An update of the libvirt package has been released.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6734-1 advisory.

    Alexander Kuznetsov discovered that libvirt incorrectly handled certain API calls. An attacker could     possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-1441)

    It was discovered that libvirt incorrectly handled certain RPC library API calls. An attacker could     possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-2494)

    It was discovered that libvirt incorrectly handled detaching certain host interfaces. An attacker could     possibly use this issue to cause libvirt to crash, resulting in a denial of service. (CVE-2024-2496)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0962 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-2494:
    A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory     for arrays before the non-negative length check is performed by the C API entry points. Passing a negative     length to the g_new0 function results in a crash due to the negative length being treated as a huge     positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by     causing the libvirt daemon to crash.

    CVE-2024-2496:
    A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This     issue can occur when detaching a host interface while at the same time collecting the list of interfaces     via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by     causing the libvirt daemon to crash.

    CVE-2024-1441:
    An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number     of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially     crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack     by causing the libvirt daemon to crash.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0143 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-3255:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service.

    CVE-2023-5088:
    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

    CVE-2023-6683:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service.

    CVE-2023-6693:
    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak.

    CVE-2024-2494:
    A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory     for arrays before the non-negative length check is performed by the C API entry points. Passing a negative     length to the g_new0 function results in a crash due to the negative length being treated as a huge     positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by     causing the libvirt daemon to crash.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0 advisory.

  - A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in     ntfs_get_attribute_value, in NTFS-3G < 2021.8.22. (CVE-2021-39263)

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a     denial of service via a crafted script. (CVE-2020-24736)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote     attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the     KeyTrap issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the     protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG     records. (CVE-2023-50387)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.102001 advisory.

  - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different     vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link     and then contents under the same filename in a filesystem can cause unsquashfs to first create the     symbolic link pointing outside the expected directory, and then the subsequent write operation will cause     the unsquashfs process to write through the symbolic link elsewhere in the filesystem. (CVE-2021-41072)

  - linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login     process) via mkfifo because the openat call (for protect_dir) lacks O_DIRECTORY. (CVE-2024-22365)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

  - The DNS message parsing code in `named` includes a section whose computational complexity is overly high.
    It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive     CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative     servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through     9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1     through 9.18.21-S1. (CVE-2023-4408)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6734-2 advisory.

    USN-6734-1 fixed vulnerabilities in libvirt. This update provides the corresponding updates for Ubuntu     24.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3253 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: negative g_new0 length can lead to unbounded memory allocation (CVE-2024-2494)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202412-16 (libvirt: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has libvirt packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory     for arrays before the non-negative length check is performed by the C API entry points. Passing a negative     length to the g_new0 function results in a crash due to the negative length being treated as a huge     positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by     causing the libvirt daemon to crash. (CVE-2024-2494)

  - An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number     of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially     crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack     by causing the libvirt daemon to crash. (CVE-2024-1441)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1099-1 advisory.

    - CVE-2024-2494: Add a check for negative array lengths before allocation to prevent potential DoS.
    (bsc#1221815)
    - CVE-2024-2496: Fixed NULL pointer dereference in udevConnectListAllInterfaces() (bsc#1221468).
    - CVE-2024-1441: Fix off-by-one error in udevListInterfacesByStatus (bsc#1221237)
    - qemu: domain: Fix logic when tainting domain (bsc#1220512)
    - conf: Remove some firmware validation checks (bsc#1216980)
    - libxl: Fix connection to modular network daemon (bsc#1214223)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205192	Photon OS 3.0: Libvirt PHSA-2024-3.0-0749	Nessus	PhotonOS Local Security Checks	2024/8/8	2025/5/16	medium
193342	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : libvirt vulnerabilities (USN-6734-1)	Nessus	Ubuntu Local Security Checks	2024/4/15	2025/5/16	medium
238791	TencentOS Server 4: libvirt (TSSA-2024:0962)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
235990	Alibaba Cloud Linux 3 : 0143: virt:rhel (ALINUX3-SA-2024:0143)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
310786	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0)	Nessus	Misc.	2026/4/29	2026/8/13	medium
208276	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102001)	Nessus	Misc.	2024/10/8	2025/10/6	medium
333715	Photon OS 5.0: Libvirt PHSA-2024-5.0-91-0246	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/11/2	medium
194729	Ubuntu 24.04 LTS. : libvirt vulnerabilities (USN-6734-2)	Nessus	Ubuntu Local Security Checks	2024/4/29	2025/5/16	medium
197754	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2024:3253)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/4/29	medium
212331	GLSA-202412-16 : libvirt: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/12/11	2024/12/11	medium
237989	NewStart CGSL MAIN 7.02 : libvirt Multiple Vulnerabilities (NS-SA-2025-0071)	Nessus	NewStart CGSL Local Security Checks	2025/6/9	2025/6/18	medium
193074	SUSE SLED15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2024:1099-1)	Nessus	SuSE Local Security Checks	2024/4/9	2026/6/26	medium

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium