The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4676 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs     (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0),     nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193,     BZ#1844296)

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

    * libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

    * QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

    * libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

    * libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4676 advisory.

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.
    (CVE-2020-14301)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the libvirt package has been released.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4000 advisory.

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles     the holding of a monitor job during a query to a guest     agent, which allows attackers to cause a denial of     service (API blockage).(CVE-2019-20485)

  - It was discovered that libvirtd before versions 4.10.1     and 5.4.1 would permit read-only clients to use the     virDomainSaveImageGetXMLDesc() API, specifying an     arbitrary path which would be accessed with the     permissions of the libvirtd process. An attacker with     access to the libvirtd socket could use this to probe     the existence of arbitrary files, cause denial of     service or cause libvirtd to execute arbitrary     programs.(CVE-2019-10161)

  - The virConnectGetDomainCapabilities() libvirt API,     versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1,     accepts an 'emulatorbin' argument to specify the     program providing emulation for a domain. Since     v1.2.19, libvirt will execute that program to probe the     domain's capabilities. Read-only clients could specify     an arbitrary path for this argument, causing libvirtd     to execute a crafted executable with its own     privileges.(CVE-2019-10167)

  - util/virlog.c in libvirt does not properly determine     the hostname on LXC container startup, which allows     local guest OS users to bypass an intended container     protection mechanism and execute arbitrary commands via     a crafted NSS module.(CVE-2018-6764)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix iptables No chain/target/match by that name (bz     #1813830)

  - systemd: start libvirtd after firewalld/iptables     services (bz #1697636)

  - CVE-2020-12430: memory leak in domstats may allow     read-only user to perform DoS attack (bz #1828216, bz     #1828190)

  - CVE-2020-10703: Potential denial of service via active     pool without target path (bz #1820690, bz #1816650)

  - CVE-2019-20485: potential DoS by holding a monitor job     while querying QEMU guest-agent (bz #1809741, bz     #1809740)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4000 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

    * libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4676 advisory.

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

    * libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

    * QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

    * libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

    * libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 20201105.1021. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.1021 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.46 and prior, 5.7.28 and prior and 8.0.18 and prior. Difficult to exploit vulnerability     allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2574)

  - Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are     affected are 5.6.47 and prior, 5.7.27 and prior and 8.0.17 and prior. Difficult to exploit vulnerability     allows low privileged attacker with network access via multiple protocols to compromise MySQL Client.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of MySQL Client. (CVE-2020-2752)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5674 advisory.

    - qemu: don't hold both jobs for suspend (Jonathon Jongsma)  [Orabug: 31073098]  {CVE-2019-20485}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
142449	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2020:4676)	Nessus	Red Hat Local Security Checks	11/4/2020	3/15/2025	high
184870	Rocky Linux 8 : virt:rhel and virt-devel:rhel (RLSA-2020:4676)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/7/2023	high
135865	Photon OS 2.0: Libvirt PHSA-2020-2.0-0228	Nessus	PhotonOS Local Security Checks	4/22/2020	7/22/2024	medium
141632	CentOS 7 : libvirt (RHSA-2020:4000)	Nessus	CentOS Local Security Checks	10/20/2020	10/9/2024	medium
141658	EulerOS Virtualization 3.0.2.2 : libvirt (EulerOS-SA-2020-2209)	Nessus	Huawei Local Security Checks	10/21/2020	2/14/2024	high
135783	Photon OS 3.0: Libvirt PHSA-2020-3.0-0078	Nessus	PhotonOS Local Security Checks	4/21/2020	8/22/2025	medium
136034	Photon OS 1.0: Libvirt PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	4/28/2020	4/29/2020	medium
137425	Fedora 31 : libvirt (2020-5cd83efda7)	Nessus	Fedora Local Security Checks	6/17/2020	3/7/2024	medium
141027	RHEL 7 : libvirt (RHSA-2020:4000)	Nessus	Red Hat Local Security Checks	9/29/2020	11/7/2024	medium
157535	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2020:4676)	Nessus	Alma Linux Local Security Checks	2/9/2022	1/13/2025	high
164552	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.1021)	Nessus	Misc.	9/1/2022	2/19/2025	critical
180921	Oracle Linux 7 : libvirt (ELSA-2020-5674)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/23/2024	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

high

medium

medium

medium

medium

high

critical

medium