The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7472 advisory.

  - swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions     prior to 0.5.3, 0.6.2, and 0.7.1 are vulnerable to out-of-bounds read. A specially crafted header of     swtpm's state, where the blobheader's hdrsize indicator has an invalid value, may cause an out-of-bounds     access when the byte array representing the state of the TPM is accessed. This will likely crash swtpm or     prevent it from starting since the state cannot be understood. Users should upgrade to swtpm v0.5.3,     v0.6.2, or v0.7.1 to receive a patch. There are currently no known workarounds. (CVE-2022-23645)

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number     of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or     malicious actor. (CVE-2022-2211)

  - A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to     acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no     protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw     allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to     crash the network filter management daemon (libvirtd/virtnwfilterd). (CVE-2022-0897)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : virt:ol / and / virt-devel:ol (ELSA-2022-7472)

medium Nessus Plugin ID 167524

Version 1.3

Version 1.2

Version 1.3 Oct 3, 2023, 2:18 PM Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Plugin Feed: 202310031418
Version 1.2 Nov 16, 2022, 12:10 PM New Plugin Feed: 202211161210