A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

The remote host is affected by the vulnerability described in GLSA-202408-18 (QEMU: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a     crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading     to a use-after-free condition. (CVE-2022-1050)

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

  - A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not     prohibit opening special files on the host side, potentially allowing a malicious client to escape from     the exported 9p tree by creating and opening a device file in the shared folder. (CVE-2023-2861)

  - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
    (CVE-2023-3180)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3800-1 advisory.

    - CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)
    - CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)
    - CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)
    - CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)
    - CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS     handshake. (bsc#1212850)
    - CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)
    - CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).
    - CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).
    - CVE-2021-3750: Fixed DMA reentrancy issue leads to use-after-free in hcd-ehci (bsc#1190011).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3721-1 advisory.

    - CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)
    - CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)
    - CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)
    - CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)
    - CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS     handshake. (bsc#1212850)
    - CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)
    - CVE-2021-3638: Fixed an out-of-bounds write due to an inconsistent check in ati_2d_blt(). (bsc#1188609)
    - CVE-2021-3750: Fixed an use-after-free in DMA reentrancy issue. (bsc#1190011)
    - CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).
    - CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6167-1 advisory.

    It was discovered that QEMU did not properly manage the guest drivers when shared buffers are not     allocated. A malicious guest driver could use this issue to cause QEMU to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS     and Ubuntu 22.10. (CVE-2022-1050)

    It was discovered that QEMU did not properly check the size of the structure pointed to by the guest     physical address pqxl. A malicious guest attacker could use this issue to cause QEMU to crash, resulting     in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,     Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-4144)

    It was discovered that QEMU did not properly manage memory in the ACPI Error Record Serialization Table     (ERST) device. A malicious guest attacker could use this issue to cause QEMU to crash, resulting in a     denial of service. This issue only affected Ubuntu 22.10. (CVE-2022-4172)

    It was discovered that QEMU did not properly manage memory when DMA memory writes happen repeatedly in the     lsi53c895a device. A malicious guest attacker could use this issue to cause QEMU to crash, resulting in a     denial of service. (CVE-2023-0330)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0840-1 advisory.

    - CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt     (bsc#1205808).
    - CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).
    - CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).
    - CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).
    - CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).
    - CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12195 advisory.

    - hw/pvrdma: Protect against buggy or malicious guest driver (Yuval Shaia) [Orabug: 35064352]     {CVE-2022-1050}
    - hw/display/qxl: Avoid buffer overrun in qxl_phys2virt (CVE-2022-4144) (Philippe Mathieu-Daude) [Orabug:
    35060182] {CVE-2022-4144}
    - ui/vnc-clipboard: fix integer underflow in vnc_client_cut_text_ext (Mauro Matteo Cascella) [Orabug:
    35060115] {CVE-2022-3165}
    - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt) [Orabug: 34779541] {CVE-2022-4172}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0761-1 advisory.

    - bsc#1172033 (CVE-2020-13253)

    - bsc#1180207 (CVE-2020-14394)

    - bsc#1172382 (CVE-2020-13754)

    - bsc#1198038 (CVE-2022-0216)

    - bsc#1193880 (CVE-2021-3929)

    - bsc#1197653 (CVE-2022-1050)

    - bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

    - bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409),       bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414
    - About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

    - bsc#1198035, CVE-2021-4206

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3362 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3362-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     March 14, 2023                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : qemu     Version        : 1:3.1+dfsg-8+deb10u10     CVE ID         : CVE-2020-14394 CVE-2020-29130 CVE-2021-3592 CVE-2021-3593                      CVE-2021-3594 CVE-2021-3595 CVE-2022-0216 CVE-2022-1050     Debian Bug     : 970937 979677 986795 989993 989994 989995 989996 1014589 1014590

    Multiple security issues were discovered in QEMU, a fast processor     emulator, which could result in denial of service, information leak,     or potentially the execution of arbitrary code.

    CVE-2020-14394

        An infinite loop flaw was found in the USB xHCI controller         emulation of QEMU while computing the length of the Transfer         Request Block (TRB) Ring. This flaw allows a privileged guest user         to hang the QEMU process on the host, resulting in a denial of         service.

    CVE-2020-17380/CVE-2021-3409

        A heap-based buffer overflow was found in QEMU in the SDHCI device         emulation support. It could occur while doing a multi block SDMA         transfer via the sdhci_sdma_transfer_multi_blocks() routine in         hw/sd/sdhci.c. A guest user or process could use this flaw to         crash the QEMU process on the host, resulting in a denial of         service condition, or potentially execute arbitrary code with         privileges of the QEMU process on the host.

    CVE-2020-29130

        slirp.c has a buffer over-read because it tries to read a certain         amount of header data even if that exceeds the total packet         length.

    CVE-2021-3592

        An invalid pointer initialization issue was found in the SLiRP         networking implementation of QEMU. The flaw exists in the         bootp_input() function and could occur while processing a udp         packet that is smaller than the size of the 'bootp_t' structure. A         malicious guest could use this flaw to leak 10 bytes of         uninitialized heap memory from the host.

    CVE-2021-3593

        An invalid pointer initialization issue was found in the SLiRP         networking implementation of QEMU. The flaw exists in the         udp6_input() function and could occur while processing a udp         packet that is smaller than the size of the 'udphdr'         structure. This issue may lead to out-of-bounds read access or         indirect host memory disclosure to the guest.

    CVE-2021-3594

        An invalid pointer initialization issue was found         in the SLiRP networking implementation of QEMU. The flaw exists in         the udp_input() function and could occur while processing a udp         packet that is smaller than the size of the 'udphdr'         structure. This issue may lead to out-of-bounds read access or         indirect host memory disclosure to the guest.

    CVE-2021-3595

        An invalid pointer initialization issue was found in the SLiRP         networking implementation of QEMU. The flaw exists in the         tftp_input() function and could occur while processing a udp         packet that is smaller than the size of the 'tftp_t'         structure. This issue may lead to out-of-bounds read access or         indirect host memory disclosure to the guest.

    CVE-2022-0216

        A use-after-free vulnerability was found in the LSI53C895A SCSI         Host Bus Adapter emulation of QEMU. The flaw occurs while         processing repeated messages to cancel the current SCSI request         via the lsi_do_msgout function. This flaw allows a malicious         privileged user within the guest to crash the QEMU process on the         host, resulting in a denial of service.

    CVE-2022-1050

        A flaw was found in the QEMU implementation of VMWare's         paravirtual RDMA device. This flaw allows a crafted guest driver         to execute HW commands when shared buffers are not yet allocated,         potentially leading to a use-after-free condition.
        Note: PVRDMA is disabled in buster, but this was fixed         preventively in case this changes in the future.

    For Debian 10 buster, these problems have been fixed in version     1:3.1+dfsg-8+deb10u10.

    We recommend that you upgrade your qemu packages.

    For the detailed security status of qemu please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/qemu

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0671-1 advisory.

    - CVE-2022-4144: Fixed qxl_phys2virt unsafe address translation that can lead to out-of-bounds read     (bsc#1205808).
      - CVE-2022-3165: Fixed integer underflow in vnc_client_cut_text_ext() (bsc#1203788).
      - CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).

      Bugfixes:

      - Fixed deviation of guest clock (bsc#1206527).
      - Fixed broken 'block limits' VPD emulation (bsc#1202364).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12108 advisory.

    - security: fix SELinux label generation logic (Daniel P. Berrange) [Orabug: 34773029] {CVE-2021-3631}
    - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daude) [Orabug:
    33930374] {CVE-2021-3638}
    - Document CVE-2022-3165 as not applicable (Mark Kanda) [Orabug: 34713999] {CVE-2022-3165}
    - Document CVE-2022-1050 as not applicable (Mark Kanda) [Orabug: 34132133] {CVE-2022-1050}
    - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt) [Orabug: 34779472] {CVE-2022-4172}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12065 advisory.

    - hw/display/ati_2d: Fix buffer overflow in ati_2d_blt (CVE-2021-3638) (Philippe Mathieu-Daude)  [Orabug:
    33930374]  {CVE-2021-3638}
    - Document CVE-2022-1050 and CVE-2022-3165 (Mark Kanda)  [Orabug: 34132133] [Orabug: 34713999]     {CVE-2022-1050} {CVE-2022-3165}
    - hw/acpi/erst.c: Fix memory handling issues (Christian A. Ehrhardt)  [Orabug: 34779472]  {CVE-2022-4172}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
205306	GLSA-202408-18 : QEMU: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
189011	EulerOS 2.0 SP9 : qemu (EulerOS-SA-2023-2887)	Nessus	Huawei Local Security Checks	high
189008	EulerOS 2.0 SP9 : qemu (EulerOS-SA-2023-2906)	Nessus	Huawei Local Security Checks	high
182125	SUSE SLES15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-oss / qemu-audio-pa / etc (SUSE-SU-2023:3800-1)	Nessus	SuSE Local Security Checks	high
181777	SUSE SLES15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-pa / qemu-block-curl / etc (SUSE-SU-2023:3721-1)	Nessus	SuSE Local Security Checks	high
177423	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : QEMU vulnerabilities (USN-6167-1)	Nessus	Ubuntu Local Security Checks	high
173215	SUSE SLES15: qemu / qemu-SLOF / qemu-arm / qemu-audio-alsa / qemu-audio-pa / etc (SUSE-SU-2023:0840-1)	Nessus	SuSE Local Security Checks	high
172674	Oracle Linux 8 : virt:kvm_utils2 (ELSA-2023-12195)	Nessus	Oracle Linux Local Security Checks	high
172642	SUSE SLES12: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-oss / qemu-audio-pa / etc (SUSE-SU-2023:0761-1)	Nessus	SuSE Local Security Checks	high
172554	Debian dla-3362 : qemu - security update	Nessus	Debian Local Security Checks	high
172404	SUSE SLED15: qemu / qemu-SLOF / qemu-accel-qtest / qemu-accel-tcg-x86 / qemu-arm / etc (SUSE-SU-2023:0671-1)	Nessus	SuSE Local Security Checks	high
171222	Oracle Linux 8 : virt:kvm_utils (ELSA-2023-12108)	Nessus	Oracle Linux Local Security Checks	high
170462	Oracle Linux 7 : qemu (ELSA-2023-12065)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2022-1050

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high