The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1730:05 advisory.

    qemu-kvm is an open source virtualizer that provides hardware emulation for     the KVM hypervisor. qemu-kvm acts as a virtual machine monitor together with     the KVM kernel modules, and emulates the hardware for a full system such as     a PC and its assocated peripherals.
    As qemu-kvm requires no host kernel patches to run, it is safe and easy to use.
    Security issues fixed with this release:
    CVE-2017-9524
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Qemu: usb: ohci: infinite loop due to incorrect return value [CVE-2017-9330] (#1457698) Qemu: nbd: segmentation fault due to client non-negotiation [CVE-2017-9524] (#1460173) Qemu: qemu-nbd: server breaks with SIGPIPE upon client abort [CVE-2017-10664] (#1466466) Qemu: exec: oob access during dma operation [CVE-2017-11334] (#1471640) revised full fix for XSA-226 (regressed 32-bit Dom0 or backend domains)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization occurs before talking to a client in the     nbd_negotiate function. (CVE-2017-9524)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the version of the qemu-kvm package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4713 advisory.

    - Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda)  [Orabug: 29886908]     {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
    - pvrdma: release device resources in case of an error (Prasad J Pandit)  [Orabug: 29056678]     {CVE-2018-20123}
    - qxl: check release info object (Prasad J Pandit)  [Orabug: 29886906]  {CVE-2019-12155}
    - target/i386: add MDS-NO feature (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}
    - docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrange)  [Orabug: 29820428]     {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
    - target/i386: define md-clear bit (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - Quick Emulator (QEMU) built with Network Block Device     (NBD) Server support was vulnerable to a null-pointer     dereference issue. The flaw could occur when releasing     a client that was not initialized due to failed     negotiation. A remote user or process could exploit     this flaw to crash the qemu-nbd server (denial of     service).(CVE-2017-9524)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289667	MiracleLinux 7 : qemu-kvm-1.5.3-126.el7.10 (AXSA:2017-1730:05)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
105929	Fedora 27 : xen (2017-908f063bb6)	Nessus	Fedora Local Security Checks	2018/1/15	2025/11/4	high
221266	Linux Distros Unpatched Vulnerability : CVE-2017-9524	Nessus	Misc.	2025/3/4	2026/1/28	high
102243	EulerOS 2.0 SP1 : qemu-kvm (EulerOS-SA-2017-1156)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	high
126673	Oracle Linux 7 : qemu (ELSA-2019-4713)	Nessus	Oracle Linux Local Security Checks	2019/7/15	2024/11/1	high
141665	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2020-2200)	Nessus	Huawei Local Security Checks	2020/10/21	2022/5/11	high
144726	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2021-1046)	Nessus	Huawei Local Security Checks	2021/1/5	2022/11/21	high
147128	EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2021-1527)	Nessus	Huawei Local Security Checks	2021/3/4	2021/3/8	medium

检测

插件搜索

high

high

high

high

high

high

high

medium