with     the same signature. A local attacker could obtain the     signature of a protected pointer and abuse this flaw to     bypass PAuth protection for all programs running on     QEMU.(CVE-2020-10702)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU     before 07-20-2020 has a buffer overflow. This occurs     during packet transmission and affects the highbank and     midway emulated machines. A guest user or process could     use this flaw to crash the QEMU process on the host,     resulting in a denial of service or potential     privileged code execution. This was fixed in commit     5519724a13664b43e225ca05351c60b4468e4555.(CVE-2020-1586     3)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in     hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS     user.(CVE-2020-13362)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in     hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an     out-of-bounds access during an es1370_write()     operation.(CVE-2020-13361)

  - rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not     validate the relationship between two addresses, which     allows attackers to trigger an invalid memory copy     operation.(CVE-2020-13765)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a     use-after-free in ip_reass in     ip_input.c.(CVE-2019-15890)

  - A use after free vulnerability in ip_reass() in     ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of     service.(CVE-2020-1983)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest     OS users to trigger infinite recursion via a crafted     mm_index value during an ati_mm_read or ati_mm_write     call.(CVE-2020-13800)

  - An out-of-bounds heap buffer access flaw was found in     the way the iSCSI Block driver in QEMU versions 2.12.0     before 4.2.1 handled a response coming from an iSCSI     server while checking the status of a Logical Address     Block (LBA) in an iscsi_co_block_status() routine. A     remote user could use this flaw to crash the QEMU     process, resulting in a denial of service or potential     execution of arbitrary code with privileges of the QEMU     process on the host.(CVE-2020-1711)

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

據發現，QEMU 未正確處理 bochs 顯示裝置。
客體中的本機攻擊者可利用此弱點造成拒絕服務或可能在主機中執行任意程式碼。此問題只會影響 Ubuntu 19.10。(CVE-2019-15034)

據發現，QEMU 在某些 VNC 作業期間未正確處理記憶體。遠端攻擊者可能會利用此問題造成 QEMU 消耗資源，進而導致拒絕服務。
此問題僅影響 Ubuntu 16.04 LTS、Ubuntu 18.04 LTS 和 Ubuntu 19.10。(CVE-2019-20382)

據發現，QEMU 未在 ARM 上正確產生 QEMU 指針驗證簽章。本機攻擊者可能會利用此問題繞過 PAuth。此問題只會影響 Ubuntu 19.10。
(CVE-2020-10702)

Ziming Zhang 發現 QEMU 未正確處理 ATI VGA 模擬。客體內的攻擊者可利用此問題造成 QEMU 損毀，進而導致拒絕服務。這個問題只會影響 Ubuntu 20.04 LTS。(CVE-2020-11869)

Aviv Sasson 發現，QEMU 未正確處理 Slirp 網路。
遠端攻擊者可利用此問題造成 QEMU 損毀，進而導致拒絕服務或可能執行任意程式碼。
此問題僅影響 Ubuntu 16.04 LTS、Ubuntu 18.04 LTS 和 Ubuntu 19.10. (CVE-2020-1983)。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

发现 QEMU 未能正确处理 bochs-display 设备。
客户机中的本地攻击者可利用此问题造成拒绝服务或可能在主机中执行任意代码。此问题仅影响 Ubuntu 19.10。(CVE-2019-15034)

发现 QEMU 未能正确处理某些 VNC 操作。远程攻击者可能利用此问题导致 QEMU 消耗资源，从而导致拒绝服务。
此问题仅影响 Ubuntu 16.04 LTS、Ubuntu 18.04 LTS 和 Ubuntu 19.10。(CVE-2019-20382)

发现 QEMU 未能正确在 ARM 上生成 QEMU 指针身份认证签名。远程攻击者可能利用此问题绕过 PAuth。此问题仅影响 Ubuntu 19.10。
(CVE-2020-10702)

Ziming Zhang 发现，QEMU 未能正确处理 ATI VGA 仿真。客户机内的本地攻击者可利用此问题造成 QEMU 崩溃，进而导致拒绝服务。此问题仅影响 Ubuntu 20.04 LTS。(CVE-2020-11869)

Aviv Sasson 发现 QEMU 未能正确处理 Slirp 网络后端。
远程攻击者可以利用此问题导致 QEMU 崩溃，从而导致拒绝服务或可能执行任意代码。
此问题仅影响 Ubuntu 16.04 LTS、Ubuntu 18.04 LTS 和 Ubuntu 19.10。(CVE-2020-1983)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

QEMUがbochsディスプレイデバイスを不適切に処理することがわかりました。
ゲスト内のローカルの攻撃者がこれを利用し、サービス拒否を引き起こしたり、ホストで任意のコードを実行したりする可能性があります。この問題の影響を受けるのは Ubuntu 19.10のみです。(CVE-2019-15034) 

QEMUが特定のVNC操作中にメモリを不適切に処理していることがわかりました。リモートの攻撃者が、この問題を利用して、QEMUにリソースを消費させることで、サービス拒否を引き起こす可能性があります。
この問題の影響を受けるのはUbuntu 16.04 LTS、Ubuntu 18.04 LTS、Ubuntu 19.10のみです (CVE-2019-20382)。

QEMUがARMでQEMUポインター認証署名を不適切に生成することがわかりました。ローカルの攻撃者がこの問題を悪用して、PAuthをバイパスする可能性があります。この問題の影響を受けるのは、Ubuntu 19.10のみです。
(CVE-2020-10702)

Ziming Zhang氏は、QEMUがATI VGAエミュレーションを不適切に処理していることを発見しました。ゲスト内のローカルの攻撃者がこの問題を悪用して、QEMUをクラッシュさせ、サービス拒否を引き起こす可能性があります。この問題の影響を受けるのは、Ubuntu 20.04 LTSのみです。(CVE-2020-11869) 

Aviv Sasson氏は、QEMUがSlirpネットワーキングを不適切に処理していることを発見しました。
リモートの攻撃者がこの問題を悪用してQEMUをクラッシュさせ、サービス拒否を引き起こしたり、任意のコードを実行したりする可能性があります。
この問題の影響を受けるのはUbuntu 16.04 LTS、Ubuntu 18.04 LTS、Ubuntu 19.10のみです。(CVE-2020-1983)。

注意: Tenable Network Security は、前述の説明ブロックを Ubuntu セキュリティアドバイザリからすでに直接抽出しています。Tenable では、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4372-1 advisory.

    It was discovered that QEMU incorrectly handled bochs-display devices. A local attacker in a guest could     use this to cause a denial of service or possibly execute arbitrary code in the host. This issue only     affected Ubuntu 19.10. (CVE-2019-15034)

    It was discovered that QEMU incorrectly handled memory during certain VNC operations. A remote attacker     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2019-20382)

    It was discovered that QEMU incorrectly generated QEMU Pointer Authentication signatures on ARM. A local     attacker could possibly use this issue to bypass PAuth. This issue only affected Ubuntu 19.10.
    (CVE-2020-10702)

    Ziming Zhang discovered that QEMU incorrectly handled ATI VGA emulation. A local attacker in a guest could     use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS. (CVE-2020-11869)

    Aviv Sasson discovered that QEMU incorrectly handled Slirp networking. A remote attacker could use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 19.10. (CVE-2020-1983)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
147523	EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1632)	Nessus	Huawei Local Security Checks	2021/3/10	2022/5/10	high
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS：QEMU 弱點 (USN-4372-1)	Nessus	Ubuntu Local Security Checks	2020/5/22	2025/9/3	medium
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS：QEMU 漏洞 (USN-4372-1)	Nessus	Ubuntu Local Security Checks	2020/5/22	2025/9/3	medium
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU の脆弱性 (USN-4372-1)	Nessus	Ubuntu Local Security Checks	2020/5/22	2025/9/3	medium
147700	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667)	Nessus	Huawei Local Security Checks	2021/3/11	2022/5/10	high
136803	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4372-1)	Nessus	Ubuntu Local Security Checks	2020/5/22	2025/9/3	medium

偵測

搜尋 Plugin

high

medium

medium

medium

high

medium