The version of qemu-kvm installed on the remote host is prior to 1.5.3-156.19. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2020-1408 advisory.

    tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an     snprintf call, leading to Information disclosure. (CVE-2019-9824)

    tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC     DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which     can lead to a DoS or potential execute arbitrary code. (CVE-2020-7039)

    In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer     overflow in later code. (CVE-2020-8608)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two issues have been found in slirp, a SLIP/PPP emulator using a dial up shell account.

CVE-2020-7039

Due to mismanagement of memory, a heap-based buffer overflow or other out-of-bounds access might happen, which can lead to a DoS or potential execute arbitrary code.

CVE-2020-8608

Prevent a buffer overflow vulnerability due to incorrect usage of return values from snprintf.

For Debian 9 stretch, these problems have been fixed in version 1:1.0.17-8+deb9u1.

We recommend that you upgrade your slirp packages.

For the detailed security status of slirp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/slirp

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanag es memory, as demonstrated by IRC DCC commands in EMU_IRC.
This can cause a heap-based buffer overflow or other out-of-bounds acces s which can lead to a DoS or potential execute arbitrary code.

For Debian 8 'Jessie', this problem has been fixed in version 1:2.1+dfsg-12+deb8u13.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

  - CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu()     routine while emulating IRC and other protocols     (bsc#1161066).

  - CVE-2019-15034: Fixed a buffer overflow in     hw/display/bochs-display.c due to improper PCI config     space allocation (bsc#1166379).

  - CVE-2020-1711: Fixed an out of bounds heap buffer access     iscsi_co_block_status() routine which could have allowed     a remote denial of service or arbitrary code with     privileges of the QEMU process on the host     (bsc#1166240).

  - CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu()     routine while emulating the identification protocol and     copying message data to a socket buffer (bsc#1123156).

  - CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu()     routine while emulating IRC and other protocols     (bsc#1163018).

  - CVE-2019-20382: Fixed a memory leak in the VNC display     driver which could have led to exhaustion of the host     memory leading to a potential Denial of service     (bsc#1165776).

  - Fixed a live migration error (bsc#1154790).

  - Fixed an issue where migrating VMs on KVM gets missing     features:ospke error (bsc#1162729).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0348 advisory.

    The container-tools module contains tools for working with containers, notably podman, buildah, skopeo,     and runc.

    Security Fix(es):

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

CVE-2020-7039: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1161066).

CVE-2019-15034: Fixed a buffer overflow in hw/display/bochs-display.c due to improper PCI config space allocation (bsc#1166379).

CVE-2020-1711: Fixed an out of bounds heap buffer access iscsi_co_block_status() routine which could have allowed a remote denial of service or arbitrary code with privileges of the QEMU process on the host (bsc#1166240).

CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() routine while emulating the identification protocol and copying message data to a socket buffer (bsc#1123156).

CVE-2020-8608: Fixed a heap buffer overflow in tcp_emu() routine while emulating IRC and other protocols (bsc#1163018).

CVE-2019-20382: Fixed a memory leak in the VNC display driver which could have led to exhaustion of the host memory leading to a potential Denial of service (bsc#1165776).

Fixed live migration errors (bsc#1154790, bsc#1156794, bsc#1156642).

Fixed an issue where migrating VMs on KVM gets missing features:ospke error (bsc#1162729).

Fixed an issue where booting up a guest system with mdev passthrough device as installation device was failing (bsc#1158880).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1351 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

    * QEMU: Slirp: potential OOB access due to unsafe snprintf() usages (CVE-2020-8608)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0889 advisory.

    The slirp4netns package contains user-mode networking for unprivileged network namespaces. It is required     to enable networking for rootless containers.

    Security Fix(es):

    * QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

    * QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu() (CVE-2020-7039)

    * CVE-2020-8608 slirp4netns: QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

    * CVE-2019-15890 QEMU: Slirp: use-after-free during packet reassembly

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - QEMU: slirp: heap buffer overflow during packet     reassembly (CVE-2019-14378)

  - QEMU: slirp: OOB buffer access while emulating tcp     protocols in tcp_emu() (CVE-2020-7039)

  - QEMU: Slirp: use-after-free during packet reassembly     (CVE-2019-15890)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-0775 advisory.

    - Resolves: bz#1734747       (CVE-2019-14378 qemu-kvm: QEMU: slirp: heap buffer overflow during packet reassembly [rhel-6.10.z])
    - Resolves: bz#1749731       (CVE-2019-15890 qemu-kvm: QEMU: Slirp: use-after-free during packet reassembly [rhel-6])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the qemu-kvm-6.1.0-3.el9 build changelog.

  - use-after-free during packet reassembly [rhel-av-8]) (CVE-2019-15890)

  - A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM     introduced in version 4.0 and fixed in version 5.0.0. A general failure of the signature generation     process caused every PAuth-enforced pointer to be signed with the same signature. A local attacker could     obtain the signature of a protected pointer and abuse this flaw to bypass PAuth protection for all     programs running on QEMU. (CVE-2020-10702)

  - A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of     the QEMU version >= v5.0. Virtio-fs is meant to share a host file system directory with a guest via     virtio-fs device. If the guest opens the maximum number of file descriptors under the shared directory, a     denial of service may occur. This flaw allows a guest user/process to cause this denial of service on the     host. (CVE-2020-10717)

  - An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine while replying to an ICMP echo request, also known     as ping. This flaw allows a malicious guest to leak the contents of the host memory, resulting in possible     information disclosure. This flaw affects versions of libslirp before 4.3.1. (CVE-2020-10756)

  - An assertion failure issue was found in the Network Block Device(NBD) Server in all QEMU versions before     QEMU 5.0.1. This flaw occurs when an nbd-client sends a spec-compliant request that is near the boundary     of maximum permitted request length. A remote nbd-client could use this flaw to crash the qemu-nbd server     resulting in a denial of service. (CVE-2020-10761)

  - out-of-bounds r/w access issue while processing usb packets [rhel-av-8.3.0]) (CVE-2020-14364)

  - OOB heap access via an unexpected response of iSCSI Server [rhel-av-8.2.0]) (CVE-2020-1711)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system     daemon where a privileged guest user is able to create a device special file in the shared directory and     use it to r/w access host devices. (CVE-2020-35517)

  - OOB buffer access while emulating tcp protocols in tcp_emu() [rhel-av-8.2.0]) (CVE-2020-7039)

  - potential OOB access due to unsafe snprintf() usages [rhel-av-8.2.0]) (CVE-2020-8608)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option     may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a     modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a     malicious user to elevate their privileges within the guest. (CVE-2021-20263)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
139088	Amazon Linux AMI : qemu-kvm (ALAS-2020-1408)	Nessus	Amazon Linux Local Security Checks	7/30/2020	12/11/2024	medium
146372	Debian DLA-2551-1 : slirp security update	Nessus	Debian Local Security Checks	2/10/2021	1/22/2024	medium
133366	Debian DLA-2090-1 : qemu security update	Nessus	Debian Local Security Checks	1/31/2020	3/28/2024	medium
135265	openSUSE Security Update : qemu (openSUSE-2020-468)	Nessus	SuSE Local Security Checks	4/7/2020	3/19/2024	high
133481	RHEL 8 : container-tools:rhel8 (RHSA-2020:0348)	Nessus	Red Hat Local Security Checks	2/5/2020	3/15/2025	medium
135169	SUSE SLES12 Security Update : qemu (SUSE-SU-2020:0845-1)	Nessus	SuSE Local Security Checks	4/2/2020	5/13/2022	high
135245	RHEL 7 : qemu-kvm (RHSA-2020:1351)	Nessus	Red Hat Local Security Checks	4/7/2020	11/7/2024	medium
138073	RHEL 7 : slirp4netns (RHSA-2020:0889)	Nessus	Red Hat Local Security Checks	7/2/2020	11/7/2024	high
134395	Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200310)	Nessus	Scientific Linux Local Security Checks	3/11/2020	3/22/2024	high
134388	Oracle Linux 6 : qemu-kvm (ELSA-2020-0775)	Nessus	Oracle Linux Local Security Checks	3/11/2020	10/22/2024	high
191255	CentOS 9 : qemu-kvm-6.1.0-3.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	high

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

high

medium

high

high

high

high