The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3494 advisory.

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise     Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the     container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack     and steal login credentials or bearer tokens. (CVE-2019-10214)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0889 advisory.

    The slirp4netns package contains user-mode networking for unprivileged network namespaces. It is required     to enable networking for rootless containers.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

    * CVE-2020-8608 slirp4netns: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

    * CVE-2019-15890 QEMU: Slirp: use-after-free during packet reassembly

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements: Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)

Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).

Ignore csske for expanding the cpu model (bsc#1136540)

Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Bug fixes and enhancements: Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational arch-capabilities to help with security and performance on Intel hosts (bsc#1134880) (fate#327764).

Add support for one more security/performance related vcpu feature (bsc#1136777) (fate#327795).

Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).

Ignore csske for expanding the cpu model (bsc#1136528).

Provide qcow2 L2 caching improvements, which allows for better storage performance in certain configurations (bsc#1139926, ECO-130).

Fixed virsh migrate-setspeed (bsc#1127077, bsc#1141043).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4191-1 advisory.

    It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate     executed scripts. A local attacker could use this to cause a denial of service. (CVE-2019-12068)

    Sergej Schumilo, Cornelius Aschermann and Simon Wrner discovered that the qxl paravirtual graphics     driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use     this to cause a denial of service. (CVE-2019-12155)

    Riccardo Schirone discovered that the QEMU bridge helper did not properly validate network interface     names. A local attacker could possibly use this to bypass ACL restrictions. (CVE-2019-13164)

    It was discovered that a heap-based buffer overflow existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service or possibly execute     arbitrary code in the host. (CVE-2019-14378)

    It was discovered that a use-after-free vulnerability existed in the SLiRP networking implementation of     QEMU. A local attacker in a guest could use this to cause a denial of service. (CVE-2019-15890)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0366 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * hw: TSX Transaction Asynchronous Abort (TAA) (CVE-2019-11135)

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [Intel 7.8 Bug] [KVM][CLX] CPUID_7_0_EDX_ARCH_CAPABILITIES is not enabled in VM qemu-kvm (BZ#1730606)

    Enhancement(s):

    * [Intel 7.8 FEAT] MDS_NO exposure to guest - qemu-kvm (BZ#1755333)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3968 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-ma packages provide the user-space component for running virtual machines that     use KVM on the IBM z Systems, IBM Power, and 64-bit ARM architectures.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1449 advisory.

    qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for threads other than the main thread. (CVE-2018-15746)

    A heap buffer overflow issue was found in the SLiRP networking implementation of the QEMU emulator. This     flaw occurs in the ip_reass() routine while reassembling incoming packets if the first fragment is bigger     than the m->m_dat[] buffer. An attacker could use this flaw to crash the QEMU process on the host,     resulting in a Denial of Service or potentially executing arbitrary code with privileges of the QEMU     process. (CVE-2019-14378)

    An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU. This issue occurs while     processing USB packets from a guest when USBDevice 'setup_len' exceeds its 'data_buf[4096]' in the     do_token_in, do_token_out routines. This flaw allows a guest user to crash the QEMU process, resulting in     a denial of service, or the potential execution of arbitrary code with the privileges of the QEMU process     on the host. (CVE-2020-14364)

    A use-after-free flaw was found in the SLiRP networking implementation of the QEMU emulator. Specifically,     this flaw occurs in the ip_reass() routine while reassembling incoming IP fragments whose combined size is     bigger than 65k. This flaw allows an attacker to crash the QEMU process on the host, resulting in a denial     of service. (CVE-2020-1983)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
180823	Oracle Linux 8 : container-tools:1.0 (ELSA-2019-3494)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	high
138073	RHEL 7 : slirp4netns (RHSA-2020:0889)	Nessus	Red Hat Local Security Checks	7/2/2020	11/7/2024	high
128318	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2019:2246-1)	Nessus	SuSE Local Security Checks	8/29/2019	4/30/2024	high
128609	SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2157-1)	Nessus	SuSE Local Security Checks	9/9/2019	4/26/2024	high
128753	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2019:2353-1)	Nessus	SuSE Local Security Checks	9/12/2019	4/26/2024	high
131017	Ubuntu 16.04 LTS / 18.04 LTS : QEMU vulnerabilities (USN-4191-1)	Nessus	Ubuntu Local Security Checks	11/14/2019	8/27/2024	high
133482	RHEL 7 : qemu-kvm (RHSA-2020:0366)	Nessus	Red Hat Local Security Checks	2/5/2020	11/7/2024	high
131376	RHEL 7 : qemu-kvm-ma (RHSA-2019:3968)	Nessus	Red Hat Local Security Checks	11/27/2019	11/7/2024	high
142974	Amazon Linux AMI : qemu-kvm (ALAS-2020-1449)	Nessus	Amazon Linux Local Security Checks	11/18/2020	12/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high