The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4725-1 advisory.

    It was discovered that QEMU incorrectly handled memory in iSCSI emulation. An attacker inside the guest     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-11947)

    Alexander Bulekov discovered that QEMU incorrectly handled Intel e1000e emulation. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-15859)

    Alexander Bulekov discovered that QEMU incorrectly handled memory region cache. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-27821)

    Cheol-woo Myung discovered that QEMU incorrectly handled Intel e1000e emulation. An attacker inside the     guest could use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu     20.04 LTS, and Ubuntu 20.10. (CVE-2020-28916)

    Wenxiang Qian discovered that QEMU incorrectly handled ATAPI emulation. An attacker inside the guest could     use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-29443)

    It was discovered that QEMU incorrectly handled VirtFS directory sharing. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20181)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of QEMU installed on the remote Windows host is prior to release 5.1.0-rc0. It is, therefore, affected by multiple vulnerabilities:
  A denial of service flaw occurs when an nbd-client sends a spec-compliant request that is near the   boundary of maximum permitted request length. A remote nbd-client could use this flaw to crash the   qemu-nbd server resulting in a denial of service. (CVE-2020-10761)

  An out-of-bounds error occurs within hw/pci/pci.c. A guest OS user could use this flaw   by providing an address near the end of the PCI configuration space. (CVE-2020-13791)

  A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
  (CVE-2020-15469)

  A use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with   the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202208-27 (QEMU: Multiple Vulnerabilities)

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This     occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or     process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or     potential privileged code execution. This was fixed in commit 5519724a13664b43e225ca05351c60b4468e4555.
    (CVE-2020-15863)

  - In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c. (CVE-2020-16092)

  - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2020-35504)

  - A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw     allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-35505)

  - A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0 during the handling of the 'Information Transfer' command (CMD_TI). This flaw allows     a privileged guest user to crash the QEMU process on the host, resulting in a denial of service or     potential code execution with the privileges of the QEMU process. (CVE-2020-35506)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It     may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A     privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
    (CVE-2021-20203)

  - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability. (CVE-2021-20257)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

  - The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to     the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This     flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of     service or potential code execution. QEMU up to (including) 5.2.0 is affected by this. (CVE-2021-3409)

  - A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions     up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get     bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the     host resulting in DoS scenario. (CVE-2021-3416)

  - A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a     single, large transfer request, to reduce the overhead and improve performance. The combined size of the     bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a     denial of service. (CVE-2021-3527)

  - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions     up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-     gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. (CVE-2021-3544)

  - An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-     user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit     this issue to leak memory from the host. (CVE-2021-3545)

  - An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET'     command from the guest. It could allow a privileged guest user to crash the QEMU process on the host,     resulting in a denial of service condition, or potential code execution with the privileges of the QEMU     process. (CVE-2021-3546)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while     handling a PVRDMA_CMD_CREATE_MR command due to improper memory remapping (mremap). This flaw allows a     malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to     system availability. (CVE-2021-3582)

  - An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions     prior to 6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest due to     improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount     of memory, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2021-3607)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to     6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest and may result in a     crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest     threat from this vulnerability is to system availability. (CVE-2021-3608)

  - A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious     guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU     versions prior to 7.0.0. (CVE-2021-3611)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions     prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-     bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this     flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the     host. (CVE-2021-3713)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
    (CVE-2021-3930)

  - A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist()     where a malicious guest controlling certain input can read out of bounds memory. A malicious user could     use this flaw leading to disclosure of sensitive information. (CVE-2021-3947)

  - A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0.
    The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A     malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host     when writing data reaches the threshold of mirroring node. (CVE-2021-4145)

  - A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4206)

  - A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

  - A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for     CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and     other unexpected results. Affected QEMU version: 6.2.0. (CVE-2022-26353)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

  -  Please review the referenced CVE identifiers for details.  (CVE-2021-3929)

  - QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c (CVE-2021-4158)

  - QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 (CVE-2022-0358)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:4191 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

    * libvirt: Insecure sVirt label generation (CVE-2021-3631)

    * libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-4191 advisory.

    - security: fix SELinux label generation logic (CVE-2021-3631)
    - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)
    - Resolves: bz#1970819       (CVE-2021-3592 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information     disclosure (bootp) [rhel-8])
    - Resolves: bz#1970835       (CVE-2021-3593 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information     disclosure (udp6) [rhel-8])
    - Resolves: bz#1970843       (CVE-2021-3595 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information     disclosure (tftp) [rhel-8])
    - Resolves: bz#1970853       (CVE-2021-3594 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information     disclosure (udp) [rhel-8])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2021:4191 advisory.

    * QEMU: net: e1000e: use-after-free while sending packets (CVE-2020-15859)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) (CVE-2021-3592)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) (CVE-2021-3593)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) (CVE-2021-3594)

    * QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) (CVE-2021-3595)

    * libvirt: Insecure sVirt label generation (CVE-2021-3631)

    * libvirt: Improper locking on ACL failure in virStoragePoolLookupByTargetPath API (CVE-2021-3667)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0119 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2018-12130:
    Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf

    CVE-2018-13405:
    The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID.

    CVE-2019-10132:
    A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket     systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using     virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and     virtlogd daemons.

    CVE-2019-10161:
    It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to     probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary     programs.

    CVE-2019-10166:
    It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit     readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed     save state files. If a managed save had already been created by a privileged user, a local attacker could     modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

    CVE-2019-10167:
    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an emulatorbin argument to specify the program providing emulation for a domain. Since v1.2.19,     libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an     arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own     privileges.

    CVE-2019-10168:
    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before     4.10.1 and 5.x.x before 5.4.1, accept an emulator argument to specify the program providing emulation     for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-     only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted     executable with its own privileges.

    CVE-2019-11135:
    TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access.

    CVE-2019-12155:
    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-14842:
    Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.
    A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did     not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data     under control of the server is written to memory before the read buffer supplied by the client. If the     read buffer is located on the stack then this allows the stack return address from nbd_pread() to be     trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is     located on the heap then other memory objects before the buffer can be overwritten, which again would     usually lead to arbitrary code execution.

    CVE-2019-15890:
    libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

    CVE-2019-20485:
    qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage).

    CVE-2019-6501:
    In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read     operations.

    CVE-2019-6778:
    In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

    CVE-2020-10703:
    A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2020-11947:
    iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose     unrelated information from process memory to an attacker.

    CVE-2020-14301:
    An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.

    CVE-2020-14339:
    A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability.

    CVE-2020-14364:
    An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host.

    CVE-2020-15859:
    QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address.

    CVE-2020-16092:
    In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c.

    CVE-2020-1711:
    An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions     2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical     Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the     QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of     the QEMU process on the host.

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-25637:
    A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability.

    CVE-2020-25723:
    A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service.

    CVE-2020-27821:
    A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0.

    CVE-2020-28916:
    hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.

    CVE-2020-29130:
    slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length.

    CVE-2020-29443:
    ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2021-20257:
    An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability.

    CVE-2021-3592:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the bootp_input() function and could occur while processing a udp packet that is smaller than     the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of     uninitialized heap memory from the host. The highest threat from this vulnerability is to data     confidentiality. This flaw affects libslirp versions prior to 4.6.0.

    CVE-2021-3593:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3594:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3631:
    A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

    CVE-2021-3667:
    An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability.

    CVE-2021-3930:
    An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8412-1 advisory.

    Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the iSCSI block driver in QEMU     incorrectly handled certain responses from an iSCSI server. A remote attacker could possibly use this     issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)

    It was discovered that the iSCSI block driver in QEMU incorrectly handled certain memory operations,     leading to a heap-based buffer over-read. An attacker could possibly use this issue to expose sensitive     information from the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)

    Ziming Zhang discovered that the SM501 display driver in QEMU contained an integer overflow. A local     attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS. (CVE-2020-12829)

    Gaoning Pan and Xingwei Li discovered that the USB xHCI controller implementation in QEMU contained an     infinite loop. An attacker inside the guest could possibly use this issue to cause QEMU to hang, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2020-14394)

    Lei Sun discovered that QEMU incorrectly handled certain MemoryRegionOps objects, leading to a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-15469)

    Alexander Bulekov discovered that the e1000e network device implementation in QEMU contained a use-after-     free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15859)

    Ziming Zhang discovered that the XGMAC Ethernet controller in QEMU contained a buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-15863)

    Alexander Bulekov discovered that the SDHCI device emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in     a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-17380)

    Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that the USB xHCI controller     implementation in QEMU did not check a return value, leading to a use-after-free. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS. (CVE-2020-25084)

    Gaoning Pan, Yongkang Jia, and Yi Ren discovered that the USB OHCI controller implementation in QEMU     contained a stack-based buffer over-read. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2020-25624)

    It was discovered that the USB OHCI controller implementation in QEMU contained an infinite loop. An     attacker inside the guest could possibly use this issue to cause QEMU to consume resources, resulting in a     denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25625)

    Cheolwoo Myung discovered that the USB EHCI emulation in QEMU did not handle DMA memory map failures,     leading to a reachable assertion. An attacker inside the guest could possibly use this issue to cause QEMU     to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-25723)

    Gaoning Pan discovered that the network device emulation in QEMU could be made to trigger an assertion     failure when processing packets that lacked a valid layer 3 protocol. An attacker inside the guest could     possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-27617)

    Wenxiang Qian discovered that the ATAPI emulation in QEMU did not properly validate a buffer index,     leading to an out-of-bounds read. An attacker inside the guest could possibly use this issue to expose     sensitive information or cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2020-29443)

    Cheolwoo Myung discovered that the ESP SCSI emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2020-35504)

    Cheolwoo Myung discovered that the am53c974 SCSI host bus adapter emulation in QEMU contained a NULL     pointer dereference. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2020-35505)

    It was discovered that the SDHCI controller emulation in QEMU contained out-of-bounds read and write     issues. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a     denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3409)

    It was discovered that several network device emulations in QEMU contained an infinite loop when operating     in loopback mode. An attacker inside the guest could possibly use this issue to cause QEMU to crash,     resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2021-3416)

    Alexander Bulekov discovered that the floppy disk emulation in QEMU contained a heap-based buffer     overflow. An attacker inside the guest could possibly use this issue to expose sensitive information or     cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and     Ubuntu 16.04 LTS. (CVE-2021-3507)

    Remy Noel discovered that the USB redirector device emulation in QEMU performed an unbounded stack     allocation when combining USB packets. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu     16.04 LTS. (CVE-2021-3527)

    It was discovered that the QXL display device emulation in QEMU contained an integer overflow, leading to     a heap-based buffer overflow. An attacker inside the guest could possibly use this issue to cause QEMU to     crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4206)

    It was discovered that the QXL display device emulation in QEMU performed a double fetch of guest-     controlled values, leading to a heap-based buffer overflow. An attacker inside the guest could possibly     use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-4207)

    It was discovered that the 9pfs server implementation in QEMU contained a race condition, leading to a     use-after-free. A malicious 9p client could possibly use this issue to escalate privileges. This issue     only affected Ubuntu 14.04 LTS. (CVE-2021-20181)

    Gaoning Pan discovered that the floppy disk emulation in QEMU contained a NULL pointer dereference. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20196)

    Gaoning Pan discovered that the vmxnet3 network device emulation in QEMU contained an integer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20203)

    It was discovered that the ARM Generic Interrupt Controller emulation in QEMU contained an out-of-bounds     heap access. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20221)

    Alexander Bulekov, Cheolwoo Myung, Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered     that the e1000 network device emulation in QEMU contained an infinite loop. An attacker inside the guest     could possibly use this issue to cause QEMU to consume resources, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2021-20257)

    It was discovered that the 9p passthrough file system implementation in QEMU did not prevent opening     special files on the host. A malicious guest could possibly use this issue to escape the exported 9p tree.
    This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2023-2861)

    It was discovered that the virtio crypto device emulation in QEMU did not properly validate certain buffer     lengths, leading to a heap buffer overflow. An attacker inside the guest could possibly use this issue to     cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 18.04 LTS. (CVE-2023-3180)

    It was discovered that the built-in VNC server in QEMU contained a NULL pointer dereference when cleaning     up a connection that failed during the handshake. A remote attacker could possibly use this issue to cause     QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2023-3354)

    It was discovered that QEMU could incorrectly direct a guest I/O operation to disk offset 0 instead of the     intended offset. An attacker inside the guest could possibly use this issue to read or overwrite sensitive     data, potentially gaining control of the host. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04     LTS, and Ubuntu 18.04 LTS. (CVE-2023-5088)

    It was discovered that several virtio device emulations in QEMU did not properly guard against DMA     reentrancy, leading to a double free. An attacker inside the guest could possibly use this issue to cause     QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-3446)

    It was discovered that the SDHCI device emulation in QEMU contained a heap- based buffer overflow. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-3447)

    It was discovered that the QEMU disk image utility (qemu-img) did not properly handle certain crafted     image files. An attacker could possibly use this issue to cause qemu-img to consume excessive resources or     access an unintended external file, resulting in a denial of service. This issue only affected Ubuntu     20.04 LTS. (CVE-2024-4467)

    Cyrille Chatras discovered that the LSI53C895A SCSI Host Bus Adapter emulation in QEMU contained a use-     after-free. An attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting     in a denial of service, or possibly execute arbitrary code. (CVE-2024-6519)

    It was discovered that the NBD server in QEMU contained an improper synchronization issue during socket     closure. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2024-7409)

    It was discovered that the USB emulation in QEMU contained a reachable assertion. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2024-8354)

    It was discovered that QEMU incorrectly handled resources during the VNC WebSocket handshake, leading to a     use-after-free. A remote attacker could possibly use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2025-11234)

    It was discovered that QEMU could be made to read out of bounds when reading VMDK images. An attacker     could possibly use this issue to expose sensitive information or cause QEMU to crash, resulting in a     denial of service. (CVE-2026-2243)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization). An attacker could trigger a denial of service (DoS), information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host.

CVE-2020-15469

A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

CVE-2020-15859

QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

CVE-2020-25084

QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

CVE-2020-28916

hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address.

CVE-2020-29130

slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVE-2020-29443

ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated.

CVE-2021-20181

9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability.

CVE-2021-20221

aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field.

For Debian 9 stretch, these problems have been fixed in version 1:2.8+dfsg-6+deb9u13.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to its security tracker page at: https://security-tracker.debian.org/tracker/qemu

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0119 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-12130:
    Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to potentially enable information disclosure via a     side channel with local access. A list of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf

    CVE-2018-13405:
    The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID.

    CVE-2019-10132:
    A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket     systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using     virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and     virtlogd daemons.

    CVE-2019-10161:
    It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to     probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary     programs.

    CVE-2019-10166:
    It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit     readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed     save state files. If a managed save had already been created by a privileged user, a local attacker could     modify this file such that libvirtd would execute an arbitrary program when the domain was resumed.

    CVE-2019-10167:
    The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an emulatorbin argument to specify the program providing emulation for a domain. Since v1.2.19,     libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an     arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own     privileges.

    CVE-2019-10168:
    The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before     4.10.1 and 5.x.x before 5.4.1, accept an emulator argument to specify the program providing emulation     for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-     only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted     executable with its own privileges.

    CVE-2019-11135:
    TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access.

    CVE-2019-12155:
    interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-14842:
    Structured reply is a feature of the newstyle NBD protocol allowing the server to send a reply in chunks.
    A bounds check which was supposed to test for chunk offsets smaller than the beginning of the request did     not work because of signed/unsigned confusion. If one of these chunks contains a negative offset then data     under control of the server is written to memory before the read buffer supplied by the client. If the     read buffer is located on the stack then this allows the stack return address from nbd_pread() to be     trivially modified, allowing arbitrary code execution under the control of the server. If the buffer is     located on the heap then other memory objects before the buffer can be overwritten, which again would     usually lead to arbitrary code execution.

    CVE-2019-15890:
    libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

    CVE-2019-20485:
    qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage).

    CVE-2019-6501:
    In QEMU 3.1, scsi_handle_inquiry_reply in hw/scsi/scsi-generic.c allows out-of-bounds write and read     operations.

    CVE-2019-6778:
    In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

    CVE-2020-10703:
    A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2020-11947:
    iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose     unrelated information from process memory to an attacker.

    CVE-2020-14301:
    An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.

    CVE-2020-14339:
    A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability.

    CVE-2020-14364:
    An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host.

    CVE-2020-15859:
    QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address.

    CVE-2020-16092:
    In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects     the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the     QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in     hw/net/net_tx_pkt.c.

    CVE-2020-1711:
    An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions     2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical     Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the     QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of     the QEMU process on the host.

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-25637:
    A double free memory issue was found to occur in the libvirt API, in versions before 6.8.0, responsible     for requesting information about network interfaces of a running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting to the read-write socket with limited ACL     permissions could use this flaw to crash the libvirt daemon, resulting in a denial of service, or     potentially escalate their privileges on the system. The highest threat from this vulnerability is to data     confidentiality and integrity as well as system availability.

    CVE-2020-25723:
    A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service.

    CVE-2020-27821:
    A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0.

    CVE-2020-28916:
    hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.

    CVE-2020-29130:
    slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length.

    CVE-2020-29443:
    ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2021-20257:
    An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability.

    CVE-2021-3592:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the bootp_input() function and could occur while processing a udp packet that is smaller than     the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of     uninitialized heap memory from the host. The highest threat from this vulnerability is to data     confidentiality. This flaw affects libslirp versions prior to 4.6.0.

    CVE-2021-3593:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3594:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-3631:
    A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

    CVE-2021-3667:
    An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability.

    CVE-2021-3930:
    An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

  - pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because     pci_get_bus() might not return a valid pointer. (CVE-2020-25742)

  - hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check     before an ide_cancel_dma_sync call. (CVE-2020-25743)

  - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2020-35504)

  - A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw     allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-35505)

  - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

  - An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It     may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A     privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
    (CVE-2021-20203)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator     of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw     allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2021-20255)

  - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions     up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-     gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. (CVE-2021-3544)

  - An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-     user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit     this issue to leak memory from the host. (CVE-2021-3545)

  - An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET'     command from the guest. It could allow a privileged guest user to crash the QEMU process on the host,     resulting in a denial of service condition, or potential code execution with the privileges of the QEMU     process. (CVE-2021-3546)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
146303	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4725-1)	Nessus	Ubuntu Local Security Checks	2021/2/8	2025/9/3	high
138897	QEMU 4.2 < 5.1.0-rc0 Multiple Vulnerabilities	Nessus	Windows	2020/7/24	2024/2/28	medium
164115	GLSA-202208-27 : QEMU: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2022/8/15	2023/10/16	high
155526	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-2763)	Nessus	Huawei Local Security Checks	2021/11/17	2023/11/23	high
155110	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2021:4191)	Nessus	Red Hat Local Security Checks	2021/11/11	2025/3/15	medium
155984	Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2021-4191)	Nessus	Oracle Linux Local Security Checks	2021/12/10	2024/11/1	medium
158874	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:4191)	Nessus	Alma Linux Local Security Checks	2022/3/12	2025/1/13	medium
276357	TencentOS Server 3: virt:rhel and virt-devel:rhel (TSSA-2022:0119)	Nessus	Tencent Local Security Checks	2025/11/20	2025/12/5	critical
320399	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-8412-1)	Nessus	Ubuntu Local Security Checks	2026/6/11	2026/6/11	high
146609	Debian DLA-2560-1 : qemu security update	Nessus	Debian Local Security Checks	2021/2/19	2024/1/22	high
236436	Alibaba Cloud Linux 3 : 0119: virt:rhel and virt-devel:rhel (ALINUX3-SA-2022:0119)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	critical
159867	EulerOS Virtualization 2.10.1 : qemu (EulerOS-SA-2022-1392)	Nessus	Huawei Local Security Checks	2022/4/18	2023/11/1	high
159876	EulerOS Virtualization 2.10.0 : qemu (EulerOS-SA-2022-1418)	Nessus	Huawei Local Security Checks	2022/4/18	2023/11/1	high

检测

插件搜索

high

medium

high

high

medium

medium

medium

critical

high

high

critical

high

high