The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0019 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-4144:
    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0118 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:
      CVE-2022-4144:
      An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest's physical address, potentially     reading past the end of the bar space into adjacent pages. This could allow a malicious guest user to     crash the QEMU process on the host, causing a denial of service. Spice was found to be affected by the     same CVE.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0099 advisory.

    * QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c8a60f6f80 advisory.

    ati-vga: out-of-bounds write in ati_2d_blt (CVE-2021-3638) (rhbz#1979882)     qxl: qxl_phys2virt unsafe address translation (CVE-2022-4144) (rhbz#2148542)     linux-user: default to -cpu max (rhbz#2121700)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0878-1 advisory.

    - CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt     (bsc#1205808).
    - CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2023_0099 advisory.

    * QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read (CVE-2022-4144)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0869 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5088:
    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

    CVE-2023-40360:
    A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device     backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this     time window to trigger an assertion and cause a denial of service.

    CVE-2023-3180:
    QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no     check for whether an endurance group is configured before checking whether Flexible Data Placement is     enabled.

    CVE-2023-42467:
    A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does     not validate an offset provided by the guest before computing a host heap pointer, which is used for     copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

    CVE-2023-3354:
    A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service.

    CVE-2023-3301:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service.

    CVE-2023-4135:
    A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

    CVE-2023-3255:
    QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately.

    CVE-2021-3750:
    A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller/'s registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0.

    CVE-2021-3929:
    A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is     similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function     nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or,     potentially, executing arbitrary code within the context of the QEMU process on the host.

    CVE-2021-4158:
    A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within     the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition.

    CVE-2021-4206:
    A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process.

    CVE-2021-4207:
    A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process.

    CVE-2022-0358:
    A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is     strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by     virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of the group. This could allow a malicious unprivileged user     inside the guest to gain access to resources accessible to the root group, potentially escalating their     privileges within the guest. A malicious local user in the host might also leverage this unexpected     executable file created by the guest to escalate their privileges on the host system.

    CVE-2022-2962:
    A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the     rx/tx descriptor or copies the rx/tx frame, it doesn/'t check whether the destination address is its own     MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a     stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host,     resulting in a denial of service condition.

    CVE-2022-3165:
    An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the     extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially     crafted payload message, resulting in a denial of service.

    CVE-2022-35414:
    ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the     translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-     virtualization Use Case in the qemu.org reference applies here, i.e., Bugs affecting the non-     virtualization use case are not considered security bugs at this time.

    CVE-2022-3872:
    An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition.

    CVE-2022-4144:
    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition.

    CVE-2023-1544:
    A flaw was found in the QEMU implementation of VMWare/'s paravirtual RDMA device. This flaw allows a     crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of     descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.

    CVE-2023-6683:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service.

    CVE-2023-6693:
    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the     Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==     block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a     denial of service condition. (CVE-2022-3872)

  - An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0761-1 advisory.

    - bsc#1172033 (CVE-2020-13253)

    - bsc#1180207 (CVE-2020-14394)

    - bsc#1172382 (CVE-2020-13754)

    - bsc#1198038 (CVE-2022-0216)

    - bsc#1193880 (CVE-2021-3929)

    - bsc#1197653 (CVE-2022-1050)

    - bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)

    - bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409),       bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414
    - About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)

    - bsc#1198035, CVE-2021-4206

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-22b1f8dae2 advisory.

    hcd-xhci: infinite loop in xhci_ring_chain_length (CVE-2020-14394)     ati-vga: out-of-bounds write in ati_2d_blt (CVE-2021-3638)     acpi erst: memory corruption issues (CVE-2022-4172)     qxl: qxl_phys2virt unsafe address translation (CVE-2022-4144)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
236088	Alibaba Cloud Linux 3 : 0019: virt:rhel and virt-devel:rhel (ALINUX3-SA-2023:0019)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
276387	TencentOS Server 3: virt and virt-devel (TSSA-2023:0118)	Nessus	Tencent Local Security Checks	11/20/2025	12/5/2025	medium
170029	AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2023:0099)	Nessus	Alma Linux Local Security Checks	1/13/2023	1/13/2025	medium
170176	Fedora 36 : qemu (2023-c8a60f6f80)	Nessus	Fedora Local Security Checks	1/19/2023	11/14/2024	medium
173379	SUSE SLES15: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-pa / qemu-block-curl / etc (SUSE-SU-2023:0878-1)	Nessus	SuSE Local Security Checks	3/24/2023	6/26/2026	medium
357102	Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc (crlsa-2023_0099)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/1/2026	medium
238947	TencentOS Server 4: qemu (TSSA-2024:0869)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
175739	EulerOS Virtualization 2.10.1 : qemu (EulerOS-SA-2023-1913)	Nessus	Huawei Local Security Checks	5/16/2023	5/16/2023	high
172642	SUSE SLES12: qemu / qemu-arm / qemu-audio-alsa / qemu-audio-oss / qemu-audio-pa / etc (SUSE-SU-2023:0761-1)	Nessus	SuSE Local Security Checks	3/17/2023	6/26/2026	high
211221	Fedora 37 : qemu (2022-22b1f8dae2)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

high

high

high

medium