tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanag es memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds acces s which can lead to a DoS or potential execute arbitrary code.

For Debian 8 'Jessie', this problem has been fixed in version 1:2.1+dfsg-12+deb8u13.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2020:0775 :

An update for qemu-kvm is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es) :

* QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

* QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

* QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - QEMU: slirp: heap buffer overflow during packet     reassembly (CVE-2019-14378)

  - QEMU: slirp: OOB buffer access while emulating tcp     protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: use-after-free during packet reassembly     (CVE-2019-15890)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0889 advisory.

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

  - QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

  - QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1351 advisory.

  - QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the qemu-kvm-6.1.0-3.el9 build changelog.

  - use-after-free during packet reassembly [rhel-av-8]) (CVE-2019-15890)

  - A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation     process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could     obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all     programs running on QEMU. (CVE-2020-10702)

  - A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of     the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via     virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a     denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the     host. (CVE-2020-10717)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before     QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary     of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server     resulting in a denial of service. (CVE-2020-10761)

  - out-of-bounds r/w access issue while processing usb packets [rhel-av-8.3.0]) (CVE-2020-14364)

  - OOB heap access via an unexpected response of iSCSI Server [rhel-av-8.2.0]) (CVE-2020-1711)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-av-8.2.0]) (CVE-2020-7039)

  - potential OOB access due to unsafe snprintf() usages [rhel-av-8.2.0]) (CVE-2020-8608)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
(CVE-2020-8608)

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
(CVE-2020-7039)

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. (CVE-2019-9824)

tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information disclosure. (CVE-2019-9824)

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.
(CVE-2020-7039)

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
(CVE-2020-8608)

ID	Name	Product	Family	Published	Updated	Severity
133366	Debian DLA-2090-1 : qemu security update	Nessus	Debian Local Security Checks	1/31/2020	3/28/2024	medium
134388	Oracle Linux 6 : qemu-kvm (ELSA-2020-0775)	Nessus	Oracle Linux Local Security Checks	3/11/2020	5/18/2022	high
134395	Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200310)	Nessus	Scientific Linux Local Security Checks	3/11/2020	3/22/2024	high
138073	RHEL 7 : slirp4netns (RHSA-2020:0889)	Nessus	Red Hat Local Security Checks	7/2/2020	5/25/2023	high
135245	RHEL 7 : qemu-kvm (RHSA-2020:1351)	Nessus	Red Hat Local Security Checks	4/7/2020	4/28/2024	medium
191255	CentOS 9 : qemu-kvm-6.1.0-3.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high
138642	Amazon Linux AMI : qemu-kvm (ALAS-2020-1400)	Nessus	Amazon Linux Local Security Checks	7/20/2020	2/29/2024	medium
139088	Amazon Linux AMI : qemu-kvm (ALAS-2020-1408)	Nessus	Amazon Linux Local Security Checks	7/30/2020	2/27/2024	medium

Detections

Analytics

Plugins Search

medium

high

high

high

medium

high

medium

medium