The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2260-1 advisory.

  - A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4206)

  - A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

  - A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for     CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and     other unexpected results. Affected QEMU version: 6.2.0. (CVE-2022-26353)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the     ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
    (CVE-2019-20808)

  - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability. (CVE-2021-20257)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while     handling a 'PVRDMA_CMD_CREATE_MR' command due to improper memory remapping (mremap). This flaw allows a     malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to     system availability. (CVE-2021-3582)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the bootp_input() function and could occur while processing a udp packet that is smaller than     the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of     uninitialized heap memory from the host. The highest threat from this vulnerability is to data     confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp6_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0. (CVE-2021-3593)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0. (CVE-2021-3594)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0. (CVE-2021-3595)

  - An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions     prior to 6.1.0. The issue occurs while handling a 'PVRDMA_REG_DSRHIGH' write from the guest due to     improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount     of memory, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2021-3607)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to     6.1.0. The issue occurs while handling a 'PVRDMA_REG_DSRHIGH' write from the guest and may result in a     crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest     threat from this vulnerability is to system availability. (CVE-2021-3608)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

  - An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
    (CVE-2021-3930)

  - A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0.
    The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A     malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host     when writing data reaches the threshold of mirroring node. (CVE-2021-4145)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5821 advisory.

    libvirt     [8.0.0-5.2.0.1]
    - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554]
    - Add runtime deps for pkg librbd1 >= 1:10.2.5 (Keshav Sharma)

    [8.0.0-5.2.el8]
    - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#2084030)
    - cputest: Drop some old artificial baseline tests (rhbz#2084030)
    - cputest: Give better names to baseline tests (rhbz#2084030)
    - cputest: Add some real world baseline tests (rhbz#2084030)
    - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#2084030)
    - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#2084030)
    - cpu_x86: Penalize disabled features when computing CPU model (rhbz#2084030)
    - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#2084030)

    [8.0.0-5.1.el8]
    - conf: Introduce memory allocation threads (rhbz#2075569)
    - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2075569)
    - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2075569)
    - qemu_command: Generate prealloc-threads property (rhbz#2075569)

    virt-v2v     [1:1.42.0-19.0.1]
    - replaced upstream references [Orabug:34095529]

    [1:1.42.0-19]
    - If listing RPM applications fails, rebuild DB and retry       resolves: rhbz#2093415

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:5263 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.101026 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers     option from a DHCPv6 Advertise message. This vulnerability can be exploited by an attacker to gain     unauthorized access and potentially lead to a loss of Confidentiality, Integrity and/or Availability.
    (CVE-2023-45234)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

  - The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped)     allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC     responses in a random subdomain attack, aka the NSEC3 issue. The RFC 5155 specification implies that an     algorithm must perform thousands of iterations of a hash function in certain situations. (CVE-2023-50868)

  - close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. (CVE-2022-48624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-9432 advisory.

    - virtio-net: fix map leaking on error during receive (Jason Wang)  [Orabug: 33941879]  {CVE-2022-26353}
    - vhost-vsock: detach the virqueue element in case of error (Stefano Garzarella)  [Orabug: 33941844]     {CVE-2022-26354}
    - virtio-net: fix use after unmap/free for sg (Jason Wang)  [Orabug: 33972912]  {CVE-2021-3748}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5489-1 advisory.

    Alexander Bulekov discovered that QEMU incorrectly handled floppy disk emulation. A privileged attacker     inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or     possibly leak sensitive information. (CVE-2021-3507)

    It was discovered that QEMU incorrectly handled NVME controller emulation. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2021-3929)

    It was discovered that QEMU incorrectly handled QXL display device emulation. A privileged attacker inside     the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2021-4206, CVE-2021-4207)

    Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that QEMU incorrectly handled the virtiofsd     shared file system daemon. An attacker inside the guest could use this issue to create files with     incorrect ownership, possibly leading to privilege escalation. This issue only affected Ubuntu 22.04 LTS.
    (CVE-2022-0358)

    It was discovered that QEMU incorrectly handled virtio-net devices. A privileged attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2022-26353)

    It was discovered that QEMU incorrectly handled vhost-vsock devices. A privileged attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2022-26354)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-5263 advisory.

    - Resolves: bz#2075635       (CVE-2022-26353 qemu-kvm: QEMU: virtio-net: map leaking on error during receive [rhel-9] [rhel-9.0.0.z])
    - Resolves: bz#2075640       (CVE-2022-26354 qemu-kvm: QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak     [rhel-9] [rhel-9.0.0.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in     the storagePoolLookupByTargetPath function where a locked virStoragePoolObj object is not properly     released on ACL permission failure. Clients connecting to the read-write socket with limited ACL     permissions could use this flaw to acquire the lock and prevent other users from accessing storage     pool/volume APIs, resulting in a denial of service condition. The highest threat from this vulnerability     is to system availability. (CVE-2021-3667)

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5821 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow (CVE-2021-4206)

    * QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow (CVE-2021-4207)

    * QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353)

    * QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * RHEL 9.0 guest with vsock device migration failed from RHEL 9.0 > RHEL 8.6 (BZ#2071103)

    * Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs) (BZ#2072242)

    * Remove upstream-only devices from the qemu-kvm binary (BZ#2077928)

    * When doing a cpu-baseline between skylake and cascadelake, cascadelake is selected as baseline.
    (BZ#2084030)

    * Virt-v2v can't convert rhel8.6 guest from VMware on rhel8.6 (BZ#2093415)

    Enhancement(s):

    * Allow memory prealloc from multiple threads (BZ#2075569)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2022:5821 advisory.

  - QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow (CVE-2021-4206)

  - QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow (CVE-2021-4207)

  - QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353)

  - QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-4021:02 advisory.

    * QEMU: virtio-net: map leaking on error during receive (CVE-2022-26353)
      * QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak (CVE-2022-26354)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
162711	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2022:2260-1)	Nessus	SuSE Local Security Checks	2022/7/5	2023/7/13	high
163161	EulerOS Virtualization 2.10.0 : qemu (EulerOS-SA-2022-2043)	Nessus	Huawei Local Security Checks	2022/7/14	2023/10/18	high
163175	EulerOS Virtualization 2.10.1 : qemu (EulerOS-SA-2022-2071)	Nessus	Huawei Local Security Checks	2022/7/14	2023/10/18	high
163859	Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-5821)	Nessus	Oracle Linux Local Security Checks	2022/8/5	2024/11/1	high
167691	AlmaLinux 9 : qemu-kvm (ALSA-2022:5263)	Nessus	Alma Linux Local Security Checks	2022/11/16	2022/11/17	high
206824	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.101026)	Nessus	Misc.	2024/9/9	2025/10/6	medium
161622	Oracle Linux 7 : qemu (ELSA-2022-9432)	Nessus	Oracle Linux Local Security Checks	2022/5/27	2024/11/1	high
162426	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : QEMU vulnerabilities (USN-5489-1)	Nessus	Ubuntu Local Security Checks	2022/6/21	2025/9/3	high
162783	Oracle Linux 9 : qemu-kvm (ELSA-2022-5263)	Nessus	Oracle Linux Local Security Checks	2022/7/7	2024/11/1	high
163613	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2022-2213)	Nessus	Huawei Local Security Checks	2022/7/29	2023/10/17	high
163729	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2022:5821)	Nessus	Red Hat Local Security Checks	2022/8/2	2025/4/8	high
163754	CentOS 8 : virt:rhel and virt-devel:rhel (CESA-2022:5821)	Nessus	CentOS Local Security Checks	2022/8/3	2023/10/17	high
293551	MiracleLinux 9 : qemu-kvm-6.2.0-11.el9.3 (AXSA:2022-4021:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high

检测

插件搜索

high

high

high

high

high

medium

high

high

high

high

high

high

high