According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a     heap-based buffer overflow.(CVE-2019-6778)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka     Quick Emulator) allows local guest OS privileged users     to cause a denial of service (NULL pointer dereference     and QEMU process crash) by leveraging failure to define     the .write method.(CVE-2015-7549)

  - The ne2000_receive function in the NE2000 NIC emulation     support (hw/net/ne2000.c) in QEMU before 2.5.1 allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via     crafted values for the PSTART and PSTOP registers,     involving ring buffer control.(CVE-2016-2841)

  - Memory leak in QEMU (aka Quick Emulator), when built     with USB EHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the     device.(CVE-2017-9374)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick     Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash).(CVE-2017-18043)

  - Memory leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)

  - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and     earlier creates temporary files with predictable names,     which allows local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program.(CVE-2015-4037)

  - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7908)

  - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier     allows local guest users to cause a denial of service     or possibly execute arbitrary code via vectors related     to (1) RX or (2) TX queue numbers or (3) interrupt     indices. NOTE: some of these details are obtained from     third party information.(CVE-2013-4544)

  - Multiple integer overflows in the USB Net device     emulator (hw/usb/dev-network.c) in QEMU before 2.5.1     allow local guest OS administrators to cause a denial     of service (QEMU process crash) or obtain sensitive     host memory information via a remote NDIS control     message packet that is mishandled in the (1)     rndis_query_response, (2) rndis_set_response, or (3)     usb_net_handle_dataout function.(CVE-2016-2538)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC     emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could     occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu     process resulting in DoS.(CVE-2018-10839)

  - Memory leak in QEMU (aka Quick Emulator), when built     with IDE AHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the AHCI     device.(CVE-2017-9373)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS     8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of     service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command     processing.(CVE-2017-9503)

  - Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2     allows remote attackers to cause a denial of service     and possibly execute arbitrary code via vectors related     to migrating ports.(CVE-2013-4526)

  - Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2     allows remote attackers to cause a denial of service or     possibly execute arbitrary code via crafted     tx_fifo_head and rx_fifo_head values in a savevm     image.(CVE-2013-4530)

  - Multiple buffer overflows in the tsc210x_load function     in hw/input/tsc210x.c in QEMU before 1.7.2 might allow     remote attackers to execute arbitrary code via a     crafted (1) precision, (2) nextprecision, (3) function,     or (4) nextfunction value in a savevm     image.(CVE-2013-4539)

  - Buffer overflow in scoop_gpio_handler_update in QEMU     before 1.7.2 might allow remote attackers to execute     arbitrary code via a large (1) prev_level, (2)     gpio_level, or (3) gpio_dir value in a savevm     image.(CVE-2013-4540)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     OS guest privileged users to cause a denial of service     (infinite loop and QEMU process crash) via vectors     involving the transfer mode register during multi block     transfer.(CVE-2017-5987)

  - Microarchitectural Store Buffer Data Sampling (MSBDS):
    Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12126)

  - Microarchitectural Load Port Data Sampling (MLPDS):
    Load ports on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12127)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS):
    Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2018-12130)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an     authenticated user to potentially enable information     disclosure via a side channel with local access. A list     of impacted products can be found here:
    https://www.intel.com/content/dam/www/public/us/en/docu     ments/corporate-information/SA00233-microcode-update-gu     idance_05132019.pdf(CVE-2019-11091)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - Heap-based buffer overflow in the .receive callback of     xlnx.xps-ethernetlite in QEMU (aka Quick Emulator)     allows attackers to execute arbitrary code on the QEMU     host via a large ethlite packet.(CVE-2016-7161)

  - Heap-based buffer overflow in the ne2000_receive     function in hw/net/ne2000.c in QEMU before 2.4.0.1     allows guest OS users to cause a denial of service     (instance crash) or possibly execute arbitrary code via     vectors related to receiving packets.(CVE-2015-5279)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     guest OS privileged users to cause a denial of service     (out-of-bounds heap access and crash) or execute     arbitrary code on the QEMU host via vectors involving     the data transfer length.(CVE-2017-5667)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4640 advisory.

    - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as       fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}       {CVE-2018-12130} {CVE-2019-11091}
    - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008}     {CVE-2019-8934}
    - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
    - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
    - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
    - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]     {CVE-2019-6501}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top :

  - Remove fuse-overlayfs because it's (currently) an     unsatisfied dependency on SLE (bsc#1143386)

  - Update libpod.conf to use correct infra_command

  - Update libpod.conf to use better versioned pause     container

  - Update libpod.conf to use official kubic pause container

  - Update libpod.conf to match latest features set:
    detach_keys, lock_type, runtime_supports_json

  - Add podman-remote varlink client

Version update podman to v1.4.4 :

  - Features

  - Podman now has greatly improved support for containers     using multiple OCI runtimes. Containers now remember if     they were created with a different runtime using
    --runtime and will always use that runtime

  - The cached and delegated options for volume mounts are     now allowed for Docker compatability (#3340)

  - The podman diff command now supports the --latest flag

  - Bugfixes

  - Fixed a bug where rootless Podman would attempt to use     the entire root configuration if no rootless     configuration was present for the user, breaking     rootless Podman for new installations

  - Fixed a bug where rootless Podman's pause process would     block SIGTERM, preventing graceful system shutdown and     hanging until the system's init send SIGKILL

  - Fixed a bug where running Podman as root with sudo -E     would not work after running rootless Podman at least     once

  - Fixed a bug where options for tmpfs volumes added with     the --tmpfs flag were being ignored

  - Fixed a bug where images with no layers could not     properly be displayed and removed by Podman

  - Fixed a bug where locks were not properly freed on     failure to create a container or pod

  - Fixed a bug where podman cp on a single file would     create a directory at the target and place the file in     it (#3384)

  - Fixed a bug where podman inspect --format '((.Mounts))'     would print a hexadecimal address instead of a     container's mounts

  - Fixed a bug where rootless Podman would not add an entry     to container's /etc/hosts files for their own hostname     (#3405)

  - Fixed a bug where podman ps --sync would segfault     (#3411)

  - Fixed a bug where podman generate kube would produce an     invalid ports configuration (#3408)

  - Misc

  - Updated containers/storage to v1.12.13

  - Podman now performs much better on systems with heavy     I/O load

  - The --cgroup-manager flag to podman now shows the     correct default setting in help if the default was     overridden by libpod.conf

  - For backwards compatability, setting
    --log-driver=json-file in podman run is now supported as     an alias for --log-driver=k8s-file. This is considered     deprecated, and json-file will be moved to a new     implementation in the future     ([#3363](https://github.com/containers/libpo\     d/issues/3363))

  - Podman's default libpod.conf file now allows the crun     OCI runtime to be used if it is installed

Update podman to v1.4.2 :

  - Fixed a bug where Podman could not run containers using     an older version of Systemd as init

  - Updated vendored Buildah to v1.9.0 to resolve a critical     bug with Dockerfile RUN instructions

  - The error message for running podman kill on containers     that are not running has been improved

  - Podman remote client can now log to a file if syslog is     not available

  - The podman exec command now sets its error code     differently based on whether the container does not     exist, and the command in the container does not exist

  - The podman inspect command on containers now outputs     Mounts JSON that matches that of docker inspect, only     including user-specified volumes and differentiating     bind mounts and named volumes

  - The podman inspect command now reports the path to a     container's OCI spec with the OCIConfigPath key (only     included when the container is initialized or running)

  - The podman run --mount command now supports the     bind-nonrecursive option for bind mounts

  - Fixed a bug where podman play kube would fail to create     containers due to an unspecified log driver

  - Fixed a bug where Podman would fail to build with musl     libc

  - Fixed a bug where rootless Podman using slirp4netns     networking in an environment with no nameservers on the     host other than localhost would result in nonfunctional     networking

  - Fixed a bug where podman import would not properly set     environment variables, discarding their values and     retaining only keys

  - Fixed a bug where Podman would fail to run when built     with Apparmor support but run on systems without the     Apparmor kernel module loaded

  - Remote Podman will now default the username it uses to     log in to remote systems to the username of the current     user

  - Podman now uses JSON logging with OCI runtimes that     support it, allowing for better error reporting

  - Updated vendored containers/image to v2.0

  - Update conmon to v0.3.0

  - Support OOM Monitor under cgroup V2

  - Add config binary and make target for configuring conmon     with a go library for importing values

Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460) 

  - Podman checkpoint and podman restore commands can now be     used to migrate containers between Podman installations     on different systems.

  - The podman cp now supports pause flag.

  - The remote client now supports a configuration file for     pre-configuring connections to remote Podman     installations

  - CVE-2019-10152: Fixed an iproper dereference of symlinks     of the the podman cp command which introduced in version     1.1.0 (bsc#1136974).

  - Fixed a bug where podman commit could improperly set     environment variables that contained = characters

  - Fixed a bug where rootless podman would sometimes fail     to start containers with forwarded ports

  - Fixed a bug where podman version on the remote client     could segfault

  - Fixed a bug where podman container runlabel would use     /proc/self/exe instead of the path of the Podman command     when printing the command being executed

  - Fixed a bug where filtering images by label did not work

  - Fixed a bug where specifying a bing mount or tmpfs mount     over an image volume would cause a container to be     unable to start

  - Fixed a bug where podman generate kube did not work with     containers with named volumes

  - Fixed a bug where rootless podman would receive     permission denied errors accessing conmon.pid

  - Fixed a bug where podman cp with a folder specified as     target would replace the folder, as opposed to copying     into it

  - Fixed a bug where rootless Podman commands could     double-unlock a lock, causing a crash

  - Fixed a bug where podman incorrectly set tmpcopyup on     /dev/ mounts, causing errors when using the Kata     containers runtime

  - Fixed a bug where podman exec would fail on older     kernels

  - Podman commit command is now usable with the Podman     remote client

  - Signature-policy flag has been deprecated

  - Updated vendored containers/storage and containers/image     libraries with numerous bugfixes

  - Updated vendored Buildah to v1.8.3

  - Podman now requires Conmon v0.2.0

  - The podman cp command is now aliased as podman container     cp

  - Rootless podman will now default init_path using root     Podman's configuration files     (/etc/containers/libpod.conf and     /usr/share/containers/libpod.conf) if not overridden in     the rootless configuration

  - Added fuse-overlayfs dependency to support overlay based     rootless image manipulations

  - The podman cp command can now read input redirected to     STDIN, and output to STDOUT instead of a file, using -     instead of an argument.

  - The podman remote client now displays version     information from both the client and server in podman     version

  - The podman unshare command has been added, allowing easy     entry into the user namespace set up by rootless Podman     (allowing the removal of files created by rootless     podman, among other things)

  - Fixed a bug where Podman containers with the --rm flag     were removing created volumes when they were     automatically removed

  - Fixed a bug where container and pod locks were     incorrectly marked as released after a system reboot,     causing errors on container and pod removal

  - Fixed a bug where Podman pods could not be removed if     any container in the pod encountered an error during     removal

  - Fixed a bug where Podman pods run with the cgroupfs     CGroup driver would encounter a race condition during     removal, potentially failing to remove the pod CGroup

  - Fixed a bug where the podman container checkpoint and     podman container restore commands were not visible in     the remote client

  - Fixed a bug where podman remote ps --ns would not print     the container's namespaces

  - Fixed a bug where removing stopped containers with     healthchecks could cause an error

  - Fixed a bug where the default libpod.conf file was     causing parsing errors

  - Fixed a bug where pod locks were not being freed when     pods were removed, potentially leading to lock     exhaustion

  - Fixed a bug where 'podman run' with SD_NOTIFY set could,     on short-running containers, create an inconsistent     state rendering the container unusable

  - The remote Podman client now uses the Varlink bridge to     establish remote connections by default

  - Fixed an issue with apparmor_parser (bsc#1123387)

  - Update to libpod v1.4.0 (bsc#1137860) :

  - The podman checkpoint and podman restore commands can     now be used to migrate containers between Podman     installations on different systems

  - The podman cp command now supports a pause flag to pause     containers while copying into them

  - The remote client now supports a configuration file for     pre-configuring connections to remote Podman     installations

  - Fixed CVE-2019-10152 - The podman cp command improperly     dereferenced symlinks in host context

  - Fixed a bug where podman commit could improperly set     environment variables that contained = characters

  - Fixed a bug where rootless Podman would sometimes fail     to start containers with forwarded ports

  - Fixed a bug where podman version on the remote client     could segfault

  - Fixed a bug where podman container runlabel would use     /proc/self/exe instead of the path of the Podman command     when printing the command being executed

  - Fixed a bug where filtering images by label did not work

  - Fixed a bug where specifying a bing mount or tmpfs mount     over an image volume would cause a container to be     unable to start

  - Fixed a bug where podman generate kube did not work with     containers with named volumes

  - Fixed a bug where rootless Podman would receive     permission denied errors accessing conmon.pid

  - Fixed a bug where podman cp with a folder specified as     target would replace the folder, as opposed to copying     into it

  - Fixed a bug where rootless Podman commands could     double-unlock a lock, causing a crash

  - Fixed a bug where Podman incorrectly set tmpcopyup on     /dev/ mounts, causing errors when using the Kata     containers runtime

  - Fixed a bug where podman exec would fail on older     kernels

  - The podman commit command is now usable with the Podman     remote client

  - The --signature-policy flag (used with several     image-related commands) has been deprecated

  - The podman unshare command now defines two environment     variables in the spawned shell: CONTAINERS_RUNROOT and     CONTAINERS_GRAPHROOT, pointing to temporary and     permanent storage for rootless containers

  - Updated vendored containers/storage and containers/image     libraries with numerous bugfixes

  - Updated vendored Buildah to v1.8.3

  - Podman now requires Conmon v0.2.0

  - The podman cp command is now aliased as podman container     cp

  - Rootless Podman will now default init_path using root     Podman's configuration files     (/etc/containers/libpod.conf and     /usr/share/containers/libpod.conf) if not overridden in     the rootless configuration

  - Update to image v1.5.1

  - Vendor in latest containers/storage

  - docker/docker_client: Drop redundant Domain(ref.ref)     call

  - pkg/blobinfocache: Split implementations into     subpackages

  - copy: progress bar: show messages on completion

  - docs: rename manpages to *.5.command

  - add container-certs.d.md manpage

  - pkg/docker/config: Bring auth tests from     docker/docker_client_test

  - Don't allocate a sync.Mutex separately

Update to storage v1.12.10 :

  - Add function to parse out mount options from graphdriver

  - Merge the disparate parts of all of the Unix-like     lockfiles

  - Fix unix-but-not-Linux compilation

  - Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set

  - Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes

  - lockfile: add RecursiveLock() API

  - Update generated files

  - Fix crash on tesing of aufs code

  - Let consumers know when Layers and Images came from     read-only stores

  - chown: do not change owner for the mountpoint

  - locks: correctly mark updates to the layers list

  - CreateContainer: don't worry about mapping layers unless     necessary

  - docs: fix manpage for containers-storage.conf

  - docs: sort configuration options alphabetically

  - docs: document OSTree file deduplication

  - Add missing options to man page for containers-storage

  - overlay: use the layer idmapping if present

  - vfs: prefer layer custom idmappings

  - layers: propagate down the idmapping settings

  - Recreate symlink when not found

  - docs: fix manpage for configuration file

  - docs: add special handling for manpages in sect 5

  - overlay: fix single-lower test

  - Recreate symlink when not found

  - overlay: propagate errors from mountProgram

  - utils: root in a userns uses global conf file

  - Fix handling of additional stores

  - Correctly check permissions on rootless directory

  - Fix possible integer overflow on 32bit builds

  - Evaluate device path for lvm

  - lockfile test: make concurrent RW test determinisitc

  - lockfile test: make concurrent read tests deterministic

  - drivers.DirCopy: fix filemode detection

  - storage: move the logic to detect rootless into utils.go

  - Don't set (struct flock).l_pid

  - Improve documentation of getLockfile

  - Rename getLockFile to createLockerForPath, and document     it

  - Add FILES section to containers-storage.5 man page

  - add digest locks

  - drivers/copy: add a non-cgo fallback

slirp4netns was updated to 0.3.0 :

  - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu()     (bsc#1123156)

This update also includes :

  - fuse3 and fuse-overlayfs to support rootless containers.

This update was imported from the SUSE:SLE-15-SP1:Update update project.

According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c     misuses snprintf return values, leading to a buffer     overflow in later code.(CVE-2020-8608)

  - This vulnerability has been modified since it was last     analyzed by the NVD. It is awaiting reanalysis which     may result in further changes to the information     provided.(CVE-2019-11135)

  - tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in     QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based     buffer overflow or other out-of-bounds access which can     lead to a DoS or potential execute arbitrary     code.(CVE-2020-7039)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - Integer overflow in the VNC display driver in QEMU     before 2.1.0 allows attachers to cause a denial of     service (process crash) via a CLIENT_CUT_TEXT message,     which triggers an infinite loop.(CVE-2015-5239)

  - Buffer overflow in the send_control_msg function in     hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows     guest users to cause a denial of service (QEMU process     crash) via a crafted virtio control     message.(CVE-2015-5745)

  - The ne2000_receive function in hw/net/ne2000.c in QEMU     before 2.4.0.1 allows attackers to cause a denial of     service (infinite loop and instance crash) or possibly     execute arbitrary code via vectors related to receiving     packets.(CVE-2015-5278)

  - The process_tx_desc function in hw/net/e1000.c in QEMU     before 2.4.0.1 does not properly process transmit     descriptor data when sending a network packet, which     allows attackers to cause a denial of service (infinite     loop and guest crash) via unspecified     vectors.(CVE-2015-6815)

  - Heap-based buffer overflow in the ne2000_receive     function in hw/net/ne2000.c in QEMU before 2.4.0.1     allows guest OS users to cause a denial of service     (instance crash) or possibly execute arbitrary code via     vectors related to receiving packets.(CVE-2015-5279)

  - Heap-based buffer overflow in the .receive callback of     xlnx.xps-ethernetlite in QEMU (aka Quick Emulator)     allows attackers to execute arbitrary code on the QEMU     host via a large ethlite packet.(CVE-2016-7161)

  - hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier     allows local guest users to cause a denial of service     or possibly execute arbitrary code via vectors related     to (1) RX or (2) TX queue numbers or (3) interrupt     indices. NOTE: some of these details are obtained from     third party information.(CVE-2013-4544)

  - The slirp_smb function in net/slirp.c in QEMU 2.3.0 and     earlier creates temporary files with predictable names,     which allows local users to cause a denial of service     (instantiation failure) by creating /tmp/qemu-smb.*-*     files before the program.(CVE-2015-4037)

  - hw/ide/core.c in QEMU does not properly restrict the     commands accepted by an ATAPI device, which allows     guest users to cause a denial of service or possibly     have unspecified other impact via certain IDE commands,     as demonstrated by a WIN_READ_NATIVE_MAX command to an     empty drive, which triggers a divide-by-zero error and     instance crash.(CVE-2015-6855)

  - hw/virtio/virtio.c in the Virtual Network Device     (virtio-net) support in QEMU, when big or mergeable     receive buffers are not supported, allows remote     attackers to cause a denial of service (guest network     consumption) via a flood of jumbo frames on the (1)     tuntap or (2) macvtap interface.(CVE-2015-7295)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka     Quick Emulator) allows local guest OS privileged users     to cause a denial of service (NULL pointer dereference     and QEMU process crash) by leveraging failure to define     the .write method.(CVE-2015-7549)

  - The eepro100 emulator in QEMU qemu-kvm blank allows     local guest users to cause a denial of service     (application crash and infinite loop) via vectors     involving the command block list.(CVE-2015-8345)

  - Qemu, when built with VNC display driver support,     allows remote attackers to cause a denial of service     (arithmetic exception and application crash) via     crafted SetPixelFormat messages from a     client.(CVE-2015-8504)

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in     QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption)     via a circular isochronous transfer descriptor (iTD)     list.(CVE-2015-8558)

  - Memory leak in net/vmxnet3.c in QEMU allows remote     attackers to cause a denial of service (memory     consumption).(CVE-2015-8567)

  - Memory leak in QEMU, when built with a VMWARE VMXNET3     paravirtual NIC emulator support, allows local guest     users to cause a denial of service (host memory     consumption) by trying to activate the vmxnet3 device     repeatedly.(CVE-2015-8568)

  - Stack-based buffer overflow in the     megasas_ctrl_get_info function in QEMU, when built with     SCSI MegaRAID SAS HBA emulation support, allows local     guest users to cause a denial of service (QEMU instance     crash) via a crafted SCSI controller CTRL_GET_INFO     command.(CVE-2015-8613)

  - Use-after-free vulnerability in hw/ide/ahci.c in QEMU,     when built with IDE AHCI Emulation support, allows     guest OS users to cause a denial of service (instance     crash) or possibly execute arbitrary code via an     invalid AHCI Native Command Queuing (NCQ) AIO     command.(CVE-2016-1568)

  - QEMU (aka Quick Emulator) built with the USB EHCI     emulation support is vulnerable to a null pointer     dereference flaw. It could occur when an application     attempts to write to EHCI capabilities registers. A     privileged user inside quest could use this flaw to     crash the QEMU process instance resulting in     DoS.(CVE-2016-2198)

  - The ohci_bus_start function in the USB OHCI emulation     support (hw/usb/hcd-ohci.c) in QEMU allows local guest     OS administrators to cause a denial of service (NULL     pointer dereference and QEMU process crash) via vectors     related to multiple eof_timers.(CVE-2016-2391)

  - The is_rndis function in the USB Net device emulator     (hw/usb/dev-network.c) in QEMU before 2.5.1 does not     properly validate USB configuration descriptor objects,     which allows local guest OS administrators to cause a     denial of service (NULL pointer dereference and QEMU     process crash) via vectors involving a remote NDIS     control message packet.(CVE-2016-2392)

  - Multiple integer overflows in the USB Net device     emulator (hw/usb/dev-network.c) in QEMU before 2.5.1     allow local guest OS administrators to cause a denial     of service (QEMU process crash) or obtain sensitive     host memory information via a remote NDIS control     message packet that is mishandled in the (1)     rndis_query_response, (2) rndis_set_response, or (3)     usb_net_handle_dataout function.(CVE-2016-2538)

  - The ne2000_receive function in the NE2000 NIC emulation     support (hw/net/ne2000.c) in QEMU before 2.5.1 allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via     crafted values for the PSTART and PSTOP registers,     involving ring buffer control.(CVE-2016-2841)

  - QEMU, when built with the Pseudo Random Number     Generator (PRNG) back-end support, allows local guest     OS users to cause a denial of service (process crash)     via an entropy request, which triggers arbitrary stack     based allocation and memory corruption.(CVE-2016-2858)

  - Buffer overflow in the stellaris_enet_receive function     in hw/net/stellaris_enet.c in QEMU, when the Stellaris     ethernet controller is configured to accept large     packets, allows remote attackers to cause a denial of     service (QEMU crash) via a large packet.(CVE-2016-4001)

  - Buffer overflow in the mipsnet_receive function in     hw/net/mipsnet.c in QEMU, when the guest NIC is     configured to accept large packets, allows remote     attackers to cause a denial of service (memory     corruption and QEMU crash) or possibly execute     arbitrary code via a packet larger than 1514     bytes.(CVE-2016-4002)

  - The ehci_advance_state function in hw/usb/hcd-ehci.c in     QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption)     via a circular split isochronous transfer descriptor     (siTD) list, a related issue to     CVE-2015-8558.(CVE-2016-4037)

  - The vmsvga_fifo_run function in hw/display/vmware_vga.c     in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and QEMU process     crash) via a VGA command.(CVE-2016-4453)

  - The vmsvga_fifo_read_raw function in     hw/display/vmware_vga.c in QEMU allows local guest OS     administrators to obtain sensitive host memory     information or cause a denial of service (QEMU process     crash) by changing FIFO registers and issuing a VGA     command, which triggers an out-of-bounds     read.(CVE-2016-4454)

  - The net_tx_pkt_do_sw_fragmentation function in     hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (infinite loop and QEMU process crash) via a     zero length for the current fragment     length.(CVE-2016-6834)

  - The vmxnet_tx_pkt_parse_headers function in     hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator)     allows local guest OS administrators to cause a denial     of service (buffer over-read) by leveraging failure to     check IP header length.(CVE-2016-6835)

  - The vmxnet3_complete_packet function in     hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to obtain sensitive host     memory information by leveraging failure to initialize     the txcq_descr object.(CVE-2016-6836)

  - Integer overflow in the net_tx_pkt_init function in     hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (QEMU process crash) via the maximum     fragmentation count, which triggers an unchecked     multiplication and NULL pointer     dereference.(CVE-2016-6888)

  - Directory traversal vulnerability in hw/9pfs/9p.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to access host files outside the export     path via a .. (dot dot) in an unspecified     string.(CVE-2016-7116)

  - The pvscsi_ring_pop_req_descr function in     hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) by     leveraging failure to limit process IO loop to the ring     size.(CVE-2016-7421)

  - The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7908)

  - The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU     (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) by setting the (1) receive     or (2) transmit descriptor ring length to     0.(CVE-2016-7909)

  - The xhci_ring_fetch function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and QEMU process crash) by leveraging failure to     limit the number of link Transfer Request Blocks (TRB)     to process.(CVE-2016-8576)

  - The serial_update_parameters function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (divide-by-zero error and QEMU process crash)     via vectors involving a value of divider greater than     baud base.(CVE-2016-8669)

  - The intel_hda_xfer function in hw/audio/intel-hda.c in     QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) via an entry with the same     value for buffer length and pointer     position.(CVE-2016-8909)

  - The rtl8139_cplus_transmit function in hw/net/rtl8139.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite     loop and CPU consumption) by leveraging failure to     limit the ring descriptor count.(CVE-2016-8910)

  - Memory leak in the v9fs_xattrcreate function in     hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS administrators to cause a denial of service     (memory consumption and QEMU process crash) via a large     number of Txattrcreate messages with the same fid     number.(CVE-2016-9102)

  - The v9fs_xattrcreate function in hw/9pfs/9p.c in QEMU     (aka Quick Emulator) allows local guest OS     administrators to obtain sensitive host heap memory     information by reading xattribute values before writing     to them.(CVE-2016-9103)

  - Multiple integer overflows in the (1) v9fs_xattr_read     and (2) v9fs_xattr_write functions in hw/9pfs/9p.c in     QEMU (aka Quick Emulator) allow local guest OS     administrators to cause a denial of service (QEMU     process crash) via a crafted offset, which triggers an     out-of-bounds access.(CVE-2016-9104)

  - Memory leak in the v9fs_link function in hw/9pfs/9p.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (memory     consumption) via vectors involving a reference to the     source fid object.(CVE-2016-9105)

  - Memory leak in the v9fs_write function in hw/9pfs/9p.c     in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (memory     consumption) by leveraging failure to free an IO     vector.(CVE-2016-9106)

  - Race condition in QEMU in Xen allows local x86 HVM     guest OS administrators to gain privileges by changing     certain data on shared rings, aka a 'double fetch'     vulnerability.(CVE-2016-9381)

  - Quick Emulator (Qemu) built with the USB redirector     usb-guest support is vulnerable to a memory leakage     flaw. It could occur while destroying the USB     redirector in 'usbredir_handle_destroy'. A guest     user/process could use this issue to leak host memory,     resulting in DoS for a host.(CVE-2016-9907)

  - Quick Emulator (Qemu) built with the USB EHCI Emulation     support is vulnerable to a memory leakage issue. It     could occur while processing packet data in     'ehci_init_transfer'. A guest user/process could use     this issue to leak host memory, resulting in DoS for a     host.(CVE-2016-9911)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick     Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash).(CVE-2017-18043)

  - Memory leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)

  - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors related to     control transfer descriptor sequence.(CVE-2017-5973)

  - Memory leak in the audio/audio.c in QEMU (aka Quick     Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and     stopping audio capture.(CVE-2017-8309)

  - Memory leak in QEMU (aka Quick Emulator), when built     with IDE AHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the AHCI     device.(CVE-2017-9373)

  - Memory leak in QEMU (aka Quick Emulator), when built     with USB EHCI Emulation support, allows local guest OS     privileged users to cause a denial of service (memory     consumption) by repeatedly hot-unplugging the     device.(CVE-2017-9374)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC     emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could     occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu     process resulting in DoS.(CVE-2018-10839)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a     heap-based buffer overflow.(CVE-2019-6778)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
130689	EulerOS 2.0 SP5 : qemu-kvm (EulerOS-SA-2019-2227)	Nessus	Huawei Local Security Checks	11/8/2019	4/15/2024	critical
180647	Oracle Linux 7 : qemu (ELSA-2019-4640)	Nessus	Oracle Linux Local Security Checks	9/7/2023	11/1/2024	critical
128458	openSUSE Security Update : podman / slirp4netns and libcontainers-common (openSUSE-2019-2044)	Nessus	SuSE Local Security Checks	9/3/2019	4/30/2024	high
135559	EulerOS 2.0 SP3 : qemu-kvm (EulerOS-SA-2020-1430)	Nessus	Huawei Local Security Checks	4/15/2020	3/18/2024	critical

Detections

Analytics

Plugins Search

critical

critical

high

critical