The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2126 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0775 advisory.

    - Resolves: bz#1734747       (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
    - Resolves: bz#1749731       (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - QEMU: slirp: heap buffer overflow during packet     reassembly (CVE-2019-14378)

  - QEMU: slirp: OOB buffer access while emulating tcp     protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: use-after-free during packet reassembly     (CVE-2019-15890)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4191-1 advisory.

    It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate     executed scripts. A local attacker could use this to cause a denial of service. (CVE-2019-12068)

    Sergej Schumilo, Cornelius Aschermann and Simon Wrner discovered that the qxl paravirtual graphics     driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use     this to cause a denial of service. (CVE-2019-12155)

    Riccardo Schirone discovered that the QEMU bridge helper did not properly validate network interface     names. A local attacker could possibly use this to bypass ACL restrictions. (CVE-2019-13164)

    It was discovered that a heap-based buffer overflow existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service or possibly execute     arbitrary code in the host. (CVE-2019-14378)

    It was discovered that a use-after-free vulnerability existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-15890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3968 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-ma packages provide the user-space component for running virtual machines that     use KVM on the IBM z Systems, IBM Power, and 64-bit ARM architectures.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements: Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134880) (fate#327764).

Add support for one more security/performance related vcpu feature (bsc#1136777) (fate#327795).

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).

Ignore csske for expanding the cpu model (bsc#1136528).

Provide qcow2 L2 caching improvements, which allows for better storage performance in certain configurations (bsc#1139926, ECO-130).

Fixed virsh migrate-setspeed (bsc#1127077, bsc#1141043).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2019-14378

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements: Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)

Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).

Ignore csske for expanding the cpu model (bsc#1136540)

Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3494 advisory.

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens. (CVE-2019-10214)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0110 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-5736:
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

    CVE-2019-9514:
    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.
    The attacker opens a number of streams and sends an invalid request over each stream that should solicit a     stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this     can consume excess memory, CPU, or both.

    CVE-2019-14378:
    ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment.

    CVE-2019-16884:
    runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor     restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a     malicious Docker image can mount over a /proc directory.

    CVE-2019-19921:
    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to     libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with     custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect     Docker due to an implementation detail that happens to block the attack.)

    CVE-2020-1983:
    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service.

    CVE-2020-7039:
    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code.

    CVE-2020-8608:
    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code.

    CVE-2020-10756:
    An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1.

    CVE-2021-3595:
    An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0.

    CVE-2021-20188:
    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged     container are not correctly checked. This flaw can be abused by a low-privileged user inside the container     to access any other file in the container, even if owned by the root user inside the container. It does     not allow to directly escape the container, though being a privileged container means that a lot of     security features are disabled when running the container. The highest threat from this vulnerability is     to data confidentiality and integrity as well as system availability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
136558	RHEL 7 : qemu-kvm (RHSA-2020:2126)	Nessus	Red Hat Local Security Checks	5/13/2020	11/7/2024	high
134388	Oracle Linux 6 : qemu-kvm (ELSA-2020-0775)	Nessus	Oracle Linux Local Security Checks	3/11/2020	10/22/2024	high
134395	Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200310)	Nessus	Scientific Linux Local Security Checks	3/11/2020	3/22/2024	high
131017	Ubuntu 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-4191-1)	Nessus	Ubuntu Local Security Checks	11/14/2019	8/27/2024	high
131376	RHEL 7 : qemu-kvm-ma (RHSA-2019:3968)	Nessus	Red Hat Local Security Checks	11/27/2019	11/7/2024	high
128609	SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2157-1)	Nessus	SuSE Local Security Checks	9/9/2019	4/26/2024	high
128753	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2019:2353-1)	Nessus	SuSE Local Security Checks	9/12/2019	4/26/2024	high
127516	Fedora 30 : libslirp (2019-77bafc4454)	Nessus	Fedora Local Security Checks	8/12/2019	5/7/2024	high
128318	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2246-1)	Nessus	SuSE Local Security Checks	8/29/2019	4/30/2024	high
180823	Oracle Linux 8 : container-tools:1.0 (ELSA-2019-3494)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	high
236506	Alibaba Cloud Linux 3 : 0110: container-tools:rhel8 (ALINUX3-SA-2022:0110)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/15/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high