The remote host is affected by the vulnerability described in GLSA-202003-66 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could possibly execute arbitrary code with the privileges of       the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Security Fix(es) :

  - QEMU: Slirp: potential OOB access due to unsafe     snprintf() usages

Bug Fix(es) :

  - QEMU: Slirp: disable emulation of tcp programs like ftp     IRC etc. [rhel-6]

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:2774 advisory.

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in     deflateEnd. (CVE-2019-20382)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0889 advisory.

    The slirp4netns package contains user-mode networking for unprivileged network namespaces. It is required     to enable networking for rootless containers.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

    * CVE-2020-8608 slirp4netns: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

    * CVE-2019-15890 QEMU: Slirp: use-after-free during packet reassembly

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that incorrect memory handling in the SLIRP networking implementation could result in denial of service or potentially the execution of arbitrary code.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2342 advisory.

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

  - QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3040 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In QEMU through 5.0.0, an integer overflow was found in     the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write     operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to     crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial     of service.(CVE-2020-12829)

  - slirp.c in libslirp through 4.3.1 has a buffer     over-read because it tries to read a certain amount of     header data even if that exceeds the total packet     length.(CVE-2020-29130)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read     because it tries to read a certain amount of header     data even if that exceeds the total packet     length.(CVE-2020-29129)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop     via an RX descriptor with a NULL buffer     address.(CVE-2020-28916)

  - ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can     encounter an outside-limits situation in a calculation.
    A guest can crash the QEMU process.(CVE-2020-27616)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows     guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a     valid Layer 3 protocol.(CVE-2020-27617)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based     buffer over-read via values obtained from the host     controller driver.(CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop     when a TD list has a loop.(CVE-2020-25625)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - A flaw was found in the memory management API of QEMU     during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access     to the MSI-X table while performing MMIO operations. A     guest user may abuse this flaw to crash the QEMU     process on the host, resulting in a denial of service.
    This flaw affects QEMU versions prior to     5.2.0.(CVE-2020-27821)

  - QEMU: reachable assertion failure in     net_tx_pkt_add_raw_fragment() in hw/net/net_tx_pkt.c     (CVE-2020-16092)

  - hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to     trigger an out-of-bounds access by providing an address     near the end of the PCI configuration     space(CVE-2020-13791)

  - qmp_guest_file_read in qga/commands-posix.c and     qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent)     in QEMU 2.12.50 has an integer overflow causing a     g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The     vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count     value) to the agent via the listening     socket.(CVE-2018-12617)

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an     unvalidated address, which leads to an out-of-bounds     read during sdhci_write() operations. A guest OS user     can crash the QEMU process.(CVE-2020-13253)

  - QEMU 4.1.0 has a memory leak in zrle_compress_data in     ui/vnc-enc-zrle.c during a VNC disconnect operation     because libz is misused, resulting in a situation where     memory allocated in deflateInit2 is not freed in     deflateEnd.(CVE-2019-20382)

  - An integer overflow was found in QEMU 4.0.1 through     4.2.0 in the way it implemented ATI VGA emulation. This     flaw occurs in the ati_2d_blt() routine in     hw/display/ati-2d.c while handling MMIO write     operations through the ati_mm_write() callback. A     malicious guest could abuse this flaw to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-11869)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2020-13659)

  - A flaw was found in QEMU in the implementation of the     Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A     general failure of the signature generation process     caused every PAuth-enforced pointer to be signed with     the same signature. A local attacker could obtain the     signature of a protected pointer and abuse this flaw to     bypass PAuth protection for all programs running on     QEMU.(CVE-2020-10702)

  - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU     before 07-20-2020 has a buffer overflow. This occurs     during packet transmission and affects the highbank and     midway emulated machines. A guest user or process could     use this flaw to crash the QEMU process on the host,     resulting in a denial of service or potential     privileged code execution. This was fixed in commit     5519724a13664b43e225ca05351c60b4468e4555.(CVE-2020-1586     3)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in     hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS     user.(CVE-2020-13362)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in     hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an     out-of-bounds access during an es1370_write()     operation.(CVE-2020-13361)

  - rom_copy() in hw/core/loader.c in QEMU 4.1.0 does not     validate the relationship between two addresses, which     allows attackers to trigger an invalid memory copy     operation.(CVE-2020-13765)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a     use-after-free in ip_reass in     ip_input.c.(CVE-2019-15890)

  - A use after free vulnerability in ip_reass() in     ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of     service.(CVE-2020-1983)

  - ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest     OS users to trigger infinite recursion via a crafted     mm_index value during an ati_mm_read or ati_mm_write     call.(CVE-2020-13800)

  - An out-of-bounds heap buffer access flaw was found in     the way the iSCSI Block driver in QEMU versions 2.12.0     before 4.2.1 handled a response coming from an iSCSI     server while checking the status of a Logical Address     Block (LBA) in an iscsi_co_block_status() routine. A     remote user could use this flaw to crash the QEMU     process, resulting in a denial of service or potential     execution of arbitrary code with privileges of the QEMU     process on the host.(CVE-2020-1711)

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of     libslirp before 4.3.1.(CVE-2020-10756)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:2774 advisory.

  - QEMU: vnc: memory leakage upon disconnect (CVE-2019-20382)

  - QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

bsc#1174543 - secure boot related fixes

bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages

bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy

bsc#1168140 - CVE-2020-11740, CVE-2020-11741: Multiple xenoprof issues

bsc#1168142 - CVE-2020-11739: Missing memory barriers in read-write unlock paths

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0252 advisory.

    This advisory aggregates security fixes for the qemu-kvm SRPM in CIQ LTS 8.6. It addresses 49 CVEs:
    CVE-2020-14364, CVE-2019-11091, CVE-2021-20221, CVE-2024-3446, CVE-2018-12130, and 44 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has qemu-kvm packages installed that are affected by multiple vulnerabilities:

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code. (CVE-2020-7039)

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1918-1 advisory.

    - CVE-2020-10756: Fix out-of-bounds read information disclosure in icmp6_send_echoreply (bsc#1172380)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:1942-1 advisory.

    - Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream     (bsc#1181103)
    - Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681,     CVE-2021-3409, bsc#1182282)
    - Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
    - Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
    - Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
    - Fix package scripts to not use hard coded paths for temporary working directories and log files     (bsc#1182425)
    - QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
    - For the record, these issues are fixed in this package already.
      Most are alternate references to previously mentioned issues:
      (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019,       CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683,       CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477,       CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1942-1 advisory.

    - Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream     (bsc#1181103)
    - Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681,     CVE-2021-3409, bsc#1182282)
    - Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
    - Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
    - Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
    - Fix package scripts to not use hard coded paths for temporary working directories and log files     (bsc#1182425)
    - QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
    - For the record, these issues are fixed in this package already.
      Most are alternate references to previously mentioned issues:
      (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019,       CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683,       CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477,       CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135021	GLSA-202003-66 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2020/3/31	2024/3/20	high
135382	Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200408)	Nessus	Scientific Linux Local Security Checks	2020/4/10	2020/10/15	medium
184607	Rocky Linux 8 : virt:rhel (RLSA-2020:2774)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	medium
138073	RHEL 7 : slirp4netns (RHSA-2020:0889)	Nessus	Red Hat Local Security Checks	2020/7/2	2024/11/7	high
138914	Debian DSA-4733-1 : qemu - security update	Nessus	Debian Local Security Checks	2020/7/27	2020/11/6	medium
170294	RHEL 7 : qemu-kvm-rhev bug fix update (Important) (RHSA-2020:2342)	Nessus	Red Hat Local Security Checks	2023/1/23	2023/1/24	high
143036	RHEL 8 : virt:rhel (RHSA-2020:3040)	Nessus	Red Hat Local Security Checks	2020/11/18	2024/11/5	medium
147700	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-1667)	Nessus	Huawei Local Security Checks	2021/3/11	2022/5/10	high
145861	CentOS 8 : virt:rhel (CESA-2020:2774)	Nessus	CentOS Local Security Checks	2021/2/1	2023/2/8	medium
139595	SUSE SLES12 Security Update : xen (SUSE-SU-2020:2234-1)	Nessus	SuSE Local Security Checks	2020/8/14	2024/2/26	high
355166	Rocky Linux 8.6 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (ciqsa-2026_0252)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
147408	NewStart CGSL MAIN 4.06 : qemu-kvm Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/5/10	high
150468	SUSE SLES15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-oss / qemu-audio-pa / etc (SUSE-SU-2021:1918-1)	Nessus	SuSE Local Security Checks	2021/6/10	2026/6/25	medium
150736	SUSE SLED15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-pa / etc (SUSE-SU-2021:1942-1)	Nessus	SuSE Local Security Checks	2021/6/12	2026/6/25	medium
151714	openSUSE 15 Security Update : qemu (openSUSE-SU-2021:1942-1)	Nessus	SuSE Local Security Checks	2021/7/16	2025/12/30	medium

检测

插件搜索

high

medium

medium

high

medium

high

medium

high

medium

high

critical

high

medium

medium

medium