The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12108 advisory.

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a     crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading     to a use-after-free condition. (CVE-2022-1050)

  - A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This     flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out     of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.
    (CVE-2021-3631)

  - An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in     the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for     the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the     host, resulting in a denial of service. (CVE-2021-3638)

  - An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service. (CVE-2022-3165)

  - An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table     (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow     the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use     these flaws to crash the QEMU process on the host. (CVE-2022-4172)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 8 : virt:kvm_utils (ELSA-2023-12108)

high Nessus Plugin ID 171222

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Sep 16, 2023, 2:14 AM Detection Plugin Feed: 202309160214
Version 1.1 Sep 5, 2023, 4:12 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309051612
Version 1.0 Feb 9, 2023, 4:31 AM New Plugin Feed: 202302090431