リモートの Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS ホストには、USN-5772-1 アドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  - 6.1.0-rc2 より前のバージョンの QEMU の USB リダイレクタデバイスのエミュレーションに欠陥が見つかりました。これは、パケットキューがいっぱいであるため、SPICE クライアントからのバルク転送中にパケットをドロップするときに発生します。悪意のある SPICE クライアントがこの欠陥を利用して、偽造されたヒープチャンクメタデータで QEMU 呼び出しを free() にし、QEMU のクラッシュを引き起こしたり、ホストの QEMU プロセスの権限でコードを実行したりする可能性があります。(CVE-2021-3682)

  - QEMU の USB EHCI コントローラーエミュレーションで、DMA 再入可能性の問題が見つかりました。EHCI は、USB パケットを転送する際に、バッファポインターが MMIO 領域と重複するかどうかを検証しません。デバイスがパケットを転送している間に、細工されたコンテンツがコントローラーのレジスタに書き込まれ、望ましくないアクション (リセットなど) がトリガーされる可能性があります。これにより、最終的にメモリ解放後使用 (Use After Free) の問題が発生する可能性があります。悪の意あるゲストがこの欠陥を利用して、ホスト上で QEMU プロセスをクラッシュさせ、サービス拒否の状態を引き起こしたり、ホストの QEMU プロセスのコンテキストで任意のコードを実行したりする可能性があります。この欠陥は、7.0.0 より前の QEMU のバージョンに影響を与えます。(CVE-2021-3750)

  - QEMU の SCSI デバイスエミュレーションで off-by-one エラーが見つかりました。「page」引数が MODE_PAGE_ALLS (0x3f) に設定されている場合、mode_sense_page() の MODE SELECT コマンドの処理中にそれが発生する可能性があります。悪意のあるゲストがこの欠陥を利用して、QEMU をクラッシュさせ、サービス拒否状態を引き起こす可能性があります。
    (CVE-2021-3930)

  - QEMU の LSI53C895A SCSI Host Bus Adapter エミュレーションにメモリ解放後使用 (Use After Free) の脆弱性が見つかりました。この欠陥は、lsi_do_msgout 関数を介して現在の SCSI リクエストをキャンセルするために繰り返しメッセージを処理する際に発生します。この欠陥により、権限のあるゲストがホスト上で QEMU プロセスをクラッシュさせ、サービス拒否を引き起こす可能性があります。(CVE-2022-0216)

  - QEMU の Tulip デバイスエミュレーションで、DMA 再入可能性の問題が見つかりました。Tulip が rx/tx 記述子を読み書きするとき、または rx/tx フレームをコピーするとき、宛先アドレスが自身の MMIO アドレスであるかどうかをチェックしません。これにより、デバイスが MMIO ハンドラーを複数回トリガーし、スタックまたはヒープオーバーフローを引き起こす可能性があります。悪意のあるゲストがこの欠陥を利用して、ホスト上の QEMU プロセスをクラッシュさせ、サービス拒否状態を引き起こす可能性があります。(CVE-2022-2962)

  - 拡張形式の ClientCutText メッセージの処理中に、QEMU VNC サーバーで整数アンダーフローの問題が見つかりました。悪意のあるクライアントがこの欠陥を利用して、特別に細工されたペイロードメッセージを送信することで QEMU の応答を停止させ、サービス拒否を引き起こす可能性があります。(CVE-2022-3165)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートの Redhat Enterprise Linux 8 ホストにインストールされているパッケージは、RHSA-2023: 2757 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - 2021.8.22までの NTFS-3G の ntfsck には、buffer+512*3-2 を含むヒープベースのバッファオーバーフローがあります注意: 上流の位置としては、その ntfsck は廃止されていますが、一部の Linux ディストリビューションによって出荷されます。
    (CVE-2021-46790)

  - 細工された NTFS イメージにより、2021.8.22 までの NTFS-3G の ntfs_get_attribute_value でヒープ枯渇が発生する可能性があります。
    (CVE-2022-30784)

  - 細工された NTFS イメージにより、2021.8.22 までの NTFS-3G の ntfs_names_full_collate のヒープベースのバッファオーバーフローが引き起こされる可能性があります。(CVE-2022-30786)

  - 細工された NTFS イメージにより、2021.8.22 までの NTFS-3G の ntfs_mft_rec_alloc のヒープベースのバッファオーバーフローが引き起こされる可能性があります。(CVE-2022-30788)

  - 細工された NTFS イメージにより、2021.8.22 までの NTFS-3G の ntfs_check_log_client_array のヒープベースのバッファオーバーフローが引き起こされる可能性があります。(CVE-2022-30789)

  - 拡張形式の ClientCutText メッセージの処理中に、QEMU VNC サーバーで整数アンダーフローの問題が見つかりました。悪意のあるクライアントがこの欠陥を利用して、特別に細工されたペイロードメッセージを送信することで QEMU の応答を停止させ、サービス拒否を引き起こす可能性があります。(CVE-2022-3165)

  - TPM2.0 のモジュールライブラリに領域外読み取りの脆弱性が存在し、CryptParameterDecryption ルーチンで TPM2.0 コマンドの末尾を超えて 2 バイトの読み取りが行われる可能性があります。この脆弱性の悪用に成功した攻撃者が、TPM に保存されている機密データの読み取りやアクセスを行う可能性があります。(CVE-2023-1018)

Nessusはこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

遠端 Azure Linux 3.0 主機上安裝的 qemu 版本比測試版本舊。因此，此版本會受到 CVE-2022-3165 公告中提及的一個弱點影響。

  - 在 QEMU VNC 伺服器中處理延伸格式的 ClientCutText 訊息時，發現整數反向溢位問題。惡意用戶端可藉由傳送特製的承載訊息，利用此缺陷導致 QEMU 沒有回應，進而引致拒絕服務。(CVE-2022-3165)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 9 主機上安裝的套件受到 RHSA-2023: 2162 公告中提及的多個弱點影響。

  - 在 QEMU VNC 伺服器中處理延伸格式的 ClientCutText 訊息時，發現整數反向溢位問題。惡意用戶端可藉由傳送特製的承載訊息，利用此缺陷導致 QEMU 沒有回應，進而引致拒絕服務。(CVE-2022-3165)

  - 在 QEMU 的 ACPI 錯誤記錄序列化表 (ERST) 裝置的 read_erst_record() 和 write_erst_record() 函式中發現整數溢位和緩衝區溢位問題。這兩個問題都可能允許來賓造成配置給 ERST 記憶體裝置的主機緩衝區滿溢。惡意來賓可利用這些缺陷造成主機上的 QEMU 處理程序損毀。(CVE-2022-4172)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Ubuntu 16.04 ESM/18.04 LTS/20.04 LTS/22.04 LTS 主機上安裝的多個套件受到 USN-5772-1 公告中提及的多個弱點影響。

  - 在 QEMU 6.1.0-rc2 更早版本的 USB 重新導向器裝置模擬中發現一個缺陷。由於封包佇列已滿，在從 SPICE 用戶端進行大量傳輸期間中斷封包時，導致發生此問題。惡意 SPICE 用戶端可利用此缺陷，透過偽造的堆積區塊中繼資料進行 QEMU 呼叫，進而導致 QEMU 損毀，或可能以 QEMU 處理程序的權限在主機上執行程式碼。(CVE-2021-3682)

  - 在 QEMU 的 USB EHCI 控制器模擬中發現 DMA 重新進入問題。EHCI 在傳輸 USB 封包時未驗證緩衝區指標是否與其 MMIO 區域重疊。當裝置仍在傳輸封包時，攻擊者可能會將特製的內容寫入控制器的暫存器並觸發不需要的動作 (例如重設)，這最終會導致釋放後使用問題。惡意來賓使用者可利用此缺陷造成主機上的 QEMU 處理程序損毀，進而導致拒絕服務或可能在 QEMU 處理程序的環境中在主機上執行程式碼。此缺陷會影響 QEMU 7.0.0 之前版本。(CVE-2021-3750)

  - 在 QEMU 的 SCSI 裝置模擬中發現一個差一錯誤。如果「page」引數設為 MODE_PAGE_ALLS (0x3f)，則在 mode_sense_page() 中處理 MODE SELECT 命令時就有可能出現此錯誤。惡意來賓可能會利用此缺陷造成 QEMU 損毀，進而導致拒絕服務狀況。
    (CVE-2021-3930)

  - 在 QEMU 的 LSI53C895A SCSI Host Bus Adapter 模擬中發現釋放後使用弱點。透過 lsi_do_msgout 函式處理重複的訊息以取消目前的 SCSI 要求時，會發生此問題。擁有權限的惡意來賓使用者可利用此缺陷，造成主機上的 QEMU 處理程序損毀，進而導致拒絕服務。(CVE-2022-0216)

  - 在 QEMU 的 Tulip 裝置模擬中發現 DMA 重新進入問題。Tulip 在讀取或寫入 rx/tx 描述符號或複制 rx/tx 框架時，不會檢查目的地位址是否為自己的 MMIO 位址。這可造成裝置多次觸發 MMIO 處理常式，進而可能導致堆疊或堆積溢位。惡意來賓可能會利用此缺陷造成主機上的 QEMU 處理程序損毀，進而導致拒絕服務。(CVE-2022-2962)

  - 在 QEMU VNC 伺服器中處理延伸格式的 ClientCutText 訊息時，發現整數反向溢位問題。惡意用戶端可藉由傳送特製的承載訊息，利用此缺陷導致 QEMU 沒有回應，進而引致拒絕服務。(CVE-2022-3165)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2023: 2757 公告中提及的多個弱點影響。

  - NTFS-3G 2021.8.22 及之前版本中的 ntfsck 有一個涉及 buffer+512*3-2 的堆積型緩衝區溢位弱點。注意：ntfsck 在上游已淘汰，但會隨附於部分 Linux 發行版本。
    (CVE-2021-46790)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可利用特製的 NTFS 影像在 ntfs_get_attribute_value 中造成堆積耗盡。
    (CVE-2022-30784)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_names_full_collate 中造成堆積型緩衝區溢位問題。(CVE-2022-30786)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_mft_rec_alloc 中造成堆積型緩衝區溢位問題。(CVE-2022-30788)

  - 在 NTFS-3G 2021.8.22 以及之前的所有版本中，攻擊者可使用建構的 NTFS 影像在 ntfs_check_log_client_array 中造成堆積型緩衝區溢位問題。(CVE-2022-30789)

  - 在 QEMU VNC 伺服器中處理延伸格式的 ClientCutText 訊息時，發現整數反向溢位問題。惡意用戶端可藉由傳送特製的承載訊息，利用此缺陷導致 QEMU 沒有回應，進而引致拒絕服務。(CVE-2022-3165)

  - TPM2.0 的模組程式庫中存在一個超出邊界讀取弱點，攻擊者可在 CryptParameterDecryption 常式中讀取超過 TPM2.0 命令結尾的 2 位元組。可成功惡意利用此弱點的攻擊者可讀取或存取儲存在 TPM 中的敏感資料。(CVE-2023-1018)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8dcdfe7297 advisory.

    vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext (CVE-2022-3165) (rhbz#2129759)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2162 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    The following packages have been upgraded to a later upstream version: qemu-kvm (7.2.0). (BZ#2111769,     BZ#2135806)

    Security Fix(es):

    * QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)

    * QEMU: ACPI ERST: memory corruption issues in read_erst_record and write_erst_record (CVE-2022-4172)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3165 advisory.

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0869 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5088:
    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

    CVE-2023-40360:
    A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device     backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this     time window to trigger an assertion and cause a denial of service.

    CVE-2023-3180:
    QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no     check for whether an endurance group is configured before checking whether Flexible Data Placement is     enabled.

    CVE-2023-42467:
    A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does     not validate an offset provided by the guest before computing a host heap pointer, which is used for     copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

    CVE-2023-3354:
    A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service.

    CVE-2023-3301:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service.

    CVE-2023-4135:
    A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

    CVE-2023-3255:
    QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately.

    CVE-2021-3750:
    A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller/'s registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0.

    CVE-2021-3929:
    A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is     similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function     nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or,     potentially, executing arbitrary code within the context of the QEMU process on the host.

    CVE-2021-4158:
    A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within     the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition.

    CVE-2021-4206:
    A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process.

    CVE-2021-4207:
    A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process.

    CVE-2022-0358:
    A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is     strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by     virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of the group. This could allow a malicious unprivileged user     inside the guest to gain access to resources accessible to the root group, potentially escalating their     privileges within the guest. A malicious local user in the host might also leverage this unexpected     executable file created by the guest to escalate their privileges on the host system.

    CVE-2022-2962:
    A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the     rx/tx descriptor or copies the rx/tx frame, it doesn/'t check whether the destination address is its own     MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a     stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host,     resulting in a denial of service condition.

    CVE-2022-3165:
    An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service.

    CVE-2022-35414:
    ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the     translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-     virtualization Use Case in the qemu.org reference applies here, i.e., Bugs affecting the non-     virtualization use case are not considered security bugs at this time.

    CVE-2022-3872:
    An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition.

    CVE-2022-4144:
    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition.

    CVE-2023-1544:
    A flaw was found in the QEMU implementation of VMWare/'s paravirtual RDMA device. This flaw allows a     crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of     descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.

    CVE-2023-6683:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service.

    CVE-2023-6693:
    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of     the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process     on the host, resulting in a denial of service. (CVE-2020-14394)

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious     guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU     versions prior to 7.0.0. (CVE-2021-3611)

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within     the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. (CVE-2021-4158)

  - A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4206)

  - A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

  - A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The     flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout     function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the     host, resulting in a denial of service. (CVE-2022-0216)

  - A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is     strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by     virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of the group. This could allow a malicious unprivileged user     inside the guest to gain access to resources accessible to the root group, potentially escalating their     privileges within the guest. A malicious local user in the host might also leverage this unexpected     executable file created by the guest to escalate their privileges on the host system. (CVE-2022-0358)

  - A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for     CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and     other unexpected results. Affected QEMU version: 6.2.0. (CVE-2022-26353)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

  - softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path,     leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case     in the qemu.org reference applies here, i.e., 'Bugs affecting the non-virtualization use case are not     considered security bugs at this time. (CVE-2022-35414)

  - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition. (CVE-2022-3872)

  - An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

  - A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem     may lead to memory corruption bugs like stack overflow or use-after-free. (CVE-2023-0330)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5772-1 advisory.

    It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could     use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2021-3682)

    It was discovered that QEMU did not properly manage memory when it transfers the USB packets. A malicious     guest attacker could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
    (CVE-2021-3750)

    It was discovered that the QEMU SCSI device emulation incorrectly handled certain MODE SELECT commands. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2021-3930)

    It was discovered that QEMU did not properly manage memory when it processing repeated messages to cancel     the current SCSI request. A malicious privileged guest attacker could use this issue to cause QEMU to     crash, resulting in a denial of service. (CVE-2022-0216)

    It was discovered that QEMU did not properly manage memory when it using Tulip device emulation. A     malicious guest attacker could use this issue to cause QEMU to crash, resulting in a denial of service.
    This issue only affected Ubuntu 22.10. (CVE-2022-2962)

    It was discovered that QEMU did not properly manage memory when processing ClientCutText messages. A     attacker could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only     affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-3165)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2757 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * ntfs-3g: heap-based buffer overflow in ntfsck (CVE-2021-46790)

    * QEMU: VNC: integer underflow in vnc_client_cut_text_ext leads to CPU exhaustion (CVE-2022-3165)

    * ntfs-3g: crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value (CVE-2022-30784)

    * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate     (CVE-2022-30786)

    * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc     (CVE-2022-30788)

    * ntfs-3g: crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array     (CVE-2022-30789)

    * tpm2: TCG TPM2.0 implementations vulnerable to memory corruption (CVE-2023-1018)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
168627	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : QEMU の脆弱性 (USN-5772-1)	Nessus	Ubuntu Local Security Checks	2022/12/12	2025/9/3	high
175828	RHEL 8: virt: rhel および virt-devel: rhel (RHSA-2023: 2757)	Nessus	Red Hat Local Security Checks	2023/5/16	2024/11/7	high
215665	Azure Linux 3.0 安全性更新qemu (CVE-2022-3165)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/9/15	medium
175443	RHEL 9：qemu-kvm (RHSA-2023: 2162)	Nessus	Red Hat Local Security Checks	2023/5/12	2024/11/7	medium
168627	Ubuntu 16.04 ESM/18.04 LTS/20.04 LTS/22.04 LTS：QEMU 弱點 (USN-5772-1)	Nessus	Ubuntu Local Security Checks	2022/12/12	2025/9/3	high
175828	RHEL 8：virt：rhel 和 virt-devel：rhel (RHSA-2023: 2757)	Nessus	Red Hat Local Security Checks	2023/5/16	2024/11/7	high
169028	Fedora 36 : qemu (2022-8dcdfe7297)	Nessus	Fedora Local Security Checks	2022/12/21	2024/11/14	medium
175443	RHEL 9 : qemu-kvm (RHSA-2023:2162)	Nessus	Red Hat Local Security Checks	2023/5/12	2024/11/7	medium
215665	Azure Linux 3.0 Security Update: qemu (CVE-2022-3165)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/9/15	medium
238947	TencentOS Server 4: qemu (TSSA-2024:0869)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
176798	EulerOS Virtualization 2.11.0 : qemu (EulerOS-SA-2023-2134)	Nessus	Huawei Local Security Checks	2023/6/7	2024/1/16	high
168627	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : QEMU vulnerabilities (USN-5772-1)	Nessus	Ubuntu Local Security Checks	2022/12/12	2025/9/3	high
175828	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2023:2757)	Nessus	Red Hat Local Security Checks	2023/5/16	2024/11/7	high

检测

插件搜索

high

high

medium

medium

high

high

medium

medium

medium

high

high

high

high