Several vulnerabilities were found in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization).

CVE-2016-5126

Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.

CVE-2016-5403

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

CVE-2017-9375

QEMU, when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.

CVE-2019-12068

QEMU scsi disk backend: lsi: exit infinite loop while executing script

CVE-2019-12155

interface_release_resource in hw/display/qxl.c in QEMU has a NULL pointer dereference.

CVE-2019-13164

qemu-bridge-helper.c in QEMU does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

CVE-2019-14378

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a case involving the first fragment.

CVE-2019-15890

libslirp 4.0.0, as used in QEMU, has a use-after-free in ip_reass in ip_input.c.

For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u12.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen to version 4.11.2 fixes the following issues :

Security issues fixed :

CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).

CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).

CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).

Other issues fixed: Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717).

Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774).

Fixed an issue where libxenlight could not create new domain (bsc#1131811).

Fixed an issue where attached pci devices were lost after reboot (bsc#1129642).

Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14199-1 advisory.

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2,     and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter     emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode     is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
    (CVE-2019-12068)

  - interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
    (CVE-2019-12155)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it     mishandles a case involving the first fragment. (CVE-2019-14378)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or     gain privileges because grant-table transfer requests are mishandled. (CVE-2019-17340)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI     device. (CVE-2019-17341)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.
    (CVE-2019-17342)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges by leveraging incorrect use of the HVM physmap concept for PV domains. (CVE-2019-17343)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     by leveraging a long-running operation that exists to support restartability of PTE updates.
    (CVE-2019-17344)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB     flushes. (CVE-2019-17346)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     or gain privileges because a guest can manipulate its virtualised %cr4 in a way that is incompatible with     Linux (and possibly other guest kernels). (CVE-2019-17347)

  - An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service     because of an incompatibility between Process Context Identifiers (PCID) and shadow-pagetable switching.
    (CVE-2019-17348)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3742 advisory.

  - QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3787 advisory.

  - QEMU: qxl: null pointer dereference while releasing spice resources (CVE-2019-12155)

  - QEMU: slirp: heap buffer overflow during packet reassembly (CVE-2019-14378)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does     not prevent ..\ directory traversal on     Windows.(CVE-2020-7211)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - QEMU 3.0.0 has an Integer Overflow because the     qga/commands*.c files do not check the length of the     argument list or the number of environment variables.
    NOTE: This has been disputed as not     exploitable.(CVE-2019-12247)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a     NULL pointer dereference, which allows the attacker to     cause a denial of service via a device     driver.(CVE-2019-5008)

  - An OOB heap buffer r/w access issue was found in the     NVM Express Controller emulation in QEMU. It could     occur in nvme_cmb_ops routines in nvme device. A guest     user/process could use this flaw to crash the QEMU     process resulting in DoS or potentially run arbitrary     code with privileges of the QEMU     process.(CVE-2018-16847)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to     cause a denial of service (NULL pointer dereference or     excessive memory allocation) in create_cq_ring or     create_qp_rings.(CVE-2018-20125)

  - QEMU can have an infinite loop in     hw/rdma/vmw/pvrdma_dev_ring.c because return values are     not checked (and -1 is mishandled).(CVE-2018-20216)

  - The load_multiboot function in hw/i386/multiboot.c in     Quick Emulator (aka QEMU) allows local guest OS users     to execute arbitrary code on the QEMU host via a     mh_load_end_addr value greater than mh_bss_end_addr,     which triggers an out-of-bounds read or write memory     access.(CVE-2018-7550)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).

CVE-2019-12155: Security fix for NULL pointer dereference while releasing spice resources (bsc#1135902).

CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-14378: Security fix for heap overflow in     ip_reass on big packet input (bsc#1143794).

  - CVE-2019-12155: Security fix for NULL pointer     dereference while releasing spice resources     (bsc#1135902).

  - CVE-2019-13164: Security fix for qemu-bridge-helper ACL     can be bypassed when names are too long (bsc#1140402).

  - CVE-2019-5008: Fix DoS (NULL pointer dereference) in     sparc64 virtual machine possible through guest device     driver (bsc#1133031).

Bug fixes and enhancements :

  - Upstream tweaked SnowRidge-Server vcpu model to now be     simply Snowridge (jsc#SLE-4883)

  - Add SnowRidge-Server vcpu model (jsc#SLE-4883)

  - Add in documentation about md-clear feature     (bsc#1138534)

  - Fix SEV issue where older machine type is not processed     correctly (bsc#1144087)

  - Fix case of a bad pointer in Xen PV usb support code     (bsc#1128106)

  - Further refine arch-capabilities handling to help with     security and performance in Intel hosts (bsc#1134883,     bsc#1135210) (fate#327764)

  - Add support for one more security/performance related     vcpu feature (bsc#1136778) (fate#327796)

  - Ignore csske for expanding the cpu model (bsc#1136540)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
129105	Debian DLA-1927-1 : qemu security update	Nessus	Debian Local Security Checks	9/23/2019	4/24/2024	high
130197	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2019:2753-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	10/24/2019	12/5/2022	high
150593	SUSE SLES11 Security Update : xen (SUSE-SU-2019:14199-1)	Nessus	SuSE Local Security Checks	6/10/2021	1/21/2022	high
194095	RHEL 7 : qemu-kvm-rhev (RHSA-2019:3742)	Nessus	Red Hat Local Security Checks	4/27/2024	4/27/2024	high
194159	RHEL 7 : qemu-kvm-rhev (RHSA-2019:3787)	Nessus	Red Hat Local Security Checks	4/28/2024	4/28/2024	high
139983	EulerOS 2.0 SP8 : qemu (EulerOS-SA-2020-1880)	Nessus	Huawei Local Security Checks	8/28/2020	2/22/2024	high
128301	SUSE SLES12 Security Update : qemu (SUSE-SU-2019:2221-1)	Nessus	SuSE Local Security Checks	8/28/2019	4/30/2024	high
128457	openSUSE Security Update : qemu (openSUSE-2019-2041)	Nessus	SuSE Local Security Checks	9/3/2019	4/30/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high