Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an
    out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A
    privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute
    arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)

  - Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to
    cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x
    (PRO100) NIC device. (CVE-2016-9101)

  - Memory leak in the v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local
    guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) via a
    large number of Txattrcreate messages with the same fid number. (CVE-2016-9102)

  - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS
    administrators to obtain sensitive host heap memory information by reading xattribute values before
    writing to them. (CVE-2016-9103)

  - Multiple integer overflows in the (1) v9fs_xattr_read and (2) v9fs_xattr_write functions in hw/9pfs/9p.c
    in QEMU (aka Quick Emulator) allow local guest OS administrators to cause a denial of service (QEMU
    process crash) via a crafted offset, which triggers an out-of-bounds access. (CVE-2016-9104)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an
    out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A
    privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute
    arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)

  - Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick
    Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a
    large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands. (CVE-2016-7994)

  - Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows
    local guest OS administrators to cause a denial of service (memory consumption) via a large number of
    crafted buffer page select (PG) indexes. (CVE-2016-7995)

  - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS
    administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure
    to limit the number of link Transfer Request Blocks (TRB) to process. (CVE-2016-8576)

  - Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS
    administrators to cause a denial of service (memory consumption) via vectors related to an I/O read
    operation. (CVE-2016-8577)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4713 advisory.

    - Document CVEs as fixed: CVE-2017-9524, CVE-2017-6058, CVE-2017-5931 (Mark Kanda)  [Orabug: 29886908]     {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-9524}
    - pvrdma: release device resources in case of an error (Prasad J Pandit)  [Orabug: 29056678]     {CVE-2018-20123}
    - qxl: check release info object (Prasad J Pandit)  [Orabug: 29886906]  {CVE-2019-12155}
    - target/i386: add MDS-NO feature (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}
    - docs: recommend use of md-clear feature on all Intel CPUs (Daniel P. Berrange)  [Orabug: 29820428]     {CVE-2018-12126} {CVE-2018-12127} {CVE-2018-12130} {CVE-2019-11091}
    - target/i386: define md-clear bit (Paolo Bonzini)  [Orabug: 29820428]  {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201702-28 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A local attacker could potentially execute arbitrary code with       privileges of QEMU process on the host, gain privileges on the host       system, cause a Denial of Service condition, or obtain sensitive       information.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
406784	Alpine: multiple qemu packages: security update to 2.8.1.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406784	Alpine: multiple qemu packages: security update to 2.8.1.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
406783	Alpine: multiple qemu packages: security update to 2.8.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406783	Alpine: multiple qemu packages: security update to 2.8.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
400893	Alpine: multiple qemu packages: security update to 2.8.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400893	Alpine: multiple qemu packages: security update to 2.8.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
126673	Oracle Linux 7 : qemu (ELSA-2019-4713)	Nessus	Oracle Linux Local Security Checks	high
97271	GLSA-201702-28 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-5931

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical