This update for xen fixes several issues. These security issues were fixed :

  - CVE-2018-8897: Prevent mishandling of debug exceptions     on x86 (XSA-260, bsc#1090820)

  - Handle HPET timers in IO-APIC mode correctly to prevent     malicious or buggy HVM guests from causing a hypervisor     crash or potentially privilege escalation/information     leaks (XSA-261, bsc#1090822)

  - Prevent unbounded loop, induced by qemu allowing an     attacker to permanently keep a physical CPU core busy     (XSA-262, bsc#1090823)

  - CVE-2018-10472: x86 HVM guest OS users (in certain     configurations) were able to read arbitrary dom0 files     via QMP live insertion of a CDROM, in conjunction with     specifying the target file as the backing file of a     snapshot (bsc#1089152).

  - CVE-2018-10471: x86 PV guest OS users were able to cause     a denial of service (out-of-bounds zero write and     hypervisor crash) via unexpected INT 80 processing,     because of an incorrect fix for CVE-2017-5754     (bsc#1089635).

  - CVE-2018-7550: The load_multiboot function allowed local     guest OS users to execute arbitrary code on the host via     a mh_load_end_addr value greater than mh_bss_end_addr,     which triggers an out-of-bounds read or write memory     access (bsc#1083292).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1369 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * QEMU: i386: multiboot OOB access while loading kernel image (CVE-2018-7550)

    * QEMU: cirrus: OOB access when updating VGA display (CVE-2018-7858)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Cyrille Chatras (Orange.com) and CERT-CC (Orange.com) for reporting     CVE-2018-7550 and Ross Lagerwall (Citrix.com) for reporting CVE-2018-7858.

    Bug Fix(es):

    * In certain Red Hat Virtualization (RHV) guest configurations, virtual pass-through devices could not be     removed properly. A reference count leak in the QEMU emulator has been removed, and the affected devices     are now removed reliably. (BZ#1555213)

    * Previously, a raw disk image that was using the --preallocation=full option in some cases could not be     resized. This problem has been fixed and no longer occurs. (BZ#1566587)

    * Due to race conditions in the virtio-blk and virtio-scsi services, the QEMU emulator sometimes     terminated unexpectedly when shutting down. The race conditions have been removed, and QEMU now exits     gracefully. (BZ#1566586)

    * Prior to this update, deleting guest snapshots using the RHV GUI in some cases failed due to an     incorrect image-seeking algorithm. This update fixes the underlying code, and guest snapshots in RHV can     now be deleted successfully. (BZ#1566369)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - QEMU: slirp: heap buffer overflow while reassembling     fragmented datagrams (CVE-2018-11806)

  - QEMU: i386: multiboot OOB access while loading kernel     image (CVE-2018-7550)

Bug Fix(es) :

  - Previously, live migrating a Windows guest in some cases     caused the guest to become unresponsive. This update     ensures that Real-time Clock (RTC) interrupts are not     missed, which prevents the problem from occurring.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1645 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)

    Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu to version 2.11.2 fixes the following issues:
Security issue fixed :

  - CVE-2018-11806: Fix heap buffer overflow issue that can     happen while reassembling fragmented datagrams     (bsc#1096223).

  - CVE-2018-3639: Mitigation functionality for Speculative     Store Bypass issue in x86 (bsc#1087082).

  - CVE-2018-7550: Fix out of bounds read and write memory     access, potentially leading to code execution     (bsc#1083291) Bug fixes :

  - bsc#1091695: SEV guest will not lauchh with     qemu-system-x86_64 version 2.11.1.

  - bsc#1094898: qemu-guest-agent service doesn't work in     version Leap 15.0.

  - bsc#1094725: `virsh blockresize` does not work with Xen     qdisks.

  - bsc#1094913: QEMU crashes when starting a guest with     more than 7.999TB.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu to version 2.11.2 fixes the following issues :

Security issue fixed :

  - CVE-2018-11806: Fix heap buffer overflow issue that can     happen while reassembling fragmented datagrams     (bsc#1096223).

  - CVE-2018-3639: Mitigation functionality for Speculative     Store Bypass issue in x86 (bsc#1087082).

  - CVE-2018-7550: Fix out of bounds read and write memory     access, potentially leading to code execution     (bsc#1083291)

Bug fixes :

  - bsc#1091695: SEV guest will not lauchh with     qemu-system-x86_64 version 2.11.1.

  - bsc#1094898: qemu-guest-agent service doesn't work in     version Leap 15.0.

  - bsc#1094725: `virsh blockresize` does not work with Xen     qdisks.

  - bsc#1094913: QEMU crashes when starting a guest with     more than 7.999TB.

This update was imported from the SUSE:SLE-15:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4285 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. (CVE-2017-5715 bsc#1068032) The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution. We replaced our initial patch by the patches from upstream. This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either
-IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used. Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient. A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see:
https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/ A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276) These two patches will be removed when we can reasonably assume everyone is running with the appropriate updates. Spectre fixes for IBM Z Series were included by providing more hw features to guests (bsc#1076813) Also security fixes for the following CVE issues are included :

  - CVE-2017-17381: The Virtio Vring implementation in QEMU     allowed local OS guest users to cause a denial of     service (divide-by-zero error and QEMU process crash) by     unsetting vring alignment while updating Virtio rings.
    (bsc#1071228)

  - CVE-2017-16845: The PS2 driver in Qemu did not validate     'rptr' and 'count' values during guest migration,     leading to out-of-bounds access. (bsc#1068613)

  - CVE-2017-15119: The Network Block Device (NBD) server in     Quick Emulator (QEMU), was vulnerable to a denial of     service issue. It could occur if a client sent large     option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this     flaw to keep the NBD server from serving other requests,     resulting in DoS. (bsc#1070144)

  - CVE-2017-18043: Integer overflow in the macro ROUND_UP     (n, d) in Quick Emulator (Qemu) allowed a user to cause     a denial of service (Qemu process crash). (bsc#1076775)

  - CVE-2018-5683: The VGA driver in Qemu allowed local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation.
    (bsc#1076114)

  - CVE-2018-7550: The multiboot functionality in Quick     Emulator (aka QEMU) allowed local guest OS users to     execute arbitrary code on the QEMU host via an     out-of-bounds read or write memory access. (bsc#1083291)

  - CVE-2017-15124: VNC server implementation in Quick     Emulator (QEMU) was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause     DoS to the server host. (bsc#1073489) Additional bugs     fixed :

  - Fix pcihp for 1.6 and older machine types (bsc#1074572)

  - Fix packaging dependencies (coreutils) for qemu-ksm     package (bsc#1040202)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201804-08 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could execute arbitrary code, cause a Denial of Service       condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109672	SUSE SLES12 Security Update : xen (SUSE-SU-2018:1177-1) (Meltdown)	Nessus	SuSE Local Security Checks	2018/5/10	2026/1/13	high
109755	RHEL 7 : qemu-kvm-rhev (RHSA-2018:1369)	Nessus	Red Hat Local Security Checks	2018/5/14	2024/10/8	high
111807	Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20180816)	Nessus	Scientific Linux Local Security Checks	2018/8/17	2024/8/19	high
194006	RHEL 7 : qemu-kvm-rhev (RHSA-2018:1645)	Nessus	Red Hat Local Security Checks	2024/4/27	2026/1/9	high
120081	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2018:2340-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/1/2	2026/1/9	high
123271	openSUSE Security Update : qemu (openSUSE-2019-620) (Spectre)	Nessus	SuSE Local Security Checks	2019/3/27	2026/1/9	high
180778	Oracle Linux 7 : qemu (ELSA-2018-4285)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/1/9	critical
108533	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2018:0762-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/3/22	2024/12/19	critical
108929	GLSA-201804-08 : QEMU: Multiple vulnerabilities (Spectre)	Nessus	Gentoo Local Security Checks	2018/4/10	2024/11/12	critical

检测

插件搜索

high

high

high

high

high

high

critical

critical

critical

critical