The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0775 advisory.

    - Resolves: bz#1734747       (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
    - Resolves: bz#1749731       (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2020-1711: Fixed a potential OOB access in the iSCSI client code (bsc#1166240).

CVE-2019-12068: Fixed a potential DoS in the LSI SCSI controller emulation (bsc#1146873).

CVE-2020-1983: Fixed a use-after-free in the ip_reass function of slirp (bsc#1170940).

CVE-2020-8608: Fixed a potential OOB access in slirp (bsc#1163018).

CVE-2020-7039: Fixed a potential OOB access in slirp (bsc#1161066).

CVE-2019-15890: Fixed a use-after-free during packet reassembly in slirp (bsc#1149811).

Fixed multiple potential DoS issues in SLIRP, similar to CVE-2019-6778 (bsc#1123156).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. (CVE-2018-20126 bsc#1119991, CVE-2019-14378 bsc#1143794, and CVE-2019-15890 bsc#1149811 respectively)

Security issues fixed :

CVE-2019-12068: Fixed potential DOS in lsi scsi controller emulation (bsc#1146873)

CVE-2019-11135: Expose taa-no 'feature', indicating CPU does not have the TSX Async Abort vulnerability. (bsc#1152506)

CVE-2018-12207: Expose pschange-mc-no 'feature', indicating CPU does not have the page size change machine check vulnerability (bsc#1117665)

Other issues fixed: Change how this bug gets fixed (bsc#1144087)

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0. (bsc#1079730, bsc#1098403, bsc#1111025, bsc#1145427, bsc#1145774)

Feature support for vfio-ccw dasd ipl (bsc#1145379 jira-SLE-6132)

Additional hardware instruction support for s390, also update qemu linux headers to 5.2-rc1 (bsc#1145436 jira-SLE-6237)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

qemu was updated to v3.1.1.1, a stable, bug-fix-only release, which includes 2 fixes we already carry, as well as one additional use- after-free fix in slirp. (CVE-2018-20126 bsc#1119991, CVE-2019-14378 bsc#1143794, and CVE-2019-15890 bsc#1149811 respectively)

Security issues fixed :

  - CVE-2019-12068: Fixed potential DOS in lsi scsi     controller emulation (bsc#1146873)

  - CVE-2019-11135: Expose taa-no 'feature', indicating CPU     does not have the TSX Async Abort vulnerability.
    (bsc#1152506)

  - CVE-2018-12207: Expose pschange-mc-no 'feature',     indicating CPU does not have the page size change     machine check vulnerability (bsc#1117665)

Other issues fixed :

  - Change how this bug gets fixed (bsc#1144087)

  - Disable file locking in the Xen PV disk backend to avoid     locking issues with PV domUs during migration. The     issues triggered by the locking can not be properly     handled in libxl. The locking introduced in qemu-2.10     was removed again in qemu-4.0. (bsc#1079730,     bsc#1098403, bsc#1111025, bsc#1145427, bsc#1145774)

  - Feature support for vfio-ccw dasd ipl (bsc#1145379     jira-SLE-6132)

  - Additional hardware instruction support for s390, also     update qemu linux headers to 5.2-rc1 (bsc#1145436     jira-SLE-6237)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-078:02 advisory.

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)
      * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)
      * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_0348 advisory.

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

CVE-2018-12207: Fixed a race condition where untrusted virtual machines could have been using the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional (bsc#1155945 XSA-304).

CVE-2018-19965: Fixed a DoS from attempting to use INVPCID with a non-canonical addresses (bsc#1115045 XSA-279).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate side-channel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack. (bsc#1152497 XSA-305).

CVE-2019-12067: Fixed a NULL pointer dereference in QEMU AHCI (bsc#1145652).

CVE-2019-12068: Fixed an infinite loop while executing script (bsc#1146874).

CVE-2019-12155: Fixed a NULL pointer dereference while releasing spice resources (bsc#1135905).

CVE-2019-14378: Fixed a heap buffer overflow during packet reassembly in slirp networking implementation (bsc#1143797).

CVE-2019-15890: Fixed a use-after-free during packet reassembly (bsc#1149813).

CVE-2019-17340: Fixed grant table transfer issues on large hosts (XSA-284 bsc#1126140).

CVE-2019-17341: Fixed a race with pass-through device hotplug (XSA-285 bsc#1126141).

CVE-2019-17342: Fixed steal_page violating page_struct access discipline (XSA-287 bsc#1126192).

CVE-2019-17343: Fixed an inconsistent PV IOMMU discipline (XSA-288 bsc#1126195).

CVE-2019-17344: Fixed a missing preemption in x86 PV page table unvalidation (XSA-290 bsc#1126196).

CVE-2019-17347: Fixed a PV kernel context switch corruption (XSA-293 bsc#1126201).

CVE-2019-18420: Fixed a hypervisor crash that could be caused by malicious x86 PV guests, resulting in a denial of service (bsc#1154448 XSA-296).

CVE-2019-18421: Fixed a privilege escalation through malicious PV guest administrators (bsc#1154458 XSA-299).

CVE-2019-18424: Fixed a privilege escalation through DMA to physical devices by untrusted domains (bsc#1154461 XSA-302).

CVE-2019-18425: Fixed a privilege escalation from 32-bit PV guest used mode (bsc#1154456 XSA-298).

CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311).

CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309).

CVE-2019-19579: Fixed a privilege escalation where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306).

CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310).

CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307).

CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest, leading to a guest denial of service (bsc#1158004 XSA-308).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the qemu-kvm-6.1.0-3.el9 build changelog.

  - use-after-free during packet reassembly [rhel-av-8]) (CVE-2019-15890)

  - A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation     process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could     obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all     programs running on QEMU. (CVE-2020-10702)

  - A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of     the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via     virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a     denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the     host. (CVE-2020-10717)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before     QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary     of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server     resulting in a denial of service. (CVE-2020-10761)

  - out-of-bounds r/w access issue while processing usb packets [rhel-av-8.3.0]) (CVE-2020-14364)

  - OOB heap access via an unexpected response of iSCSI Server [rhel-av-8.2.0]) (CVE-2020-1711)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-av-8.2.0]) (CVE-2020-7039)

  - potential OOB access due to unsafe snprintf() usages [rhel-av-8.2.0]) (CVE-2020-8608)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Fix out-of-bounds access issue while doing multi block SDMA (CVE-2020-25085, bsc#1176681)

Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)

QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)

Change dependency from CONFIG_VFIO back to CONFIG_LINUX (bsc#1179725)

For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues:
(CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1894-1 advisory.

    - Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
    - Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
    - Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)
    - For the record, these issues are fixed in this package already.
      Most are alternate references to previously mentioned issues:
      (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019,       CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683,       CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477,       CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975,       bsc#1094725)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0119 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-12130:
    Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf

    CVE-2018-13405:
    The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID.

    CVE-2019-10132:
    A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket     systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using     virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and     virtlogd daemons.

    CVE-2019-10161:
    It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to     probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary     programs.

    CVE-2019-10166:
    It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit     readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed     save state files. If a managed save had already been created by a privileged user, a local attacker could     modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

    CVE-2019-10167:
    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an emulatorbin argument to specify the program providing emulation for a domain. Since v1.2.19,     libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an     arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own     privileges.

    CVE-2019-10168:
    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before     4.10.1 and 5.x.x before 5.4.1, accept an emulator argument to specify the program providing emulation     for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-     only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted     executable with its own privileges.

    CVE-2019-11135:
    TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access.

    CVE-2019-12155:
    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-14842:
    Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.
    A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did     not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data     under control of the server is written to memory before the read buffer supplied by the client. If the     read buffer is located on the stack then this allows the stack return address from nbd_pread() to be     trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is     located on the heap then other memory objects before the buffer can be overwritten, which again would     usually lead to arbitrary code execution.

    CVE-2019-15890:
    libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

    CVE-2019-20485:
    qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage).

    CVE-2019-6501:
    In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read     operations.

    CVE-2019-6778:
    In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

    CVE-2020-10703:
    A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2020-11947:
    iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose     unrelated information from process memory to an attacker.

    CVE-2020-14301:
    An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.

    CVE-2020-14339:
    A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability.

    CVE-2020-14364:
    An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host.

    CVE-2020-15859:
    QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address.

    CVE-2020-16092:
    In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c.

    CVE-2020-1711:
    An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions     2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical     Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the     QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of     the QEMU process on the host.

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-25637:
    A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability.

    CVE-2020-25723:
    A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service.

    CVE-2020-27821:
    A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0.

    CVE-2020-28916:
    hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.

    CVE-2020-29130:
    slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length.

    CVE-2020-29443:
    ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2021-20257:
    An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability.

    CVE-2021-3592:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the bootp_input() function and could occur while processing a udp packet that is smaller than     the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of     uninitialized heap memory from the host. The highest threat from this vulnerability is to data     confidentiality. This flaw affects libslirp versions prior to 4.6.0.

    CVE-2021-3593:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3594:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3631:
    A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

    CVE-2021-3667:
    An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability.

    CVE-2021-3930:
    An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issue fixed: Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration (bsc#1133818).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
134388	Oracle Linux 6 : qemu-kvm (ELSA-2020-0775)	Nessus	Oracle Linux Local Security Checks	2020/3/11	2024/10/22	high
137577	SUSE SLES12 Security Update : qemu (SUSE-SU-2020:1514-1)	Nessus	SuSE Local Security Checks	2020/6/18	2024/3/6	high
130953	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2955-1)	Nessus	SuSE Local Security Checks	2019/11/13	2024/4/11	high
131064	openSUSE Security Update : qemu (openSUSE-2019-2510)	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	high
294386	MiracleLinux 4 : qemu-kvm-0.12.1.2-2.506.6.0.1.AXS4 (AXSA:2020-078:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
354660	Rocky Linux 8 [CIQ] Security Update: cockpit-podman / container-selinux / containernetworking-plugins / etc Multiple Vulnerabilities (crlsa-2020_0348)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium
133763	SUSE SLES12 Security Update : xen (SUSE-SU-2020:0388-1)	Nessus	SuSE Local Security Checks	2020/2/18	2024/3/27	critical
191255	CentOS 9 : qemu-kvm-6.1.0-3.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
150220	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1837-1)	Nessus	SuSE Local Security Checks	2021/6/3	2023/12/27	medium
150399	SUSE SLES12: qemu / qemu-arm / qemu-block-curl / qemu-block-iscsi / etc (SUSE-SU-2021:1894-1)	Nessus	SuSE Local Security Checks	2021/6/9	2026/6/25	medium
236436	Alibaba Cloud Linux 3 : 0119: virt:rhel and virt-devel:rhel (ALINUX3-SA-2022:0119)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	critical
130253	SUSE SLES12 Security Update : xen (SUSE-SU-2019:2769-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	2019/10/25	2022/12/5	high

偵測

搜尋 Plugin

high

high

high

high

high

medium

critical

high

medium

medium

critical

high