The remote OracleVM system is missing necessary patches to address critical security updates :

  - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331407]

  - kvm-vga.h-remove-unused-stuff-and-reformat.patch     [bz#1331407]

  - kvm-vga-use-constants-from-vga.h.patch [bz#1331407]

  -     kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patc     h [bz#1331407]

  -     kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710.
    patch [bz#1331407]

  - kvm-vga-add-vbe_enabled-helper.patch [bz#1331407]

  - kvm-vga-factor-out-vga-register-setup.patch [bz#1331407]

  - kvm-vga-update-vga-register-setup-on-vbe-changes.patch     [bz#1331407]

  -     kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac     .patch 

  - Resolves: bz#1331407 (EMBARGOED CVE-2016-3710 qemu-kvm:
    qemu: incorrect banked access bounds checking in vga     module [rhel-6.8.z])

  - Revert 'warning when CPU threads>1 for non-Intel CPUs'     fix

  -     kvm-qemu-ga-implement-win32-guest-set-user-password.patc     h [bz#1174181]

  - kvm-util-add-base64-decoding-function.patch [bz#1174181]

  - kvm-qga-convert-to-use-error-checked-base64-decode.patch     [bz#1174181]

  -     kvm-qga-use-more-idiomatic-qemu-style-eol-operators.patc     h [bz#1174181]

  - kvm-qga-use-size_t-for-wcslen-return-value.patch     [bz#1174181]

  -     kvm-qga-use-wide-chars-constants-for-wchar_t-comparisons     .patch 

  - kvm-qga-fix-off-by-one-length-check.patch [bz#1174181]

  - kvm-qga-check-utf8-to-utf16-conversion.patch     [bz#1174181]

  - Resolves: bz#1174181 (RFE: provide QEMU guest agent     command for setting root account password (Linux guest))

  - kvm-hw-qxl-qxl_send_events-nop-if-stopped.patch     [bz#1290743]

  -     kvm-block-mirror-fix-full-sync-mode-when-target-does-not     .patch [bz#971312]

  - Resolves: bz#1290743 (qemu-kvm core dumped when repeat     system_reset 20 times during guest boot)

  - Resolves: bz#971312 (block: Mirroring to raw block     device doesn't zero out unused blocks)

  - Mon Feb 08 2016 Miroslav Rezanina < - 0.12.1.2-2.488.el6

  - Fixed qemu-ga path configuration [bz#1213233]

  - Resolves: bz#1213233 ([virtagent] The default path     '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script     doesn't exist)

  -     kvm-virtio-scsi-use-virtqueue_map_sg-when-loading-reques     .patch 

  - kvm-scsi-disk-fix-cmd.mode-field-typo.patch [bz#1249740]

  - Resolves: bz#1249740 (Segfault occurred at Dst VM while     completed migration upon ENOSPC)

  -     kvm-blockdev-Error-out-on-negative-throttling-option-val     .patch 

  -     kvm-fw_cfg-add-check-to-validate-current-entry-value-CVE     .patch 

  - Resolves: bz#1294619 (Guest should failed to boot if set     iops,bps to negative number)

  - Resolves: bz#1298046 (CVE-2016-1714 qemu-kvm: Qemu:
    nvram: OOB r/w access in processing firmware     configurations [rhel-6.8])

  - kvm-Change-fsfreeze-hook-default-location.patch     [bz#1213233]

  - kvm-qxl-replace-pipe-signaling-with-bottom-half.patch     [bz#1290743]

  - Resolves: bz#1213233 ([virtagent] The default path     '/etc/qemu/fsfreeze-hook' for 'fsfreeze-hook' script     doesn't exist)

  - Resolves: bz#1290743 (qemu-kvm core dumped when repeat     system_reset 20 times during guest boot)

  - kvm-qga-flush-explicitly-when-needed.patch [bz#1210246]

  - kvm-qga-add-guest-set-user-password-command.patch     [bz#1174181]

  -     kvm-qcow2-Zero-initialise-first-cluster-for-new-images.p     atch [bz#1223216]

  -     kvm-Documentation-Warn-against-qemu-img-on-active-image.
    patch [bz#1297424]

  -     kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I     .patch 

  - kvm-qemu-options-Fix-texinfo-markup.patch [bz#1250442]

  - kvm-qga-Fix-memory-allocation-pasto.patch []

  -     kvm-block-raw-posix-Open-file-descriptor-O_RDWR-to-work-     .patch 

  - Resolves: bz#1174181 (RFE: provide QEMU guest agent     command for setting root/administrator account password)

  - Resolves: bz#1210246 ([virtagent]The 'write' content is     lost if 'read' it before flush through guest agent)

  - Resolves: bz#1223216 (qemu-img can not create qcow2     image when backend is block device)

  - Resolves: bz#1250442 (qemu-doc.html bad markup in     section 3.3 Invocation)

  - Resolves: bz#1268347 (posix_fallocate emulation on NFS     fails with Bad file descriptor if fd is opened O_WRONLY)

  - Resolves: bz#1292678 (Qemu should report error when     cmdline set threads=2 in amd host)

  - Resolves: bz#1297424 (Add warning about running qemu-img     on active VMs to its manpage)

  - kvm-rtl8139-Fix-receive-buffer-overflow-check.patch     [bz#1262866]

  -     kvm-rtl8139-Do-not-consume-the-packet-during-overflow-in     .patch 

  - Resolves: bz#1262866 ([RHEL6] Package is 100% lost when     ping from host to Win2012r2 guest with 64000 size)

  -     kvm-qemu-kvm-get-put-MSR_TSC_AUX-across-reset-and-migrat     .patch 

  -     kvm-qcow2-Discard-VM-state-in-active-L1-after-creating-s     .patch 

  -     kvm-net-pcnet-add-check-to-validate-receive-data-size-CV     .patch 

  - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch     [bz#1286567]

  - Resolves: bz#1219908 (Writing snapshots with 'virsh     snapshot-create-as' command slows as more snapshots are     created)

  - Resolves: bz#1265428 (contents of MSR_TSC_AUX are not     migrated)

  - Resolves: bz#1286567 (CVE-2015-7512 qemu-kvm: Qemu: net:
    pcnet: buffer overflow in non-loopback mode [rhel-6.8])

  -     kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE-     .patch 

  - Resolves: bz#1263275 (CVE-2015-5279 qemu-kvm: qemu: Heap     overflow vulnerability in ne2000_receive function     [rhel-6.8])

  -     kvm-virtio-rng-fix-segfault-when-adding-a-virtio-pci-rng     .patch 

  - kvm-qga-commands-posix-Fix-bug-in-guest-fstrim.patch     [bz#1213236]

  -     kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20     .patch 

  -     kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-     .patch 

  -     kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE     .patch 

  -     kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.p     atch [bz#1248763]

  -     kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.pa     tch [bz#1248763]

  -     kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51     .patch 

  -     kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.pa     tch [bz#1248763]

  - Resolves: bz#1213236 ([virtagent] 'guest-fstrim' failed     for guest with os on spapr-vscsi disk)

  - Resolves: bz#1230068 (Segmentation fault when re-adding     virtio-rng-pci device)

  - Resolves: bz#1248763 (CVE-2015-5165 qemu-kvm: Qemu:
    rtl8139 uninitialized heap memory information leakage to     guest [rhel-6.8])

Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.

An information leak flaw was found in the way QEMU's RTL8139 emulation implementation processed network packets under RTL8139 controller's C+ mode of operation. An unprivileged guest user could use this flaw to read up to 65 KB of uninitialized QEMU heap memory. (CVE-2015-5165)

Red Hat would like to thank the Xen project for reporting this issue.
Upstream acknowledges Donghai Zhu of Alibaba as the original reporter.

All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2724-1 advisory.

    It was discovered that QEMU incorrectly handled a PRDT with zero complete sectors in the IDE     functionality. A malicious guest could possibly use this issue to cause a denial of service. This issue     only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9718)

    Donghai Zhu discovered that QEMU incorrectly handled the RTL8139 driver. A malicious guest could possibly     use this issue to read sensitive information from arbitrary host memory. (CVE-2015-5165)

    Donghai Zhu discovered that QEMU incorrectly handled unplugging emulated block devices. A malicious guest     could use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the     user running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers     would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 15.04. (CVE-2015-5166)

    Qinghao Tang and Mr. Zuozhi discovered that QEMU incorrectly handled memory in the VNC display driver. A     malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary code on     the host as the user running the QEMU process. In the default installation, when QEMU is used with     libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu     15.04. (CVE-2015-5225)

    It was discovered that QEMU incorrectly handled the virtio-serial device. A malicious guest could use this     issue to cause a denial of service, or possibly execute arbitrary code on the host as the user running the     QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be isolated by     the libvirt AppArmor profile. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-5745)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

xen was updated to fix 13 security issues.

These security issues were fixed :

  - CVE-2015-7972: Populate-on-demand balloon size     inaccuracy can crash guests (bsc#951845).

  - CVE-2015-7969: Leak of main per-domain vcpu pointer     array (DoS) (bsc#950703).

  - CVE-2015-7969: Leak of per-domain profiling-related vcpu     pointer array (DoS) (bsc#950705).

  - CVE-2015-7971: Some pmu and profiling hypercalls log     without rate limiting (bsc#950706).

  - CVE-2015-4037: Insecure temporary file use in     /net/slirp.c (bsc#932267).

  - CVE-2014-0222: Validate L2 table size to avoid integer     overflows (bsc#877642).

  - CVE-2015-7835: Uncontrolled creation of large page     mappings by PV guests (bsc#950367).

  - CVE-2015-7311: libxl fails to honour readonly flag on     disks with qemu-xen (bsc#947165).

  - CVE-2015-5165: QEMU leak of uninitialized heap memory in     rtl8139 device model (bsc#939712).

  - CVE-2015-5166: Use after free in QEMU/Xen block unplug     protocol (bsc#939709).

  - CVE-2015-5239: Integer overflow in vnc_client_read() and     protocol_client_msg() (bsc#944463).

  - CVE-2015-6815: e1000: infinite loop issue (bsc#944697).

  - CVE-2015-5154: Host code execution via IDE subsystem     CD-ROM (bsc#938344).

This non-security issues was fixed :

  - bsc#941074: VmError: Device 51728 (vbd) could not be     connected. Hotplug scripts not working.

This security update fixes a number of security issues in Xen in wheezy.

For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.1-1+deb7u1.

We recommend that you upgrade your libidn packages.

CVE-2015-2752

The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptable, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

CVE-2015-2756

QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.

CVE-2015-5165

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.

CVE-2015-5307

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.

CVE-2015-7969

Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of 'teardowns' of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.

CVE-2015-7970

The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial of service (CPU consumption and possibly reboot) via crafted memory contents that triggers a 'time-consuming linear scan,' related to Populate-on-Demand.

CVE-2015-7971

Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.

CVE-2015-7972

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to 'heavy memory pressure.'

CVE-2015-8104

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

CVE-2015-8339

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

CVE-2015-8340

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.

CVE-2015-8550

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability.

CVE-2015-8554

Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a 'write path.'

CVE-2015-8555

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.

CVE-2015-8615

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).

CVE-2016-1570

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXT_MARK_SUPER or (2) MMUEXT_UNMARK_SUPER sub-op in the HYPERVISOR_mmuext_op hypercall or (3) unknown vectors related to page table updates.

CVE-2016-1571

The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

CVE-2016-2270

Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.

CVE-2016-2271

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and     earlier, allows remote attackers to read process heap memory via unspecified vectors. (CVE-2015-5165)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91316	OracleVM 3.4 : qemu-kvm (OVMSA-2016-0051)	Nessus	OracleVM Local Security Checks	2016/5/25	2021/1/4	critical
86513	CentOS 6 : qemu-kvm (CESA-2015:1833)	Nessus	CentOS Local Security Checks	2015/10/22	2021/1/4	medium
85683	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2724-1)	Nessus	Ubuntu Local Security Checks	2015/8/28	2025/9/3	medium
86863	openSUSE Security Update : xen (openSUSE-2015-729)	Nessus	SuSE Local Security Checks	2015/11/13	2021/1/19	medium
91198	Debian DLA-479-1 : xen security update	Nessus	Debian Local Security Checks	2016/5/18	2021/1/11	high
218835	Linux Distros Unpatched Vulnerability : CVE-2015-5165	Nessus	Misc.	2025/3/4	2026/7/27	high

检测

插件搜索

critical

medium

medium

medium

high

high