The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0816 advisory.

    - Resolves: bz#1518711       (CVE-2017-15268 qemu-kvm: Qemu: I/O: potential memory exhaustion via websock connection to VNC     [rhel-7.5])
    - Resolves: bz#1527405       (CVE-2017-15124 qemu-kvm: Qemu: memory exhaustion through framebuffer update request message in VNC     server [rhel-7.5])
    - Resolves: bz#1534691       (CVE-2018-5683 qemu-kvm: Qemu: Out-of-bounds read in vga_draw_text routine [rhel-7.5])
    - kvm-target-i386-cpu-add-new-CPUID-bits-for-indirect-bran.patch [CVE-2017-5715]
    - kvm-target-i386-add-support-for-SPEC_CTRL-MSR.patch [CVE-2017-5715]
    - kvm-target-i386-cpu-add-new-CPU-models-for-indirect-bran.patch [CVE-2017-5715]
    - Resolves: bz#1508745       (CVE-2017-13711 qemu-kvm: Qemu: Slirp: use-after-free when sending response [rhel-7.5])
    - Resolves: bz#1501121       (CVE-2017-14167 qemu-kvm: Qemu: i386: multiboot OOB access while loading kernel image [rhel-7.5])
    - Resolves: bz#1501295       (CVE-2017-15289 qemu-kvm: Qemu: cirrus: OOB access issue in  mode4and5 write functions [rhel-7.5])
    - Resolves: bz#1486642       (CVE-2017-13672 qemu-kvm: Qemu: vga: OOB read access during display update [rhel-7.5])
    - Resolves: bz#1466463       (CVE-2017-10664 qemu-kvm: Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [rhel-7.5])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for qemu-kvm is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es) :

* Qemu: vga: OOB read access during display update (CVE-2017-13672)

* Qemu: Slirp: use-after-free when sending response (CVE-2017-13711)

* Qemu: memory exhaustion through framebuffer update request message in VNC server (CVE-2017-15124)

* Qemu: I/O: potential memory exhaustion via websock connection to VNC (CVE-2017-15268)

* Qemu: Out-of-bounds read in vga_draw_text routine (CVE-2018-5683)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank David Buchanan for reporting CVE-2017-13672; Wjjzhang (Tencent.com) for reporting CVE-2017-13711;
and Jiang Xin and Lin ZheCheng for reporting CVE-2018-5683. The CVE-2017-15124 issue was discovered by Daniel Berrange (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2655:03 advisory.

    * Qemu: vga: OOB read access during display update (CVE-2017-13672)
    * Qemu: Slirp: use-after-free when sending response (CVE-2017-13711)
    * Qemu: memory exhaustion through framebuffer update request message in VNC server (CVE-2017-15124)
    * Qemu: I/O: potential memory exhaustion via websock connection to VNC (CVE-2017-15268)
    * Qemu: Out-of-bounds read in vga_draw_text routine (CVE-2018-5683)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1113 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * The Network Block Device (NBD) server in Quick Emulator (QEMU), is vulnerable to a denial of service     issue. It could occur if a client sent large option requests, making the server waste CPU time on reading     up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests,     resulting in DoS. (CVE-2017-15119)

    * Qemu: vga: OOB read access during display update (CVE-2017-13672)

    * Qemu: vga: reachable assert failure during display update (CVE-2017-13673)

    * Qemu: Slirp: use-after-free when sending response (CVE-2017-13711)

    * VNC server implementation in Quick Emulator (QEMU) was found to be vulnerable to an unbounded memory     allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not     consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC     client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank David Buchanan for reporting CVE-2017-13672 and CVE-2017-13673 and Wjjzhang     (Tencent.com) for reporting CVE-2017-13711. The CVE-2017-15119 issue was discovered by Eric Blake (Red     Hat) and the CVE-2017-15124 issue was discovered by Daniel Berrange (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4285 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were found in qemu, a fast processor emulator :

  - CVE-2017-9375     Denial of service via memory leak in USB XHCI emulation.

  - CVE-2017-12809     Denial of service in the CDROM device drive emulation.

  - CVE-2017-13672     Denial of service in VGA display emulation.

  - CVE-2017-13711     Denial of service in SLIRP networking support.

  - CVE-2017-14167     Incorrect validation of multiboot headers could result     in the execution of arbitrary code.

According to the versions of the qemu-kvm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - QEMU (aka Quick Emulator), when built with the VGA     display emulator support, allows local guest OS     privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     involving display update.(CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU)     2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to     cause DoS to the server host.(CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a     memory leak by triggering slow data-channel read     operations, related to     io/channel-websock.c.(CVE-2017-15268)

  - The vga_draw_text function in Qemu allows local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address     validation.(CVE-2018-5683)

  - Quick Emulator (aka QEMU), when built with the Cirrus     CLGD 54xx VGA Emulator support, allows local guest OS     privileged users to cause a denial of service     (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating     VGA display.(CVE-2018-7858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An out-of-bounds read access issue was found in the VGA display emulator built into the Quick emulator (QEMU). It could occur while reading VGA memory to update graphics display. A privileged user/process inside guest could use this flaw to crash the QEMU process on the host resulting in denial of service situation.(CVE-2017-13672)

A memory leakage issue was found in the I/O channels websockets implementation of the Quick Emulator (QEMU). It could occur while sending screen updates to a client, which is slow to read and process them further. A privileged guest user could use this flaw to cause a denial of service on the host and/or potentially crash the QEMU process instance on the host.(CVE-2017-15268)

A use-after-free issue was found in the Slirp networking implementation of the Quick emulator (QEMU). It occurs when a Socket referenced from multiple packets is freed while responding to a message. A user/process could use this flaw to crash the QEMU process on the host resulting in denial of service.(CVE-2017-13711 )

Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.(CVE-2018-7858)

VNC server implementation in Quick Emulator (QEMU) was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.(CVE-2017-15124)

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.(CVE-2018-3639)

An out-of-bounds read access issue was found in the VGA emulator of QEMU. It could occur in vga_draw_text routine, while updating display area for a vnc client. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS.(CVE-2018-5683)

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - QEMU (aka Quick Emulator), when built with the VGA     display emulator support, allows local guest OS     privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     involving display update.(CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU)     2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to     cause DoS to the server host.(CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a     memory leak by triggering slow data-channel read     operations, related to     io/channel-websock.c.(CVE-2017-15268)

  - The vga_draw_text function in Qemu allows local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address     validation.(CVE-2018-5683)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load i1/4+ Store instructions (a commonly     used performance optimization). It relies on the     presence of a precisely-defined instruction sequence in     the privileged code as well as the fact that memory     read from address to which a recent memory write has     occurred may see an older value and subsequently cause     an update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639)

  - Quick Emulator (aka QEMU), when built with the Cirrus     CLGD 54xx VGA Emulator support, allows local guest OS     privileged users to cause a denial of service     (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating     VGA display.(CVE-2018-7858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4585 advisory.

    - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann)  [Orabug: 29216656]  {CVE-2018-16872}
    - pvrdma: add uar_read routine (Prasad J Pandit)  [Orabug: 29216658]  {CVE-2018-20191}
    - pvrdma: release ring object in case of an error (Prasad J Pandit)  [Orabug: 29216659]  {CVE-2018-20126}
    - pvrdma: check number of pages when creating rings (Prasad J Pandit)  [Orabug: 29216666]     {CVE-2018-20125}
    - pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit)  [Orabug: 29216672]     {CVE-2018-20216}
    - rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
    - rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 29212424]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746}     {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849}     {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu to version 2.9.1 fixes several issues.

It also announces that the qed storage format will be no longer supported in Leap 15.0.

These security issues were fixed :

  - CVE-2017-15268: Qemu allowed remote attackers to cause a     memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c     (bsc#1062942)

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063122)

  - CVE-2017-15038: Race condition in the v9fs_xattrwalk     function local guest OS users to obtain sensitive     information from host heap memory via vectors related to     reading extended attributes (bsc#1062069)

  - CVE-2017-10911: The make_response function in the Linux     kernel allowed guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures (bsc#1057378)

  - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator     support allowed local guest OS privileged users to cause     a denial of service (NULL pointer dereference and QEMU     process crash) by flushing an empty CDROM device drive     (bsc#1054724)

  - CVE-2017-14167: Integer overflow in the load_multiboot     function allowed local guest OS users to execute     arbitrary code on the host via crafted multiboot header     address values, which trigger an out-of-bounds write     (bsc#1057585)

  - CVE-2017-13672: The VGA display emulator support allowed     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update (bsc#1056334)

  - CVE-2017-13711: Use-after-free vulnerability allowed     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets (bsc#1056291).

These non-security issues were fixed :

  - Fixed not being able to build from rpm sources due to     undefined macro (bsc#1057966)

  - Fiedx package build failure against new glibc     (bsc#1055587)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Memory leak in hw/audio/es1370.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5526)

  - Memory leak in hw/audio/ac97.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5525)

  - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors related to     control transfer descriptor sequence.(CVE-2017-5973)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     OS guest privileged users to cause a denial of service     (infinite loop and QEMU process crash) via vectors     involving the transfer mode register during multi block     transfer.(CVE-2017-5987)

  - Memory leak in the megasas_handle_dcmd function in     hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption) via MegaRAID Firmware     Interface (MFI) commands with the sglist size set to a     value over 2 Gb.(CVE-2017-5856)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - Quick Emulator (Qemu) built with the VirtFS, host     directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It     could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this     flaw to escalate their privileges inside     guest.(CVE-2017-7493)

  - In QEMU 3.1.0, load_device_tree in device_tree.c calls     the deprecated load_image function, which has a buffer     overflow risk.(CVE-2018-20815)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)     allows local guest OS privileged users to cause a     denial of service (infinite loop and CPU consumption)     via the message ring page count.(CVE-2017-8112)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - TSX Asynchronous Abort condition on some CPUs utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6,     1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1,     1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12     (fixed), when executing script in lsi_execute_script(),     the LSI scsi adapter emulator advances 's->dsp' index     to read next opcode. This can lead to an infinite loop     if the next opcode is empty. Move the existing loop     exit after 10k iterations so that it covers no-op     opcodes as well.(CVE-2019-12068)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - Qemu has a Buffer Overflow in pcnet_receive in     hw/net/pcnet.c because an incorrect integer data type     is used.(CVE-2018-17962)

  - Quick Emulator(Qemu) built with the VMWARE PVSCSI     paravirtual SCSI bus emulation support is vulnerable to     an OOB r/w access issue. It could occur while     processing SCSI commands 'PVSCSI_CMD_SETUP_RINGS' or     'PVSCSI_CMD_SETUP_MSG_RING'. A privileged user inside     guest could use this flaw to crash the Qemu process     resulting in DoS.(CVE-2016-4952)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer     overflow via incoming fragmented     datagrams.(CVE-2018-11806)

  - In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c     allows out-of-bounds access by triggering an invalid     msg_len value.(CVE-2018-18849)

  - hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an     fid path while it is being accessed by a second thread,     leading to (for example) a use-after-free     outcome.(CVE-2018-19364)

  - v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS     users to cause a denial of service (crash) because of a     race condition during file renaming.(CVE-2018-19489)

  - QEMU, through version 2.10 and through version 3.1.0,     is vulnerable to an out-of-bounds read of up to 128     bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A     local attacker with permission to execute i2c commands     could exploit this to read stack memory of the qemu     process on the host.(CVE-2019-3812)

  - A flaw was found in QEMU's Media Transfer Protocol     (MTP). The code opening files in usb_mtp_get_object and     usb_mtp_get_partial_object and directories in     usb_mtp_object_readdir doesn't consider that the     underlying filesystem may have changed since the time     lstat(2) was called in usb_mtp_object_alloc, a     classical TOCTTOU problem. An attacker with write     access to the host filesystem, shared with a guest, can     use this property to navigate the host filesystem in     the context of the QEMU process and read any file the     QEMU process has access to. Access to the filesystem     may be local or via a network share protocol such as     CIFS.(CVE-2018-16872)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - Quick Emulator (QEMU) built with Network Block Device     (NBD) Server support was vulnerable to a null-pointer     dereference issue. The flaw could occur when releasing     a client that was not initialized due to failed     negotiation. A remote user or process could exploit     this flaw to crash the qemu-nbd server (denial of     service).(CVE-2017-9524)

  - Qemu has integer overflows because IOReadHandler and     its associated functions use a signed integer data type     for a size value.(CVE-2018-18438)

  - The Bluetooth subsystem in QEMU mishandles negative     values for length variables, leading to memory     corruption.(CVE-2018-19665)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - A use-after-free issue was found in the Slirp     networking implementation of the Quick emulator (QEMU).
    It occurs when a Socket referenced from multiple     packets is freed while responding to a message. A     user/process could use this flaw to crash the QEMU     process on the host resulting in denial of     service.(CVE-2017-13711)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - A heap buffer overflow issue was found in the way SLiRP     networking back-end in QEMU processes fragmented     packets. It could occur while reassembling the     fragmented datagrams of an incoming packet. A     privileged user/process inside guest could use this     flaw to crash the QEMU process resulting in DoS or     potentially leverage it to execute arbitrary code on     the host with privileges of the QEMU     process.(CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - An integer overflow issue was found in the RTL8139 NIC     emulation in QEMU. It could occur while receiving     packets over the network if the size value is greater     than INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process, resulting in DoS     scenario.(CVE-2018-17958)

  - An integer overflow issue was found in the AMD PC-Net     II NIC emulation in QEMU. It could occur while     receiving packets, if the size value was greater than     INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process resulting in     DoS.(CVE-2018-17962)

  - A heap buffer overflow issue was found in the     load_device_tree() function of QEMU, which is invoked     to load a device tree blob at boot time. It occurs due     to device tree size manipulation before buffer     allocation, which could overflow a signed int type. A     user/process could use this flaw to potentially execute     arbitrary code on a host system with privileges of the     QEMU process.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     3.1.x through 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not     ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the     IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the ip_reass() routine while     reassembling incoming packets if the first fragment is     bigger than the m->m_dat[] buffer. An attacker could     use this flaw to crash the QEMU process on the host,     resulting in a Denial of Service or potentially     executing arbitrary code with privileges of the QEMU     process.(CVE-2019-14378)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure.(CVE-2020-10756)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the tcp_emu() routine while emulating     IRC and other protocols. An attacker could use this     flaw to crash the QEMU process on the host, resulting     in a denial of service or potential execution of     arbitrary code with privileges of the QEMU     process.(CVE-2020-7039)

  - An out-of-bound write access flaw was found in the way     QEMU loads ROM contents at boot time. This flaw occurs     in the rom_copy() routine while loading the contents of     a 32-bit -kernel image into memory. Running an     untrusted -kernel image may load contents at arbitrary     memory locations, potentially leading to code execution     with the privileges of the QEMU     process.(CVE-2020-13765)

  - A use-after-free flaw was found in the USB(xHCI/eHCI)     controller emulators of QEMU. This flaw occurs while     setting up the USB packet as a usb_packet_map() routine     and returns an error that was not checked. This flaw     allows a guest user or process to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-25084)

  - An infinite loop flaw was found in the USB OHCI     controller emulator of QEMU. This flaw occurs while     servicing OHCI isochronous transfer descriptors (TD) in     the ohci_service_iso_td routine, as it retires a TD if     it has passed its time frame. It does not check if the     TD was already processed and holds an error code in     TD_CC. This issue may happen if the TD list has a loop.
    This flaw allows a guest user or process to consume CPU     cycles on the host, resulting in a denial of     service.(CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - A potential directory traversal issue was found in the     tftp server of the SLiRP user-mode networking     implementation used by QEMU. It could occur on a     Windows host, as it allows the use of both forward     ('/') and backward slash('\') tokens as separators in a     file path. A user able to access the tftp server could     use this flaw to access undue files by using relative     paths.(CVE-2020-7211)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109106	Oracle Linux 7 : qemu-kvm (ELSA-2018-0816)	Nessus	Oracle Linux Local Security Checks	2018/4/18	2024/10/31	high
109372	CentOS 7 : qemu-kvm (CESA-2018:0816)	Nessus	CentOS Local Security Checks	2018/4/27	2024/10/22	high
289845	MiracleLinux 7 : qemu-kvm-1.5.3-156.el7 (AXSA:2018-2655:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
233296	RHEL 7 : qemu-kvm-rhev (RHSA-2018:1113)	Nessus	Red Hat Local Security Checks	2025/3/24	2025/3/24	critical
180778	Oracle Linux 7 : qemu (ELSA-2018-4285)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
103655	Debian DSA-3991-1 : qemu - security update	Nessus	Debian Local Security Checks	2017/10/4	2025/11/19	high
110148	EulerOS 2.0 SP1 : qemu-kvm (EulerOS-SA-2018-1144)	Nessus	Huawei Local Security Checks	2018/5/29	2024/10/1	high
110451	Amazon Linux 2 : qemu-kvm (ALAS-2018-1034) (Spectre)	Nessus	Amazon Linux Local Security Checks	2018/6/12	2026/1/12	medium
110865	EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2018-1201)	Nessus	Huawei Local Security Checks	2018/7/3	2026/1/12	medium
180740	Oracle Linux 7 : qemu (ELSA-2019-4585)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
104423	openSUSE Security Update : qemu (openSUSE-2017-1248)	Nessus	SuSE Local Security Checks	2017/11/7	2025/11/14	high
138009	EulerOS Virtualization 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1790)	Nessus	Huawei Local Security Checks	2020/7/1	2024/3/5	critical
151383	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2021-2166)	Nessus	Huawei Local Security Checks	2021/7/6	2023/12/11	critical
220798	Linux Distros Unpatched Vulnerability : CVE-2017-13711	Nessus	Misc.	2025/3/4	2025/8/21	high
110457	Amazon Linux AMI : qemu-kvm (ALAS-2018-1034) (Spectre)	Nessus	Amazon Linux Local Security Checks	2018/6/12	2026/1/12	medium

检测

插件搜索

high

high

high

critical

critical

critical

high

high

medium

medium

critical

high

critical

critical

high

medium