The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0869 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5088:
    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

    CVE-2023-40360:
    A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device     backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this     time window to trigger an assertion and cause a denial of service.

    CVE-2023-3180:
    QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no     check for whether an endurance group is configured before checking whether Flexible Data Placement is     enabled.

    CVE-2023-42467:
    A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does     not validate an offset provided by the guest before computing a host heap pointer, which is used for     copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

    CVE-2023-3354:
    A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service.

    CVE-2023-3301:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service.

    CVE-2023-4135:
    A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

    CVE-2023-3255:
    QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately.

    CVE-2021-3750:
    A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller/'s registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0.

    CVE-2021-3929:
    A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is     similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function     nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or,     potentially, executing arbitrary code within the context of the QEMU process on the host.

    CVE-2021-4158:
    A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within     the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition.

    CVE-2021-4206:
    A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process.

    CVE-2021-4207:
    A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process.

    CVE-2022-0358:
    A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is     strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by     virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of the group. This could allow a malicious unprivileged user     inside the guest to gain access to resources accessible to the root group, potentially escalating their     privileges within the guest. A malicious local user in the host might also leverage this unexpected     executable file created by the guest to escalate their privileges on the host system.

    CVE-2022-2962:
    A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the     rx/tx descriptor or copies the rx/tx frame, it doesn/'t check whether the destination address is its own     MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a     stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host,     resulting in a denial of service condition.

    CVE-2022-3165:
    An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service.

    CVE-2022-35414:
    ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the     translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-     virtualization Use Case in the qemu.org reference applies here, i.e., Bugs affecting the non-     virtualization use case are not considered security bugs at this time.

    CVE-2022-3872:
    An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition.

    CVE-2022-4144:
    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition.

    CVE-2023-1544:
    A flaw was found in the QEMU implementation of VMWare/'s paravirtual RDMA device. This flaw allows a     crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of     descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.

    CVE-2023-6683:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service.

    CVE-2023-6693:
    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

TencentOS Server 4: qemu (TSSA-2024:0869)

high Nessus Plugin ID 238947

Version 1.2

Version 1.1

Version 1.2 Nov 21, 2025, 2:12 PM CVE (set "CVE" coverage to "CVE-2021-3750,CVE-2021-3929,CVE-2021-4158,CVE-2021-4206,CVE-2021-4207,CVE-2022-0358,CVE-2022-2962,CVE-2022-3165,CVE-2022-35414,CVE-2022-3872,CVE-2022-4144,CVE-2023-1544,CVE-2023-3180,CVE-2023-3255,CVE-2023-3301,CVE-2023-3354,CVE-2023-40360,CVE-2023-4135,CVE-2023-42467,CVE-2023-5088,CVE-2023-6683,CVE-2023-6693") CVSS metrics ("CVSSv2 score" set to 6.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C") CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2022-35414") CVSSv2 severity (based on CVE-2022-35414, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202511211412
Version 1.1 Jun 17, 2025, 2:02 AM New Plugin Feed: 202506170202