The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest     OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different     vulnerability than CVE-2017-6505. (CVE-2017-9330)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for xen fixes several issues. These security issues were fixed :

  - Page transfer might have allowed PV guest to elevate     privilege (XSA-217, bsc#1042882)

  - Races in the grant table unmap code allowed for     informations leaks and potentially privilege escalation     (XSA-218, bsc#1042893)

  - Insufficient reference counts during shadow emulation     allowed a malicious pair of guest to elevate their     privileges to the privileges that XEN runs under     (XSA-219, bsc#1042915)

  - Missing NULL pointer check in event channel poll allows     guests to DoS the host (XSA-221, bsc#1042924)

  - Stale P2M mappings due to insufficient error checking     allowed malicious guest to leak information or elevate     privileges (XSA-222, bsc#1042931)

  - Grant table operations mishandled reference counts     allowing malicious guests to escape (XSA-224,     bsc#1042938)

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042160)

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037243)

  - PKRU and BND* leakage between vCPU-s might have leaked     information to other guests (XSA-220, bsc#1042923)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - blkif responses leaked backend stack data, which allowed     unprivileged guest to obtain sensitive information from     the host or other guests (XSA-216, bsc#1042863)

  - Page transfer might have allowed PV guest to elevate     privilege (XSA-217, bsc#1042882)

  - Races in the grant table unmap code allowed for     informations leaks and potentially privilege escalation     (XSA-218, bsc#1042893)

  - Insufficient reference counts during shadow emulation     allowed a malicious pair of guest to elevate their     privileges to the privileges that XEN runs under     (XSA-219, bsc#1042915)

  - Stale P2M mappings due to insufficient error checking     allowed malicious guest to leak information or elevate     privileges (XSA-222, bsc#1042931)

  - Grant table operations mishandled reference counts     allowing malicious guests to escape (XSA-224,     bsc#1042938)

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042160)

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037243)

  - CVE-2017-8905: Xen a failsafe callback, which might have     allowed PV guest OS users to execute arbitrary code on     the host OS (XSA-215, bsc#1034845).

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043297)

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043074)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036470)

  - Missing NULL pointer check in event channel poll allows     guests to DoS the host (XSA-221, bsc#1042924)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes several issues. These security issues were fixed :

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042159).

  - CVE-2017-8379: Memory leak in the keyboard input event     handlers support allowed local guest OS privileged users     to cause a denial of service (host memory consumption)     by rapidly generating large keyboard events     (bsc#1037334).

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037242).

  - CVE-2017-7493: The VirtFS, host directory sharing via     Plan 9 File System(9pfs) support, was vulnerable to an     improper access control issue. It could occur while     accessing virtfs metadata files in mapped-file security     mode. A guest user could have used this flaw to escalate     their privileges inside guest (bsc#1039495).

  - CVE-2017-7377: The v9fs_create and v9fs_lcreate     functions in hw/9pfs/9p.c allowed local guest OS     privileged users to cause a denial of service (file     descriptor or memory consumption) via vectors related to     an already in-use fid (bsc#1032075).

  - CVE-2017-8086: A memory leak in the v9fs_list_xattr     function in hw/9pfs/9p-xattr.c allowed local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable (bsc#1035950).

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025109)

  - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks     function in hw/sd/sdhci.c allowed local OS guest     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors involving the     transfer mode register during multi block transfer     (bsc#1025311).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028184)

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028656)

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034908)

  - CVE-2017-7980: An out-of-bounds r/w access issues in the     Cirrus CLGD 54xx VGA Emulator support allowed privileged     user inside guest to use this flaw to crash the Qemu     process resulting in DoS or potentially execute     arbitrary code on a host with privileges of Qemu process     on the host (bsc#1035406)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036211).

  - CVE-2017-9375: The USB xHCI controller emulator support     was vulnerable to an infinite recursive call loop issue,     which allowed a privileged user inside guest to crash     the Qemu process resulting in DoS (bsc#1042800).

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043073).

  - CVE-2017-9373: The IDE AHCI Emulation support was     vulnerable to a host memory leakage issue, which allowed     a privileged user inside guest to leak host memory     resulting in DoS (bsc#1042801).

  - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to an out-of-bounds     read access issue which allowed a privileged user inside     guest to read host memory resulting in DoS     (bsc#1037336).

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427).

  - CVE-2017-7471: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper access control issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1034866).

  - Fix privilege escalation in TCG mode of QEMU. This is     not considered a security issue by the upstream project,     but is included as additional hardening (bsc#1030624)

  - Fix potential DoS in virtfs

  - CVE-2016-10028: The Virtio GPU Device emulator support     was vulnerable to an out of bounds memory access issue     allowing a guest user to crash the Qemu process instance     on a host, resulting in DoS (bsc#1017084, bsc#1016503)

  - CVE-2016-10029: The Virtio GPU Device emulator support     was vulnerable to an OOB read issue allowing a guest     user to crash the Qemu process instance resulting in Dos     (bsc#1017081, bsc#1016504)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021741)

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043296).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-03 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker might cause a Denial of Service or gain escalated       privileges from a guest VM.
  Workaround :

    There is no known workaround at this time.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3414-1 advisory.

    Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use     this issue to elevate privileges inside the guest. (CVE-2017-7493)

    Li Qiang discovered that QEMU incorrectly handled VMWare PVSCSI emulation. A privileged attacker inside     the guest could use this issue to cause QEMU to consume resources or crash, resulting in a denial of     service. (CVE-2017-8112)

    It was discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation support. A     privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of     service, or possibly to obtain sensitive host memory. This issue only affected Ubuntu 16.04 LTS and Ubuntu     17.04. (CVE-2017-8380)

    Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest     could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. This     issue only affected Ubuntu 17.04. (CVE-2017-9060)

    Li Qiang discovered that QEMU incorrectly handled the e1000e device. A privileged attacker inside the     guest could use this issue to cause QEMU to hang, resulting in a denial of service. This issue only     affected Ubuntu 17.04. (CVE-2017-9310)

    Li Qiang discovered that QEMU incorrectly handled USB OHCI emulation support. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-9330)

    Li Qiang discovered that QEMU incorrectly handled IDE AHCI emulation support. A privileged attacker inside     the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of     service. (CVE-2017-9373)

    Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation support. A privileged attacker inside     the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of     service. (CVE-2017-9374)

    Li Qiang discovered that QEMU incorrectly handled USB xHCI emulation support. A privileged attacker inside     the guest could use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2017-9375)

    Zhangyanyu discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation     support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in     a denial of service. (CVE-2017-9503)

    It was discovered that the QEMU qemu-nbd server incorrectly handled initialization. A remote attacker     could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2017-9524)

    It was discovered that the QEMU qemu-nbd server incorrectly handled signals. A remote attacker could use     this issue to cause the server to crash, resulting in a denial of service. (CVE-2017-10664)

    Li Qiang discovered that the QEMU USB redirector incorrectly handled logging debug messages. An attacker     inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2017-10806)

    Anthony Perard discovered that QEMU incorrectly handled Xen block-interface responses. An attacker inside     the guest could use this issue to cause QEMU to leak contents of host memory. (CVE-2017-10911)

    Reno Robert discovered that QEMU incorrectly handled certain DHCP options strings. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-11434)

    Ryan Salsamendi discovered that QEMU incorrectly handled empty CDROM device drives. A privileged attacker     inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-12809)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
221685	Linux Distros Unpatched Vulnerability : CVE-2017-9330	Nessus	Misc.	2025/3/4	2025/3/4	medium
101202	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:1742-1)	Nessus	SuSE Local Security Checks	2017/7/3	2021/1/6	high
101224	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1770-1)	Nessus	SuSE Local Security Checks	2017/7/5	2021/1/19	high
101227	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:1774-1)	Nessus	SuSE Local Security Checks	2017/7/5	2021/1/6	critical
100630	GLSA-201706-03 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/6/6	2021/1/11	critical
103217	Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3414-1)	Nessus	Ubuntu Local Security Checks	2017/9/14	2025/9/3	critical

检测

插件搜索

medium

high

high

critical

critical

critical