According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - A use-after-free issue was found in the Slirp     networking implementation of the Quick emulator (QEMU).
    It occurs when a Socket referenced from multiple     packets is freed while responding to a message. A     user/process could use this flaw to crash the QEMU     process on the host resulting in denial of     service.(CVE-2017-13711)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - A heap buffer overflow issue was found in the way SLiRP     networking back-end in QEMU processes fragmented     packets. It could occur while reassembling the     fragmented datagrams of an incoming packet. A     privileged user/process inside guest could use this     flaw to crash the QEMU process resulting in DoS or     potentially leverage it to execute arbitrary code on     the host with privileges of the QEMU     process.(CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - An integer overflow issue was found in the RTL8139 NIC     emulation in QEMU. It could occur while receiving     packets over the network if the size value is greater     than INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process, resulting in DoS     scenario.(CVE-2018-17958)

  - An integer overflow issue was found in the AMD PC-Net     II NIC emulation in QEMU. It could occur while     receiving packets, if the size value was greater than     INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process resulting in     DoS.(CVE-2018-17962)

  - A heap buffer overflow issue was found in the     load_device_tree() function of QEMU, which is invoked     to load a device tree blob at boot time. It occurs due     to device tree size manipulation before buffer     allocation, which could overflow a signed int type. A     user/process could use this flaw to potentially execute     arbitrary code on a host system with privileges of the     QEMU process.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     3.1.x through 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not     ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the     IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the ip_reass() routine while     reassembling incoming packets if the first fragment is     bigger than the m->m_dat[] buffer. An attacker could     use this flaw to crash the QEMU process on the host,     resulting in a Denial of Service or potentially     executing arbitrary code with privileges of the QEMU     process.(CVE-2019-14378)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure.(CVE-2020-10756)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the tcp_emu() routine while emulating     IRC and other protocols. An attacker could use this     flaw to crash the QEMU process on the host, resulting     in a denial of service or potential execution of     arbitrary code with privileges of the QEMU     process.(CVE-2020-7039)

  - An out-of-bound write access flaw was found in the way     QEMU loads ROM contents at boot time. This flaw occurs     in the rom_copy() routine while loading the contents of     a 32-bit -kernel image into memory. Running an     untrusted -kernel image may load contents at arbitrary     memory locations, potentially leading to code execution     with the privileges of the QEMU     process.(CVE-2020-13765)

  - A use-after-free flaw was found in the USB(xHCI/eHCI)     controller emulators of QEMU. This flaw occurs while     setting up the USB packet as a usb_packet_map() routine     and returns an error that was not checked. This flaw     allows a guest user or process to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-25084)

  - An infinite loop flaw was found in the USB OHCI     controller emulator of QEMU. This flaw occurs while     servicing OHCI isochronous transfer descriptors (TD) in     the ohci_service_iso_td routine, as it retires a TD if     it has passed its time frame. It does not check if the     TD was already processed and holds an error code in     TD_CC. This issue may happen if the TD list has a loop.
    This flaw allows a guest user or process to consume CPU     cycles on the host, resulting in a denial of     service.(CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - A potential directory traversal issue was found in the     tftp server of the SLiRP user-mode networking     implementation used by QEMU. It could occur on a     Windows host, as it allows the use of both forward     ('/') and backward slash('\') tokens as separators in a     file path. A user able to access the tftp server could     use this flaw to access undue files by using relative     paths.(CVE-2020-7211)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386)

Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Apply fixes to qemu scsi passthrough with respect to timeout and error conditions, including using more correct status codes. (bsc#1178049)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Use '%service_del_postun_without_restart' instead of '%service_del_postun' to avoid 'Failed to try-restart qemu-ga@.service' error while updating the qemu-guest-agent.
(bsc#1178565)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Drop the 'ampersand 0x25 shift altgr' line in pt-br keymap file (bsc#1129962)

Fix migration failure with error message: 'error while loading state section id 3(ram) (bsc#1154790)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Use '%service_del_postun_without_restart' instead of '%service_del_postun' to avoid 'Failed to try-restart qemu-ga@.service' error while updating the qemu-guest-agent.
(bsc#1178565)

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8412-1 advisory.

    Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU     incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

    It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations,     leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive     information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

    Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local     attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

    Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an     infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2020-14394)

    Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-15469)

    Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-     free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

    Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

    Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in     a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-17380)

    Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that the USB xHCI controller     implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

    Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU     contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-25624)

    It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An     attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

    Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures,     leading to a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU     to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25723)

    Gaoning Pan discovered that the network device emulation in QEMU could be made to trigger an assertion     failure when processing packets that lacked a valid layer 3 protocol. An attacker inside the guest could     possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-27617)

    Wenxiang Qian discovered that the ATAPI emulation in QEMU did not properly validate a buffer index,     leading to an out-of-bounds read. An attacker inside the guest could possibly use this issue to expose     sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-29443)

    Cheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)

    Cheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation in QEMU contained a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-35505)

    It was discovered that the SDHCI controller emulation in QEMU contained out-of-bounds read and write     issues. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3409)

    It was discovered that several network device emulations in QEMU contained an infinite loop when operating     in loopback mode. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2021-3416)

    Alexander Bulekov discovered that the floppy disk emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to expose sensitive information or     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3507)

    Remy Noel discovered that the USB redirector device emulation in QEMU performed an unbounded stack     allocation when combining USB packets. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu     16.04 LTS. (CVE-2021-3527)

    It was discovered that the QXL display device emulation in QEMU contained an integer overflow, leading to     a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)

    It was discovered that the QXL display device emulation in QEMU performed a double fetch of guest-     controlled values, leading to a heap-based buffer overflow. An attacker inside the guest could possibly     use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4207)

    It was discovered that the 9pfs server implementation in QEMU contained a race condition, leading to a     use-after-free. A malicious 9p client could possibly use this issue to escalate privileges. This issue     only affected Ubuntu 14.04 LTS. (CVE-2021-20181)

    Gaoning Pan discovered that the floppy disk emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)

    Gaoning Pan discovered that the vmxnet3 network device emulation in QEMU contained an integer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20203)

    It was discovered that the ARM Generic Interrupt Controller emulation in QEMU contained an out-of-bounds     heap access. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20221)

    Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered     that the e1000 network device emulation in QEMU contained an infinite loop. An attacker inside the guest     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20257)

    It was discovered that the 9p passthrough file system implementation in QEMU did not prevent opening     special files on the host. A malicious guest could possibly use this issue to escape the exported 9p tree.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-2861)

    It was discovered that the virtio crypto device emulation in QEMU did not properly validate certain buffer     lengths, leading to a heap buffer overflow. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 18.04 LTS. (CVE-2023-3180)

    It was discovered that the built-in VNC server in QEMU contained a NULL pointer dereference when cleaning     up a connection that failed during the handshake. A remote attacker could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2023-3354)

    It was discovered that QEMU could incorrectly direct a guest I/O operation to disk offset 0 instead of the     intended offset. An attacker inside the guest could possibly use this issue to read or overwrite sensitive     data, potentially gaining control of the host. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04     LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)

    It was discovered that several virtio device emulations in QEMU did not properly guard against DMA     reentrancy, leading to a double free. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-3446)

    It was discovered that the SDHCI device emulation in QEMU contained a heap- based buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-3447)

    It was discovered that the QEMU disk image utility (qemu-img) did not properly handle certain crafted     image files. An attacker could possibly use this issue to cause qemu-img to consume excessive resources or     access an unintended external file, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS. (CVE-2024-4467)

    Cyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter emulation in QEMU contained a use-     after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519)

    It was discovered that the NBD server in QEMU contained an improper synchronization issue during socket     closure. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-7409)

    It was discovered that the USB emulation in QEMU contained a reachable assertion. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2024-8354)

    It was discovered that QEMU incorrectly handled resources during the VNC WebSocket handshake, leading to a     use-after-free. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-11234)

    It was discovered that QEMU could be made to read out of bounds when reading VMDK images. An attacker     could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a     denial of service. (CVE-2026-2243)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
151383	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2021-2166)	Nessus	Huawei Local Security Checks	2021/7/6	2023/12/11	critical
148752	SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1245-1)	Nessus	SuSE Local Security Checks	2021/4/19	2024/1/4	high
148757	SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1244-1)	Nessus	SuSE Local Security Checks	2021/4/19	2024/1/3	high
320399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-8412-1)	Nessus	Ubuntu Local Security Checks	2026/6/11	2026/6/11	high

偵測

搜尋 Plugin

critical

high

high

high