Amazon Linux 2 : qemu (ALAS-2026-4102)

high Nessus Plugin ID 379824

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4102 advisory.

A flaw was found in QEMU's websocket I/O channel (QIOChannelWebsock in io/channel-websock.c). The websocket server reads encoded data from a connected client into an input buffer and decodes it into a separate buffer, but the size limit is enforced only on the encoded-input buffer and not on the decoded- input buffer. A client that connects to a QEMU websocket endpoint -- such as a VNC server or a character- device socket backend configured with websocket=on -- and sends data that is not consumed can cause the decoded-input buffer to grow without bound, exhausting host memory and leading to a denial of service.
(CVE-2026-101291)

hw/usb/hcd-xhci: More reentrancy guard fixes for the XHCI code (CVE-2026-111819)

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container. (CVE-2026-120830)

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service. (CVE-2026-120831)

An out-of-bounds read was found in the USB CCID smartcard reader device (hw/usb/dev-smartcard-reader.c) in QEMU. ccid_bulk_in_get() decremented the pending bulk-in slot count when a ring slot became active instead of when it was released, allowing a malicious guest to fill the bulk-in ring, partially read a slot, and then reuse the still-active slot with a shorter response. The resulting stale position exceeds the new buffer length, causing an unsigned-integer underflow in ccid_bulk_in_copy_to_guest() that reads past the response buffer and can disclose host process memory to the guest or crash the QEMU process. The flaw was introduced in QEMU 0.15.0 and fixed in 11.1.3 and 10.0.15. (CVE-2026-18204)

A flaw was found in the USB CCID (smartcard reader) device emulation (hw/usb/dev-smartcard-reader.c) in QEMU. For each PC_to_RDR_XfrBlock APDU received from the guest, ccid_on_apdu_from_guest() queues a pending answer without checking whether the slot is already busy. A guest that submits XfrBlock messages faster than the asynchronous card backend can process them can overflow the 128-entry pending-answers ring buffer, triggering an assertion failure in ccid_add_pending_answer() that aborts the QEMU process. This may result in a denial of service of the QEMU process. The flaw was introduced in QEMU 0.15.0 and fixed in 11.1.3 and 10.0.15. (CVE-2026-18410)

A flaw was found in the USB CCID smartcard reader device emulation (hw/usb/dev-smartcard-reader.c) in QEMU. A guest can submit an interrupt IN transfer shorter than the 2-byte RDR_to_PC_NotifySlotChange message; usb_packet_copy() asserts that the packet has enough space, so a zero- or one-byte request triggers an assertion failure, crashing QEMU. This may result in a denial of service of the QEMU process.
(CVE-2026-18609)

hw/display/vga: fix OOB writes after external surface resize (CVE-2026-97889)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Run 'yum update qemu' or or 'yum update --advisory ALAS2-2026-4102' to update your system.

Plugin Details

Severity: High

ID: 379824

File Name: al2_ALAS-2026-4102.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.38

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2026-120830

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:ivshmem-tools, p-cpe:/a:amazon:linux:qemu-audio-alsa, p-cpe:/a:amazon:linux:qemu-audio-oss, p-cpe:/a:amazon:linux:qemu-audio-pa, p-cpe:/a:amazon:linux:qemu-audio-sdl, p-cpe:/a:amazon:linux:qemu-block-curl, p-cpe:/a:amazon:linux:qemu-block-dmg, p-cpe:/a:amazon:linux:qemu-block-iscsi, p-cpe:/a:amazon:linux:qemu-block-nfs, p-cpe:/a:amazon:linux:qemu-block-rbd, p-cpe:/a:amazon:linux:qemu-block-ssh, p-cpe:/a:amazon:linux:qemu-common, p-cpe:/a:amazon:linux:qemu-debuginfo, p-cpe:/a:amazon:linux:qemu-guest-agent, p-cpe:/a:amazon:linux:qemu-img, p-cpe:/a:amazon:linux:qemu-kvm-core, p-cpe:/a:amazon:linux:qemu-kvm, p-cpe:/a:amazon:linux:qemu-system-aarch64-core, p-cpe:/a:amazon:linux:qemu-system-aarch64, p-cpe:/a:amazon:linux:qemu-system-x86-core, p-cpe:/a:amazon:linux:qemu-system-x86, p-cpe:/a:amazon:linux:qemu-ui-curses, p-cpe:/a:amazon:linux:qemu-ui-gtk, p-cpe:/a:amazon:linux:qemu-ui-sdl, p-cpe:/a:amazon:linux:qemu-user-binfmt, p-cpe:/a:amazon:linux:qemu-user-static, p-cpe:/a:amazon:linux:qemu-user, p-cpe:/a:amazon:linux:qemu

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 11/3/2026

Reference Information

CVE: CVE-2026-101291, CVE-2026-111819, CVE-2026-120830, CVE-2026-120831, CVE-2026-18204, CVE-2026-18410, CVE-2026-18609, CVE-2026-97889

Detections

Analytics