The remote OracleVM system is missing necessary patches to address critical security updates :

  -     kvm-slirp-fix-big-little-endian-conversion-in-ident-prot     .patch 

  -     kvm-slirp-ensure-there-is-enough-space-in-mbuf-to-null-t     .patch 

  - kvm-slirp-don-t-manipulate-so_rcv-in-tcp_emu.patch     [bz#1669066]

  - kvm-qxl-check-release-info-object.patch [bz#1712728]

  - kvm-net-Use-iov-helper-functions.patch [bz#1636415]

  -     kvm-net-increase-buffer-size-to-accommodate-Jumbo-frame-     .patch 

  - kvm-net-ignore-packet-size-greater-than-INT_MAX.patch     [bz#1636415]

  - kvm-net-drop-too-large-packet-early.patch [bz#1636415]

  - kvm-PATCH-slirp-fix-buffer-overrun.patch [bz#1586251]

  - kvm-Fix-build-from-previous-commit.patch [bz#1586251]

  - kvm-slirp-remove-mbuf-m_hdr-m_dat-indirection.patch     [bz#1586251]

  - kvm-slirp-Convert-mbufs-to-use-g_malloc-and-g_free.patch     [bz#1586251]

  -     kvm-slirp-correct-size-computation-while-concatenating-m     .patch 

  - kvm-pcnet-fix-possible-buffer-overflow.patch     [bz#1636774]

  - Resolves: bz#1586251 (CVE-2018-11806 qemu-kvm: QEMU:
    slirp: heap buffer overflow while reassembling     fragmented datagrams [rhel-6.10.z])

  - Resolves: bz#1636415 (CVE-2018-10839 qemu-kvm: Qemu:
    ne2000: integer overflow leads to buffer overflow issue     [rhel-6])

  - Resolves: bz#1636774 (CVE-2018-17962 qemu-kvm: Qemu:
    pcnet: integer overflow leads to buffer overflow     [rhel-6])

  - Resolves: bz#1669066 (CVE-2019-6778 qemu-kvm: QEMU:
    slirp: heap buffer overflow in tcp_emu [rhel-6.10.z])

  - Resolves: bz#1712728 (CVE-2019-12155 qemu-kvm: QEMU:
    qxl: null pointer dereference while releasing spice     resources [rhel-6])

The remote NewStart CGSL host, running version MAIN 4.05, has qemu-kvm packages installed that are affected by multiple vulnerabilities:

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer     overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC     emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could     occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu     process resulting in DoS. (CVE-2018-10839)

  - Qemu has a Buffer Overflow in pcnet_receive in     hw/net/pcnet.c because an incorrect integer data type is     used. (CVE-2018-17962)

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-     based buffer overflow. (CVE-2019-6778)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference. (CVE-2019-12155)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a     heap-based buffer overflow.(CVE-2019-6778)

  - A flaw was found in QEMU's Media Transfer Protocol     (MTP). The code opening files in usb_mtp_get_object and     usb_mtp_get_partial_object and directories in     usb_mtp_object_readdir doesn't consider that the     underlying filesystem may have changed since the time     lstat(2) was called in usb_mtp_object_alloc, a     classical TOCTTOU problem. An attacker with write     access to the host filesystem, shared with a guest, can     use this property to navigate the host filesystem in     the context of the QEMU process and read any file the     QEMU process has access to. Access to the filesystem     may be local or via a network share protocol such as     CIFS.(CVE-2018-16872)

  - hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an     fid path while it is being accessed by a second thread,     leading to (for example) a use-after-free     outcome.(CVE-2018-19364)

  - v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS     users to cause a denial of service (crash) because of a     race condition during file renaming.(CVE-2018-19489)

  - QEMU, through version 2.10 and through version 3.1.0,     is vulnerable to an out-of-bounds read of up to 128     bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A     local attacker with permission to execute i2c commands     could exploit this to read stack memory of the qemu     process on the host.(CVE-2019-3812)

  - Memory leak in hw/audio/ac97.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5525)

  - Memory leak in hw/audio/es1370.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5526)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     OS guest privileged users to cause a denial of service     (infinite loop and QEMU process crash) via vectors     involving the transfer mode register during multi block     transfer.(CVE-2017-5987)

  - An integer overflow flaw was found in Quick Emulator     (QEMU) in the CCID Card device support. The flaw could     occur while passing messages via command/response     packets to and from the host. A privileged user inside     a guest could use this flaw to crash the QEMU     process.(CVE-2017-5898)

  - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors related to     control transfer descriptor sequence.(CVE-2017-5973)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).

CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).

CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).

CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).

CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).

CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).

Fixed a live migration error (bsc#1154790).

Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4640 advisory.

    - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as       fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}       {CVE-2018-12130} {CVE-2019-11091}
    - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008}     {CVE-2019-8934}
    - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
    - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
    - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
    - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]     {CVE-2019-6501}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4556 advisory.

  - A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in     usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest     device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS     scenario OR possibly lead to code execution on the host. (CVE-2018-16867)

  - hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to     uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
    (CVE-2018-20191)

  - A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and     usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying     filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical     TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this     property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU     process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
    (CVE-2018-16872)

  - hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe     ring element with a large num_sge value. (CVE-2018-20124)

  - QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and
    -1 is mishandled). (CVE-2018-20216)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference     or excessive memory allocation) in create_cq_ring or create_qp_rings. (CVE-2018-20125)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are     mishandled. (CVE-2018-20126)

  - pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.
    (CVE-2018-20123)

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow. (CVE-2019-6778)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129370	OracleVM 3.4 : qemu-kvm (OVMSA-2019-0045)	Nessus	OracleVM Local Security Checks	9/26/2019	4/23/2024	high
134319	NewStart CGSL MAIN 4.05 : qemu-kvm Multiple Vulnerabilities (NS-SA-2020-0019)	Nessus	NewStart CGSL Local Security Checks	3/8/2020	3/25/2024	high
134555	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2020-1266)	Nessus	Huawei Local Security Checks	3/13/2020	1/6/2021	high
135168	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2020:0844-1)	Nessus	SuSE Local Security Checks	4/2/2020	5/13/2022	high
180647	Oracle Linux 7 : qemu (ELSA-2019-4640)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	critical
180708	Oracle Linux 7 : qemu (ELSA-2019-4556)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

critical

high