According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - slirp.c in libslirp through 4.3.1 has a buffer     over-read because it tries to read a certain amount of     header data even if that exceeds the total packet     length.(CVE-2020-29130)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read     because it tries to read a certain amount of header     data even if that exceeds the total packet     length.(CVE-2020-29129)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop     via an RX descriptor with a NULL buffer     address.(CVE-2020-28916)

  - ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can     encounter an outside-limits situation in a calculation.
    A guest can crash the QEMU process.(CVE-2020-27616)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows     guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a     valid Layer 3 protocol.(CVE-2020-27617)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based     buffer over-read via values obtained from the host     controller driver.(CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop     when a TD list has a loop.(CVE-2020-25625)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - A flaw was found in the memory management API of QEMU     during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access     to the MSI-X table while performing MMIO operations. A     guest user may abuse this flaw to crash the QEMU     process on the host, resulting in a denial of service.
    This flaw affects QEMU versions prior to     5.2.0.(CVE-2020-27821)

  - QEMU: reachable assertion failure in     net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c     (CVE-2020-16092)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to     trigger an out-of-bounds access by providing an address     near the end of the PCI configuration     space(CVE-2020-13791)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an     unvalidated address, which leads to an out-of-bounds     read during sdhci_write() operations. A guest OS user     can crash the QEMU process.(CVE-2020-13253)

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in     ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where     memory allocated in deflateInit2 is not freed in     deflateEnd.(CVE-2019-20382)

  - An integer overflow was found in QEMU 4.0.1 through     4.2.0 in the way it implemented ATI VGA emulation. This     flaw occurs in the ati_2d_blt() routine in     hw/display/ati-2d.c while handling MMIO write     operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-11869)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2020-13659)

  - A flaw was found in QEMU in the implementation of the     Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A     general failure of the signature generation process     caused every PAuth-enforced pointer to be signed with     the same signature. A local attacker could obtain the     signature of a protected pointer and abuse this flaw to     bypass PAuth protection for all programs running on     QEMU.(CVE-2020-10702)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU     before 07-20-2020 has a buffer overflow. This occurs     during packet transmission and affects the highbank and     midway emulated machines. A guest user or process could     use this flaw to crash the QEMU process on the host,     resulting in a denial of service or potential     privileged code execution. This was fixed in commit     5519724a13664b43e225ca05351c60b4468e4555.(CVE-2020-1586     3)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in     hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS     user.(CVE-2020-13362)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in     hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an     out-of-bounds access during an es1370_write()     operation.(CVE-2020-13361)

  - rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not     validate the relationship between two addresses, which     allows attackers to trigger an invalid memory copy     operation.(CVE-2020-13765)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a     use-after-free in ip_reass in     ip_input.c.(CVE-2019-15890)

  - A use after free vulnerability in ip_reass() in     ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of     service.(CVE-2020-1983)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest     OS users to trigger infinite recursion via a crafted     mm_index value during an ati_mm_read or ati_mm_write     call.(CVE-2020-13800)

  - An out-of-bounds heap buffer access flaw was found in     the way the iSCSI Block driver in QEMU versions 2.12.0     before 4.2.1 handled a response coming from an iSCSI     server while checking the status of a Logical Address     Block (LBA) in an iscsi_co_block_status() routine. A     remote user could use this flaw to crash the QEMU     process, resulting in a denial of service or potential     execution of arbitrary code with privileges of the QEMU     process on the host.(CVE-2020-1711)

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for kvm fixes the following security issues :

CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735)

CVE-2018-11806: Prevent heap-based buffer overflow via incoming fragmented datagrams (bsc#1096223)

With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

This security issue was fixed :

  - CVE-2018-12617: qmp_guest_file_read had an integer     overflow that could have been exploited by sending a     crafted QMP command (including guest-file-read with a     large count value) to the agent via the listening socket     causing DoS (bsc#1098735)

These non-security issues were fixed :

  - Allow kvm group access to /dev/sev (bsc#1102604).

  - Fix for the value used for reduced_phys_bits. Please     update the reduced_phys_bits value used on the     commandline or in libvirt XML to the value 1 (explicitly     set now in QEMU code). (bsc#1103628)

  - Fix (again) the qemu guest agent udev rule file, which     got unfixed in a series of unfortunate events     (bsc#1094898 and now bsc#1105279)

This update was imported from the SUSE:SLE-15:Update update project.

This update for qemu fixes the following security issues :

CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735)

CVE-2018-11806: Prevent heap-based buffer overflow via incoming fragmented datagrams (bsc#1096223)

With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or information disclosure.

In addition this update backports support to passthrough the new md-clear CPU flag added in the intel-microcode update shipped in DSA 4447 to x86-based guests.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

  - An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display     driver. This flaw could occur while refreshing the VNC display surface area in the     'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
    (CVE-2017-2633)

  - Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows     local guest OS users to execute arbitrary code on the host via crafted multiboot header address values,     which trigger an out-of-bounds write. (CVE-2017-14167)

  - The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to     cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst     calculation. (CVE-2017-15289)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
    (CVE-2018-5683)

  - QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS     privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors     involving display update. (CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c. (CVE-2017-15268)

  - Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest     OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating VGA display. (CVE-2018-7858)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS     users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than     mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. (CVE-2018-7550)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in     QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count value) to the agent via the listening socket.
    (CVE-2018-12617)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing files on a shared host     directory. A privileged user inside guest could use this flaw to access host file system beyond the shared     folder and potentially escalating their privileges on a host. (CVE-2017-7471)

  - A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network     Block Device (NBD) client support. The flaw could occur while processing server's response to a     'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting     in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
    (CVE-2017-2630)

  - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
    (CVE-2017-10806)

  - The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by     leveraging use of qemu_map_ram_ptr to access guest ram block area. (CVE-2017-11334)

  - The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-     by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
    (CVE-2017-17381)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
    (CVE-2017-7493)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial     of service (infinite loop and CPU consumption) via the message ring page count. (CVE-2017-8112)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command processing. (CVE-2017-9503)

  - QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local     guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash)     by flushing an empty CDROM device drive. (CVE-2017-12809)

  - Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS users to obtain sensitive information from host heap memory via vectors related to reading     extended attributes. (CVE-2017-15038)

  - The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of     service issue. It could occur if a client sent large option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other     requests, resulting in DoS. (CVE-2017-15119)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-     of-bounds access. (CVE-2017-16845)

  - The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged     users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related     to negative pitch. (CVE-2017-18030)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash). (CVE-2017-18043)

  - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and stopping audio capture. (CVE-2017-8309)

  - Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large     keyboard events. (CVE-2017-8379)

  - Buffer overflow in the megasas_mmio_write function in Qemu 2.9.0 allows remote attackers to have     unspecified impact via unknown vectors. (CVE-2017-8380)

  - The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen     mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty     function. (CVE-2017-13673)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues: These security issue were fixed :

  - CVE-2018-3646: Systems with microprocessors utilizing     speculative execution and address translations may have     allowed unauthorized disclosure of information residing     in the L1 data cache to an attacker with local user     access with guest OS privilege via a terminal page fault     and a side-channel analysis (bsc#1091107, bsc#1027519).

  - CVE-2018-12617: An integer overflow that could cause a     segmentation fault in qmp_guest_file_read() with     g_malloc() in qemu-guest-agent was fixed (bsc#1098744)

  - CVE-2018-3665: System software utilizing Lazy FP state     restore technique on systems using Intel Core-based     microprocessors may potentially allow a local process to     infer data from another process through a speculative     execution side channel. (bsc#1095242)

  - CVE-2018-3639: Systems with microprocessors utilizing     speculative execution and speculative execution of     memory reads before the addresses of all prior memory     writes are known may allow unauthorized disclosure of     information to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4. (bsc#1092631)

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis. (bsc#1074562)

  - CVE-2017-5753: Systems with microprocessors utilizing     speculative execution and branch prediction may allow     unauthorized disclosure of information to an attacker     with local user access via a side-channel analysis.
    (bsc#1074562)

  - CVE-2017-5754: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis of the data cache. (bsc#1074562)

  - CVE-2018-12891: Certain PV MMU operations may take a     long time to process. For that reason Xen explicitly     checks for the need to preempt the current vCPU at     certain points. A few rarely taken code paths did bypass     such checks. By suitably enforcing the conditions     through its own page table contents, a malicious guest     may cause such bypasses to be used for an unbounded     number of iterations. A malicious or buggy PV guest may     cause a Denial of Service (DoS) affecting the entire     host. Specifically, it may prevent use of a physical CPU     for an indeterminate period of time. (bsc#1097521)

  - CVE-2018-12893: One of the fixes in XSA-260 added some     safety checks to help prevent Xen livelocking with debug     exceptions. Unfortunately, due to an oversight, at least     one of these safety checks can be triggered by a guest.
    A malicious PV guest can crash Xen, leading to a Denial     of Service. Only x86 PV guests can exploit the     vulnerability. x86 HVM and PVH guests cannot exploit the     vulnerability. An attacker needs to be able to control     hardware debugging facilities to exploit the     vulnerability, but such permissions are typically     available to unprivileged users. (bsc#1097522)

  - CVE-2018-11806: m_cat in slirp/mbuf.c in Qemu has a     heap-based buffer overflow via incoming fragmented     datagrams. (bsc#1096224)

  - CVE-2018-10982: An issue was discovered in Xen allowed     x86 HVM guest OS users to cause a denial of service     (unexpectedly high interrupt number, array overrun, and     hypervisor crash) or possibly gain hypervisor privileges     by setting up an HPET timer to deliver interrupts in     IO-APIC mode, aka vHPET interrupt injection.
    (bsc#1090822)

  - CVE-2018-10981: An issue was discovered in Xen that     allowed x86 HVM guest OS users to cause a denial of     service (host OS infinite loop) in situations where a     QEMU device model attempts to make invalid transitions     between states of a request. (bsc#1090823) Following     bugs were fixed :

  - After updating to kernel 3.0.101-0.47.106.32-xen system     crashes in check_bugs() (bsc#1097206)

  - bsc#1079730 - in xen-kmp, unplug emulated devices after     migration This is required since xen-4.10 and/or     qemu-2.10 because the state of unplug is not propagated     from one dom0 to another. Without this unplug qemu's     block-backend will be unable to open qcow2 disks on the     receiving dom0

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

These security issues were fixed :

  - CVE-2018-12617: qmp_guest_file_read had an integer     overflow that could have been exploited by sending a     crafted QMP command (including guest-file-read with a     large count value) to the agent via the listening socket     causing DoS (bsc#1098735).

  - CVE-2018-11806: Prevent heap-based buffer overflow via     incoming fragmented datagrams (bsc#1096223).

With this release the mitigations for Spectre v4 are moved the the patches from upstream (CVE-2018-3639, bsc#1092885).

This feature was added :

  - Add support for block resize support for disks through     the monitor (bsc#1094725).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for qemu fixes the following issues :

This security issue was fixed :

CVE-2018-12617: qmp_guest_file_read had an integer overflow that could have been exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket causing DoS (bsc#1098735)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were found in QEMU, a fast processor emulator :

CVE-2018-12617

The qmp_guest_file_read function (qga/commands-posix.c) is affected by an integer overflow and subsequent memory allocation failure. This weakness might be leveraged by remote attackers to cause denial of service (application crash).

CVE-2018-16872

The usb_mtp_get_object, usb_mtp_get_partial_object and usb_mtp_object_readdir functions (hw/usb/dev-mtp.c) are affected by a symlink attack. Remote attackers might leverage this vulnerability to perform information disclosure.

CVE-2019-6778

The tcp_emu function (slirp/tcp_subr.c) is affected by a heap buffer overflow caused by insufficient validation of available space in the sc_rcv->sb_data buffer. Remote attackers might leverage this flaw to cause denial of service, or any other unspecified impact.

For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u10.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow issue was found in the NE200 NIC     emulation. It could occur while receiving packets from     the network, if the size value was greater than     INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process, resulting in DoS scenario.
    (CVE-2018-10839)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - Qemu before version 2.9 is vulnerable to an improper     link following when built with the VirtFS. A privileged     user inside guest could use this flaw to access host     file system beyond the shared folder and potentially     escalating their privileges on a host. (CVE-2016-9602)

  - Quick Emulator (QEMU), compiled with the PC System     Emulator with multiboot feature support, is vulnerable     to an OOB r/w memory access issue. The issue could     occur while loading a kernel image during the guest     boot, if mh_load_end_addr address is greater than the     mh_bss_end_addr address. A user or process could use     this flaw to potentially achieve arbitrary code     execution on a host.(CVE-2018-7550)

  - An out-of-bounds read access issue was found in the VGA     display emulator built into the Quick emulator (QEMU).
    It could occur while reading VGA memory to update     graphics display. A privileged user/process inside     guest could use this flaw to crash the QEMU process on     the host resulting in denial of service     situation.(CVE-2017-13672)

  - An assert failure issue was found in the VGA display     emulator built into the Quick emulator (QEMU). It could     occur while updating graphics display, due to     miscalculating region for dirty bitmap snapshot in     split screen mode. A privileged user/process inside     guest could use this flaw to crash the QEMU process on     the host resulting in denial of service.
    (CVE-2017-13673)

  - The Network Block Device (NBD) server in Quick Emulator     (QEMU), is vulnerable to a denial of service issue. It     could occur if a client sent large option requests,     making the server waste CPU time on reading up to 4GB     per request. A client could use this flaw to keep the     NBD server from serving other requests, resulting in     DoS.(CVE-2017-15119)

  - QEMU (aka Quick Emulator) before 2.9.0, when built with     the USB OHCI Emulation support, allows local guest OS     users to cause a denial of service (infinite loop) by     leveraging an incorrect return value, a different     vulnerability than CVE-2017-6505.(CVE-2017-9330)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick     Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash). (CVE-2017-18043)

  - VNC server implementation in Quick Emulator (QEMU) was     found to be vulnerable to an unbounded memory     allocation issue, as it did not throttle the     framebuffer updates sent to its client. If the client     did not consume these updates, VNC server allocates     growing memory to hold onto this data. A malicious     remote VNC client could use this flaw to cause DoS to     the server host.(CVE-2017-15124)

  - A memory leakage issue was found in the I/O channels     websockets implementation of the Quick Emulator (QEMU).
    It could occur while sending screen updates to a     client, which is slow to read and process them further.
    A privileged guest user could use this flaw to cause a     denial of service on the host and/or potentially crash     the QEMU process instance on the host.(CVE-2017-15268)

  - Quick Emulator (QEMU), compiled with the PC System     Emulator with multiboot feature support, is vulnerable     to an OOB r/w memory access issue. The issue could     occur due to an integer overflow while loading a kernel     image during a guest boot. A user or process could use     this flaw to potentially achieve arbitrary code     execution on a host.(CVE-2017-14167)

  - Memory leak in QEMU (aka Quick Emulator), when built     with IDE AHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the AHCI     device.(CVE-2017-9373)

  - Memory leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)

  - ** DISPUTED ** The disas_insn function in     target/i386/translate.c in QEMU before 2.9.0, when TCG     mode without hardware acceleration is used, does not     limit the instruction size, which allows local users to     gain privileges by creating a modified basic block that     injects code into a setuid program, as demonstrated by     procmail. NOTE: the vendor has stated 'this bug does     not violate any security guarantees QEMU     makes.'(CVE-2017-8284)

  - Memory leak in the keyboard input event handlers     support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host     memory consumption) by rapidly generating large     keyboard events.(CVE-2017-8379)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the pxa2xx_ssp_load function in     hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote     attackers to cause a denial of service or possibly     execute arbitrary code via a crafted s-i1/4zrx_level     value in a savevm image.(CVE-2013-4533)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD)     list. (CVE-2015-8558)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure     to define the .write method. (CVE-2015-7549)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for xen fixes the following issues: Security issues fixed :

  - CVE-2018-12617: Fix integer overflow that causes     segmentation fault in qmp_guest_file_read() with     g_malloc() (bsc#1098744).

  - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267)     (bsc#1095242).

  - CVE-2018-11806: Fix heap buffer overflow while     reassembling fragmented datagrams (bsc#1096224).

  - CVE-2018-12891: Fix possible Denial of Service (DoS) via     certain PV MMU operations that affect the entire host     (XSA-264) (bsc#1097521).

  - CVE-2018-12893: Fix crash/Denial of Service (DoS) via     safety check (XSA-265) (bsc#1097522). Bug fixes :

  - bsc#1079730: Fix failed 'write' lock.

  - bsc#1027519: Add upstream patches from January.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
147523	EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-1632)	Nessus	Huawei Local Security Checks	2021/3/10	2022/5/10	high
117386	SUSE SLES11 Security Update : kvm (SUSE-SU-2018:2650-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/9/10	2024/8/8	high
117475	openSUSE Security Update : qemu (openSUSE-2018-996)	Nessus	SuSE Local Security Checks	2018/9/13	2024/8/8	high
112201	SUSE SLES12 Security Update : qemu (SUSE-SU-2018:2556-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/8/31	2024/8/13	high
125609	Debian DSA-4454-1 : qemu - security update	Nessus	Debian Local Security Checks	2019/5/31	2024/5/17	high
112287	SUSE SLES11 Security Update : kvm (SUSE-SU-2018:2615-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/9/5	2024/8/12	high
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2023/9/8	critical
112147	SUSE SLES11 Security Update : xen (SUSE-SU-2018:2528-1) (Foreshadow) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/8/28	2024/8/14	high
118870	openSUSE Security Update : qemu (openSUSE-2018-1364) (Spectre)	Nessus	SuSE Local Security Checks	2018/11/11	2024/7/24	high
120094	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:2679-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	high
122511	Debian DLA-1694-1 : qemu security update	Nessus	Debian Local Security Checks	2019/3/1	2021/1/11	high
123294	openSUSE Security Update : qemu (openSUSE-2019-683)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/11	high
124908	EulerOS Virtualization for ARM 64 3.0.1.0 : qemu-kvm (EulerOS-SA-2019-1405)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high
129182	EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-1988)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	high
147700	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667)	Nessus	Huawei Local Security Checks	2021/3/11	2022/5/10	high
198718	RHEL 6 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/12	critical
198727	RHEL 7 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/12	critical
111261	SUSE SLES11 Security Update : xen (SUSE-SU-2018:2037-1)	Nessus	SuSE Local Security Checks	2018/7/24	2024/9/3	high

偵測

搜尋 Plugin

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

critical

critical

high