The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1531 advisory.

  - qemu: when started as root, extra groups are not dropped correctly (CVE-2011-2527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- CVE-2011-1750 virtio-blk: heap buffer overflow (bz     698906, bz 698911)

    - CVE-2011-2527 set groups properly for -runas (bz       720773, bz 720784)

    - CVE-2012-0029 e1000 buffer overflow (bz 783984, bz       772075)

    - virtio-blk: refuse SG_IO requests with scsi=off (bz       770135)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1531 advisory.

  - The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group     privileges when the -runas option is used, which allows local guest users to access restricted files on     the host. (CVE-2011-2527)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Andrew Griffiths discovered that QEMU did not correctly drop privileges when using the 'runas' argument. Under certain circumstances a local attacker could exploit this to escalate privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in KVM, a solution for full virtualization on x86 hardware :

  - CVE-2011-2212     Nelson Elhage discovered a buffer overflow in the virtio     subsystem, which could lead to denial of service or     privilege escalation.

  - CVE-2011-2527     Andrew Griffiths discovered that group privileges were     insufficiently dropped when started with -runas option,     resulting in privilege escalation.

The following vulnerabilities have been fixed in KVM :

  - buffer overflow in e1000 device emulation.
    (CVE-2012-0029)

  - missing initgroups() for -runas (CVE-2011-2527)

A missing initgroups() call for the -runas option has been fixed in kvm (CVE-2011-2527) as well as a buffer overflow in the e1000 device emulation (CVE-2012-0029).

ID	Name	Product	Family	Published	Updated	Severity
64006	RHEL 6 : qemu-kvm (RHSA-2011:1531)	Nessus	Red Hat Local Security Checks	1/24/2013	4/27/2024	medium
59420	Fedora 15 : qemu-0.14.0-9.fc15 (2012-8604)	Nessus	Fedora Local Security Checks	6/8/2012	1/11/2021	high
181093	Oracle Linux 6 : qemu-kvm (ELSA-2011-1531)	Nessus	Oracle Linux Local Security Checks	9/7/2023	12/25/2023	medium
55717	Ubuntu 10.04 LTS / 10.10 / 11.04 : qemu-kvm vulnerability (USN-1177-1)	Nessus	Ubuntu Local Security Checks	7/28/2011	9/19/2019	low
55672	Debian DSA-2282-1 : qemu-kvm - several vulnerabilities	Nessus	Debian Local Security Checks	7/26/2011	1/11/2021	high
57725	SuSE 11.1 Security Update : KVM (SAT Patch Number 5655)	Nessus	SuSE Local Security Checks	1/30/2012	1/19/2021	high
75889	openSUSE Security Update : kvm (openSUSE-SU-2012:0207-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/19/2021	high

Detections

Analytics

Plugins Search

medium

high

medium

low

high

high

high