According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - Quick Emulator (QEMU) built with Network Block Device     (NBD) Server support was vulnerable to a null-pointer     dereference issue. The flaw could occur when releasing     a client that was not initialized due to failed     negotiation. A remote user or process could exploit     this flaw to crash the qemu-nbd server (denial of     service).(CVE-2017-9524)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4713 advisory.

    - Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda)  [Orabug: 29886908]     {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
    - pvrdma: release device resources in case of an error (Prasad J Pandit)  [Orabug: 29056678]     {CVE-2018-20123}
    - qxl: check release info object (Prasad J Pandit)  [Orabug: 29886906]  {CVE-2019-12155}
    - target/i386: add MDS-NO feature (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}
    - docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrange)  [Orabug: 29820428]     {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
    - target/i386: define md-clear bit (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes several issues. These security issues were fixed :

  - CVE-2017-15268: Qemu allowed remote attackers to cause a     memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c     (bsc#1062942).

  - CVE-2017-9524: The qemu-nbd server when built with the     Network Block Device (NBD) Server support allowed remote     attackers to cause a denial of service (segmentation     fault and server crash) by leveraging failure to ensure     that all initialization occurs talking to a client in     the nbd_negotiate function (bsc#1043808).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063122)

  - CVE-2017-15038: Race condition in the v9fs_xattrwalk     function local guest OS users to obtain sensitive     information from host heap memory via vectors related to     reading extended attributes (bsc#1062069)

  - CVE-2017-10911: The make_response function in the Linux     kernel allowed guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures (bsc#1057378)

  - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator     support allowed local guest OS privileged users to cause     a denial of service (NULL pointer dereference and QEMU     process crash) by flushing an empty CDROM device drive     (bsc#1054724)

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046636)

  - CVE-2017-10806: Stack-based buffer overflow allowed     local guest OS users to cause a denial of service (QEMU     process crash) via vectors related to logging debug     messages (bsc#1047674)

  - CVE-2017-14167: Integer overflow in the load_multiboot     function allowed local guest OS users to execute     arbitrary code on the host via crafted multiboot header     address values, which trigger an out-of-bounds write     (bsc#1057585)

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049381)

  - CVE-2017-11334: The address_space_write_continue     function allowed local guest OS privileged users to     cause a denial of service (out-of-bounds access and     guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048902)

  - CVE-2017-13672: The VGA display emulator support allowed     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update (bsc#1056334)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities were found in qemu, a fast processor emulator :

  - CVE-2017-9524     Denial of service in qemu-nbd server

  - CVE-2017-10806     Buffer overflow in USB redirector

  - CVE-2017-11334     Out-of-band memory access in DMA operations

  - CVE-2017-11434     Out-of-band memory access in SLIRP/DHCP

According to the version of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The qemu-nbd server in QEMU (aka Quick Emulator), when     built with the Network Block Device (NBD) Server     support, allows remote attackers to cause a denial of     service (segmentation fault and server crash) by     leveraging failure to ensure that all initialization     occurs before talking to a client in the nbd_negotiate     function.(CVE-2017-9524)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2408 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-     pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to     failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial     of service). (CVE-2017-9524)

    * An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR)     optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user     inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020)

    * A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation     support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly     resulted in leaking host memory, which affected other services on the host. A privileged user inside the     guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's     QEMU process instance. (CVE-2016-7466)

    * Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422,     CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921,     CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379,     CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)

    Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360     Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team     360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466,     CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting     CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang     (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and     CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang     (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
144726	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2021-1046)	Nessus	Huawei Local Security Checks	2021/1/5	2022/11/21	high
147128	EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2021-1527)	Nessus	Huawei Local Security Checks	2021/3/4	2021/3/8	medium
141665	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2020-2200)	Nessus	Huawei Local Security Checks	2020/10/21	2022/5/11	high
126673	Oracle Linux 7 : qemu (ELSA-2019-4713)	Nessus	Oracle Linux Local Security Checks	2019/7/15	2024/11/1	high
104429	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:2936-1)	Nessus	SuSE Local Security Checks	2017/11/7	2025/11/14	high
102209	Debian DSA-3925-1 : qemu - security update	Nessus	Debian Local Security Checks	2017/8/7	2025/12/4	high
102244	EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2017-1157)	Nessus	Huawei Local Security Checks	2017/8/8	2025/12/4	high
210314	RHEL 7 : qemu-kvm-rhev (RHSA-2017:2408)	Nessus	Red Hat Local Security Checks	2024/11/5	2024/11/5	medium

检测

插件搜索

high

medium

high

high

high

high

high

medium