This update for qemu fixes several issues. These security issues were fixed :

  - CVE-2017-10911: The make_response function in the Linux     kernel allowed guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures (bsc#1057378).

  - CVE-2017-12809: The IDE disk and CD/DVD-ROM Emulator     support allowed local guest OS privileged users to cause     a denial of service (NULL pointer dereference and QEMU     process crash) by flushing an empty CDROM device drive     (bsc#1054724).

  - CVE-2017-15289: The mode4and5 write functions allowed     local OS guest privileged users to cause a denial of     service (out-of-bounds write access and Qemu process     crash) via vectors related to dst calculation     (bsc#1063122)

  - CVE-2017-15038: Race condition in the v9fs_xattrwalk     function local guest OS users to obtain sensitive     information from host heap memory via vectors related to     reading extended attributes (bsc#1062069)

  - CVE-2017-14167: Integer overflow in the load_multiboot     function allowed local guest OS users to execute     arbitrary code on the host via crafted multiboot header     address values, which trigger an out-of-bounds write     (bsc#1057585)

  - CVE-2017-11434: The dhcp_decode function in     slirp/bootp.c allowed local guest OS users to cause a     denial of service (out-of-bounds read) via a crafted     DHCP options string (bsc#1049381)

  - CVE-2017-11334: The address_space_write_continue     function allowed local guest OS privileged users to     cause a denial of service (out-of-bounds access and     guest instance crash) by leveraging use of     qemu_map_ram_ptr to access guest ram block area     (bsc#1048902)

  - CVE-2017-13672: The VGA display emulator support allowed     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update (bsc#1056334)

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025109)

  - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks     function in hw/sd/sdhci.c allowed local OS guest     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors involving the     transfer mode register during multi block transfer     (bsc#1025311)

  - CVE-2017-6505: The ohci_service_ed_list function allowed     local guest OS users to cause a denial of service     (infinite loop) via vectors involving the number of link     endpoint list descriptors (bsc#1028184)

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028656)

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034908)

  - CVE-2017-7980: An out-of-bounds r/w access issues in the     Cirrus CLGD 54xx VGA Emulator support allowed privileged     user inside guest to use this flaw to crash the Qemu     process resulting in DoS or potentially execute     arbitrary code on a host with privileges of Qemu process     on the host (bsc#1035406)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036211)

  - CVE-2017-9375: The USB xHCI controller emulator support     was vulnerable to an infinite recursive call loop issue,     which allowed a privileged user inside guest to crash     the Qemu process resulting in DoS (bsc#1042800)

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043073)

  - CVE-2017-9373: The IDE AHCI Emulation support was     vulnerable to a host memory leakage issue, which allowed     a privileged user inside guest to leak host memory     resulting in DoS (bsc#1042801)

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042159)

  - CVE-2017-8379: Memory leak in the keyboard input event     handlers support allowed local guest OS privileged users     to cause a denial of service (host memory consumption)     by rapidly generating large keyboard events     (bsc#1037334)

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037242)

  - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to an out-of-bounds     read access issue which allowed a privileged user inside     guest to read host memory resulting in DoS (bsc#1037336)

  - CVE-2017-7493: The VirtFS, host directory sharing via     Plan 9 File System(9pfs) support, was vulnerable to an     improper access control issue. It could occur while     accessing virtfs metadata files in mapped-file security     mode. A guest user could have used this flaw to escalate     their privileges inside guest (bsc#1039495)

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021741)

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043296)

  - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which     allowed remote attackers to cause a denial of service     (daemon crash) by disconnecting during a     server-to-client reply attempt (bsc#1046636)

  - CVE-2017-10806: Stack-based buffer overflow allowed     local guest OS users to cause a denial of service (QEMU     process crash) via vectors related to logging debug     messages (bsc#1047674)

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427)

  - CVE-2017-7377: The v9fs_create and v9fs_lcreate     functions in hw/9pfs/9p.c allowed local guest OS     privileged users to cause a denial of service (file     descriptor or memory consumption) via vectors related to     an already in-use fid (bsc#1032075)

  - CVE-2017-8086: A memory leak in the v9fs_list_xattr     function in hw/9pfs/9p-xattr.c allowed local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable (bsc#1035950)

  - CVE-2017-7471: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper access control issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1034866)

  - CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC     device support, causing an OOB read access (bsc#994605)

  - CVE-2016-6834: A infinite loop during packet     fragmentation in the VMWARE VMXNET3 NIC device support     allowed privileged user inside guest to crash the Qemu     instance resulting in DoS (bsc#994418)

  - Fix privilege escalation in TCG mode (bsc#1030624)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - A use-after-free issue was found in the Slirp     networking implementation of the Quick emulator (QEMU).
    It occurs when a Socket referenced from multiple     packets is freed while responding to a message. A     user/process could use this flaw to crash the QEMU     process on the host resulting in denial of     service.(CVE-2017-13711)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - A heap buffer overflow issue was found in the way SLiRP     networking back-end in QEMU processes fragmented     packets. It could occur while reassembling the     fragmented datagrams of an incoming packet. A     privileged user/process inside guest could use this     flaw to crash the QEMU process resulting in DoS or     potentially leverage it to execute arbitrary code on     the host with privileges of the QEMU     process.(CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - An integer overflow issue was found in the RTL8139 NIC     emulation in QEMU. It could occur while receiving     packets over the network if the size value is greater     than INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process, resulting in DoS     scenario.(CVE-2018-17958)

  - An integer overflow issue was found in the AMD PC-Net     II NIC emulation in QEMU. It could occur while     receiving packets, if the size value was greater than     INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process resulting in     DoS.(CVE-2018-17962)

  - A heap buffer overflow issue was found in the     load_device_tree() function of QEMU, which is invoked     to load a device tree blob at boot time. It occurs due     to device tree size manipulation before buffer     allocation, which could overflow a signed int type. A     user/process could use this flaw to potentially execute     arbitrary code on a host system with privileges of the     QEMU process.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     3.1.x through 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not     ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the     IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the ip_reass() routine while     reassembling incoming packets if the first fragment is     bigger than the m->m_dat[] buffer. An attacker could     use this flaw to crash the QEMU process on the host,     resulting in a Denial of Service or potentially     executing arbitrary code with privileges of the QEMU     process.(CVE-2019-14378)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure.(CVE-2020-10756)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the tcp_emu() routine while emulating     IRC and other protocols. An attacker could use this     flaw to crash the QEMU process on the host, resulting     in a denial of service or potential execution of     arbitrary code with privileges of the QEMU     process.(CVE-2020-7039)

  - An out-of-bound write access flaw was found in the way     QEMU loads ROM contents at boot time. This flaw occurs     in the rom_copy() routine while loading the contents of     a 32-bit -kernel image into memory. Running an     untrusted -kernel image may load contents at arbitrary     memory locations, potentially leading to code execution     with the privileges of the QEMU     process.(CVE-2020-13765)

  - A use-after-free flaw was found in the USB(xHCI/eHCI)     controller emulators of QEMU. This flaw occurs while     setting up the USB packet as a usb_packet_map() routine     and returns an error that was not checked. This flaw     allows a guest user or process to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-25084)

  - An infinite loop flaw was found in the USB OHCI     controller emulator of QEMU. This flaw occurs while     servicing OHCI isochronous transfer descriptors (TD) in     the ohci_service_iso_td routine, as it retires a TD if     it has passed its time frame. It does not check if the     TD was already processed and holds an error code in     TD_CC. This issue may happen if the TD list has a loop.
    This flaw allows a guest user or process to consume CPU     cycles on the host, resulting in a denial of     service.(CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - A potential directory traversal issue was found in the     tftp server of the SLiRP user-mode networking     implementation used by QEMU. It could occur on a     Windows host, as it allows the use of both forward     ('/') and backward slash('\') tokens as separators in a     file path. A user able to access the tftp server could     use this flaw to access undue files by using relative     paths.(CVE-2020-7211)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes several issues.

These security issues were fixed :

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042159).

  - CVE-2017-8379: Memory leak in the keyboard input event     handlers support allowed local guest OS privileged users     to cause a denial of service (host memory consumption)     by rapidly generating large keyboard events     (bsc#1037334).

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037242).

  - CVE-2017-7493: The VirtFS, host directory sharing via     Plan 9 File System(9pfs) support, was vulnerable to an     improper access control issue. It could occur while     accessing virtfs metadata files in mapped-file security     mode. A guest user could have used this flaw to escalate     their privileges inside guest (bsc#1039495).

  - CVE-2017-7377: The v9fs_create and v9fs_lcreate     functions in hw/9pfs/9p.c allowed local guest OS     privileged users to cause a denial of service (file     descriptor or memory consumption) via vectors related to     an already in-use fid (bsc#1032075).

  - CVE-2017-8086: A memory leak in the v9fs_list_xattr     function in hw/9pfs/9p-xattr.c allowed local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable (bsc#1035950).

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025109)

  - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks     function in hw/sd/sdhci.c allowed local OS guest     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors involving the     transfer mode register during multi block transfer     (bsc#1025311).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028184)

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028656)

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034908)

  - CVE-2017-7980: An out-of-bounds r/w access issues in the     Cirrus CLGD 54xx VGA Emulator support allowed privileged     user inside guest to use this flaw to crash the Qemu     process resulting in DoS or potentially execute     arbitrary code on a host with privileges of Qemu process     on the host (bsc#1035406)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036211).

  - CVE-2017-9375: The USB xHCI controller emulator support     was vulnerable to an infinite recursive call loop issue,     which allowed a privileged user inside guest to crash     the Qemu process resulting in DoS (bsc#1042800).

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043073).

  - CVE-2017-9373: The IDE AHCI Emulation support was     vulnerable to a host memory leakage issue, which allowed     a privileged user inside guest to leak host memory     resulting in DoS (bsc#1042801).

  - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to an out-of-bounds     read access issue which allowed a privileged user inside     guest to read host memory resulting in DoS     (bsc#1037336).

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427).

  - CVE-2017-7471: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper access control issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1034866).

  - Fix privilege escalation in TCG mode of QEMU. This is     not considered a security issue by the upstream project,     but is included as additional hardening (bsc#1030624)

  - Fix potential DoS in virtfs

  - CVE-2016-10028: The Virtio GPU Device emulator support     was vulnerable to an out of bounds memory access issue     allowing a guest user to crash the Qemu process instance     on a host, resulting in DoS (bsc#1017084, bsc#1016503)

  - CVE-2016-10029: The Virtio GPU Device emulator support     was vulnerable to an OOB read issue allowing a guest     user to crash the Qemu process instance resulting in Dos     (bsc#1017081, bsc#1016504)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021741)

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043296).

This non-security issue was fixed :

  - Enable MONITOR/MWAIT support for guests (bsc#1031142)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4585 advisory.

  - An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display     driver. This flaw could occur while refreshing the VNC display surface area in the     'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
    (CVE-2017-2633)

  - Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows     local guest OS users to execute arbitrary code on the host via crafted multiboot header address values,     which trigger an out-of-bounds write. (CVE-2017-14167)

  - The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to     cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst     calculation. (CVE-2017-15289)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
    (CVE-2018-5683)

  - QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS     privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors     involving display update. (CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c. (CVE-2017-15268)

  - Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest     OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating VGA display. (CVE-2018-7858)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS     users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than     mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. (CVE-2018-7550)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for threads other than the main thread. (CVE-2018-15746)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2018-17963)

  - Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is     used. (CVE-2018-17962)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data     type is used. (CVE-2018-17958)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu process resulting in DoS. (CVE-2018-10839)

  - qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in     QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count value) to the agent via the listening socket.
    (CVE-2018-12617)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing files on a shared host     directory. A privileged user inside guest could use this flaw to access host file system beyond the shared     folder and potentially escalating their privileges on a host. (CVE-2017-7471)

  - A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network     Block Device (NBD) client support. The flaw could occur while processing server's response to a     'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting     in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
    (CVE-2017-2630)

  - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
    (CVE-2017-10806)

  - The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by     leveraging use of qemu_map_ram_ptr to access guest ram block area. (CVE-2017-11334)

  - The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-     by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
    (CVE-2017-17381)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
    (CVE-2017-7493)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial     of service (infinite loop and CPU consumption) via the message ring page count. (CVE-2017-8112)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command processing. (CVE-2017-9503)

  - QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local     guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash)     by flushing an empty CDROM device drive. (CVE-2017-12809)

  - Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS users to obtain sensitive information from host heap memory via vectors related to reading     extended attributes. (CVE-2017-15038)

  - The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of     service issue. It could occur if a client sent large option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other     requests, resulting in DoS. (CVE-2017-15119)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-     of-bounds access. (CVE-2017-16845)

  - The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged     users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related     to negative pitch. (CVE-2017-18030)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash). (CVE-2017-18043)

  - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and stopping audio capture. (CVE-2017-8309)

  - Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large     keyboard events. (CVE-2017-8379)

  - Buffer overflow in the megasas_mmio_write function in Qemu 2.9.0 allows remote attackers to have     unspecified impact via unknown vectors. (CVE-2017-8380)

  - The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen     mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty     function. (CVE-2017-13673)

  - A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in     usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest     device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS     scenario OR possibly lead to code execution on the host. (CVE-2018-16867)

  - hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to     uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).
    (CVE-2018-20191)

  - A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and     usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying     filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical     TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this     property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU     process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
    (CVE-2018-16872)

  - hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe     ring element with a large num_sge value. (CVE-2018-20124)

  - QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and
    -1 is mishandled). (CVE-2018-20216)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference     or excessive memory allocation) in create_cq_ring or create_qp_rings. (CVE-2018-20125)

  - hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are     mishandled. (CVE-2018-20126)

  - In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid     msg_len value. (CVE-2018-18849)

  - An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could     occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU     process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.
    (CVE-2018-16847)

  - hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second     thread, leading to (for example) a use-after-free outcome. (CVE-2018-19364)

  - v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a     race condition during file renaming. (CVE-2018-19489)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4285 advisory.

  - An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display     driver. This flaw could occur while refreshing the VNC display surface area in the     'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
    (CVE-2017-2633)

  - Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows     local guest OS users to execute arbitrary code on the host via crafted multiboot header address values,     which trigger an out-of-bounds write. (CVE-2017-14167)

  - The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to     cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst     calculation. (CVE-2017-15289)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
    (CVE-2018-5683)

  - QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS     privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors     involving display update. (CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c. (CVE-2017-15268)

  - Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest     OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating VGA display. (CVE-2018-7858)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS     users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than     mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. (CVE-2018-7550)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for threads other than the main thread. (CVE-2018-15746)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2018-17963)

  - Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is     used. (CVE-2018-17962)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data     type is used. (CVE-2018-17958)

  - Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow,     which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user     inside guest could use this flaw to crash the Qemu process resulting in DoS. (CVE-2018-10839)

  - qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in     QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count value) to the agent via the listening socket.
    (CVE-2018-12617)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing files on a shared host     directory. A privileged user inside guest could use this flaw to access host file system beyond the shared     folder and potentially escalating their privileges on a host. (CVE-2017-7471)

  - A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network     Block Device (NBD) client support. The flaw could occur while processing server's response to a     'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting     in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
    (CVE-2017-2630)

  - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
    (CVE-2017-10806)

  - The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by     leveraging use of qemu_map_ram_ptr to access guest ram block area. (CVE-2017-11334)

  - The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-     by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
    (CVE-2017-17381)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
    (CVE-2017-7493)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial     of service (infinite loop and CPU consumption) via the message ring page count. (CVE-2017-8112)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command processing. (CVE-2017-9503)

  - QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local     guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash)     by flushing an empty CDROM device drive. (CVE-2017-12809)

  - Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS users to obtain sensitive information from host heap memory via vectors related to reading     extended attributes. (CVE-2017-15038)

  - The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of     service issue. It could occur if a client sent large option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other     requests, resulting in DoS. (CVE-2017-15119)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-     of-bounds access. (CVE-2017-16845)

  - The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged     users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related     to negative pitch. (CVE-2017-18030)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash). (CVE-2017-18043)

  - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and stopping audio capture. (CVE-2017-8309)

  - Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large     keyboard events. (CVE-2017-8379)

  - Buffer overflow in the megasas_mmio_write function in Qemu 2.9.0 allows remote attackers to have     unspecified impact via unknown vectors. (CVE-2017-8380)

  - The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen     mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty     function. (CVE-2017-13673)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- CVE-2017-7718: cirrus: OOB read access issue (bz     #1443443)

  - CVE-2016-9603: cirrus: heap buffer overflow via vnc     connection (bz #1432040)

  - CVE-2017-7377: 9pfs: fix file descriptor leak (bz     #1437872)

  - CVE-2017-7980: cirrus: OOB r/w access issues in bitblt     (bz #1444372)

  - CVE-2017-8112: vmw_pvscsi: infinite loop in pvscsi_log2     (bz #1445622)

  - CVE-2017-8309: audio: host memory lekage via capture     buffer (bz #1446520)

  - CVE-2017-8379: input: host memory lekage via keyboard     events (bz #1446560)

  - CVE-2017-8380: scsi: megasas: out-of-bounds read in     megasas_mmio_write (bz #1446578)

  - CVE-2017-9060: virtio-gpu: host memory leakage in Virtio     GPU device (bz #1452598)

  - CVE-2017-9310: net: infinite loop in e1000e NIC     emulation (bz #1452623)

  - CVE-2017-9330: usb: ohci: infinite loop due to incorrect     return value (bz #1457699)

  - CVE-2017-9374: usb: ehci host memory leakage during     hotunplug (bz #1459137)

  - CVE-2017-10806: usb-redirect: stack-based buffer     overflow in debug logging (bz #1468497)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges inside the guest. (CVE-2017-7493)

Li Qiang discovered that QEMU incorrectly handled VMware PVSCSI emulation. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources or crash, resulting in a denial of service. (CVE-2017-8112)

It was discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly to obtain sensitive host memory. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-8380)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service.
This issue only affected Ubuntu 17.04. (CVE-2017-9060)

Li Qiang discovered that QEMU incorrectly handled the e1000e device. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 17.04. (CVE-2017-9310)

Li Qiang discovered that QEMU incorrectly handled USB OHCI emulation support. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-9330)

Li Qiang discovered that QEMU incorrectly handled IDE AHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. (CVE-2017-9373)

Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. (CVE-2017-9374)

Li Qiang discovered that QEMU incorrectly handled USB xHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service.
(CVE-2017-9375)

Zhangyanyu discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-9503)

It was discovered that the QEMU qemu-nbd server incorrectly handled initialization. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2017-9524)

It was discovered that the QEMU qemu-nbd server incorrectly handled signals. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2017-10664)

Li Qiang discovered that the QEMU USB redirector incorrectly handled logging debug messages. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2017-10806)

Anthony Perard discovered that QEMU incorrectly handled Xen block-interface responses. An attacker inside the guest could use this issue to cause QEMU to leak contents of host memory. (CVE-2017-10911)

Reno Robert discovered that QEMU incorrectly handled certain DHCP options strings. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2017-11434)

Ryan Salsamendi discovered that QEMU incorrectly handled empty CDROM device drives. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.04.
(CVE-2017-12809).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-3414-1 fixed vulnerabilities in QEMU. The patch backport for CVE-2017-9375 was incomplete and caused a regression in the USB xHCI controller emulation support. This update fixes the problem.

We apologize for the inconvenience.

Leo Gaspard discovered that QEMU incorrectly handled VirtFS access control. A guest attacker could use this issue to elevate privileges inside the guest. (CVE-2017-7493)

Li Qiang discovered that QEMU incorrectly handled VMware PVSCSI emulation. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources or crash, resulting in a denial of service. (CVE-2017-8112)

It was discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly to obtain sensitive host memory. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-8380)

Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. This issue only affected Ubuntu 17.04. (CVE-2017-9060)

Li Qiang discovered that QEMU incorrectly handled the e1000e device. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. This issue only affected Ubuntu 17.04.
(CVE-2017-9310)

Li Qiang discovered that QEMU incorrectly handled USB OHCI emulation support. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-9330)

Li Qiang discovered that QEMU incorrectly handled IDE AHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. (CVE-2017-9373)

Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources and crash, resulting in a denial of service. (CVE-2017-9374)

Li Qiang discovered that QEMU incorrectly handled USB xHCI emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2017-9375)

Zhangyanyu discovered that QEMU incorrectly handled MegaRAID SAS 8708EM2 Host Bus Adapter emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-9503)

It was discovered that the QEMU qemu-nbd server incorrectly handled initialization. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service. (CVE-2017-9524)

It was discovered that the QEMU qemu-nbd server incorrectly handled signals. A remote attacker could use this issue to cause the server to crash, resulting in a denial of service.
(CVE-2017-10664)

Li Qiang discovered that the QEMU USB redirector incorrectly handled logging debug messages. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-10806)

Anthony Perard discovered that QEMU incorrectly handled Xen block-interface responses. An attacker inside the guest could use this issue to cause QEMU to leak contents of host memory. (CVE-2017-10911)

Reno Robert discovered that QEMU incorrectly handled certain DHCP options strings. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-11434)

Ryan Salsamendi discovered that QEMU incorrectly handled empty CDROM device drives. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.04. (CVE-2017-12809).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

  - An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display     driver. This flaw could occur while refreshing the VNC display surface area in the     'vnc_refresh_server_surface'. A user inside a guest could use this flaw to crash the QEMU process.
    (CVE-2017-2633)

  - Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows     local guest OS users to execute arbitrary code on the host via crafted multiboot header address values,     which trigger an out-of-bounds write. (CVE-2017-14167)

  - The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to     cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst     calculation. (CVE-2017-15289)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
    (CVE-2018-5683)

  - QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS     privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors     involving display update. (CVE-2017-13672)

  - Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear     ifq_so from pending packets. (CVE-2017-13711)

  - VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an     unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause DoS to the server host. (CVE-2017-15124)

  - Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read     operations, related to io/channel-websock.c. (CVE-2017-15268)

  - Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest     OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by     leveraging incorrect region calculation when updating VGA display. (CVE-2018-7858)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS     users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than     mh_bss_end_addr, which triggers an out-of-bounds read or write memory access. (CVE-2018-7550)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
    (CVE-2018-11806)

  - qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in     QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when     trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP     command (including guest-file-read with a large count value) to the agent via the listening socket.
    (CVE-2018-12617)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing files on a shared host     directory. A privileged user inside guest could use this flaw to access host file system beyond the shared     folder and potentially escalating their privileges on a host. (CVE-2017-7471)

  - A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network     Block Device (NBD) client support. The flaw could occur while processing server's response to a     'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting     in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
    (CVE-2017-2630)

  - Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
    (CVE-2017-10806)

  - The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by     leveraging use of qemu_map_ram_ptr to access guest ram block area. (CVE-2017-11334)

  - The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-     by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
    (CVE-2017-17381)

  - Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
    (CVE-2017-7493)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial     of service (infinite loop and CPU consumption) via the message ring page count. (CVE-2017-8112)

  - QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows     local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process     crash) via vectors involving megasas command processing. (CVE-2017-9503)

  - QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local     guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash)     by flushing an empty CDROM device drive. (CVE-2017-12809)

  - Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local     guest OS users to obtain sensitive information from host heap memory via vectors related to reading     extended attributes. (CVE-2017-15038)

  - The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of     service issue. It could occur if a client sent large option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other     requests, resulting in DoS. (CVE-2017-15119)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-     of-bounds access. (CVE-2017-16845)

  - The cirrus_invalidate_region function in hw/display/cirrus_vga.c in Qemu allows local OS guest privileged     users to cause a denial of service (out-of-bounds array access and QEMU process crash) via vectors related     to negative pitch. (CVE-2017-18030)

  - Integer overflow in the macro ROUND_UP (n, d) in Quick Emulator (Qemu) allows a user to cause a denial of     service (Qemu process crash). (CVE-2017-18043)

  - Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and stopping audio capture. (CVE-2017-8309)

  - Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large     keyboard events. (CVE-2017-8379)

  - Buffer overflow in the megasas_mmio_write function in Qemu 2.9.0 allows remote attackers to have     unspecified impact via unknown vectors. (CVE-2017-8380)

  - The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen     mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty     function. (CVE-2017-13673)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Memory leak in hw/audio/es1370.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5526)

  - Memory leak in hw/audio/ac97.c in QEMU (aka Quick     Emulator) allows local guest OS privileged users to     cause a denial of service (host memory consumption and     QEMU process crash) via a large number of device unplug     operations.(CVE-2017-5525)

  - The xhci_kick_epctx function in hw/usb/hcd-xhci.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors related to     control transfer descriptor sequence.(CVE-2017-5973)

  - The sdhci_sdma_transfer_multi_blocks function in     hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local     OS guest privileged users to cause a denial of service     (infinite loop and QEMU process crash) via vectors     involving the transfer mode register during multi block     transfer.(CVE-2017-5987)

  - Memory leak in the megasas_handle_dcmd function in     hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption) via MegaRAID Firmware     Interface (MFI) commands with the sglist size set to a     value over 2 Gb.(CVE-2017-5856)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - Quick Emulator (Qemu) built with the VirtFS, host     directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It     could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this     flaw to escalate their privileges inside     guest.(CVE-2017-7493)

  - In QEMU 3.1.0, load_device_tree in device_tree.c calls     the deprecated load_image function, which has a buffer     overflow risk.(CVE-2018-20815)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator)     allows local guest OS privileged users to cause a     denial of service (infinite loop and CPU consumption)     via the message ring page count.(CVE-2017-8112)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - TSX Asynchronous Abort condition on some CPUs utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6,     1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1,     1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12     (fixed), when executing script in lsi_execute_script(),     the LSI scsi adapter emulator advances 's->dsp' index     to read next opcode. This can lead to an infinite loop     if the next opcode is empty. Move the existing loop     exit after 10k iterations so that it covers no-op     opcodes as well.(CVE-2019-12068)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - Qemu has a Buffer Overflow in pcnet_receive in     hw/net/pcnet.c because an incorrect integer data type     is used.(CVE-2018-17962)

  - Quick Emulator(Qemu) built with the VMWARE PVSCSI     paravirtual SCSI bus emulation support is vulnerable to     an OOB r/w access issue. It could occur while     processing SCSI commands 'PVSCSI_CMD_SETUP_RINGS' or     'PVSCSI_CMD_SETUP_MSG_RING'. A privileged user inside     guest could use this flaw to crash the Qemu process     resulting in DoS.(CVE-2016-4952)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer     overflow via incoming fragmented     datagrams.(CVE-2018-11806)

  - In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c     allows out-of-bounds access by triggering an invalid     msg_len value.(CVE-2018-18849)

  - hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an     fid path while it is being accessed by a second thread,     leading to (for example) a use-after-free     outcome.(CVE-2018-19364)

  - v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS     users to cause a denial of service (crash) because of a     race condition during file renaming.(CVE-2018-19489)

  - QEMU, through version 2.10 and through version 3.1.0,     is vulnerable to an out-of-bounds read of up to 128     bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A     local attacker with permission to execute i2c commands     could exploit this to read stack memory of the qemu     process on the host.(CVE-2019-3812)

  - A flaw was found in QEMU's Media Transfer Protocol     (MTP). The code opening files in usb_mtp_get_object and     usb_mtp_get_partial_object and directories in     usb_mtp_object_readdir doesn't consider that the     underlying filesystem may have changed since the time     lstat(2) was called in usb_mtp_object_alloc, a     classical TOCTTOU problem. An attacker with write     access to the host filesystem, shared with a guest, can     use this property to navigate the host filesystem in     the context of the QEMU process and read any file the     QEMU process has access to. Access to the filesystem     may be local or via a network share protocol such as     CIFS.(CVE-2018-16872)

  - ** DISPUTED ** An issue was discovered in ide_dma_cb()     in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - Quick Emulator (QEMU) built with Network Block Device     (NBD) Server support was vulnerable to a null-pointer     dereference issue. The flaw could occur when releasing     a client that was not initialized due to failed     negotiation. A remote user or process could exploit     this flaw to crash the qemu-nbd server (denial of     service).(CVE-2017-9524)

  - Qemu has integer overflows because IOReadHandler and     its associated functions use a signed integer data type     for a size value.(CVE-2018-18438)

  - The Bluetooth subsystem in QEMU mishandles negative     values for length variables, leading to memory     corruption.(CVE-2018-19665)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Quick Emulator (Qemu) built with the VirtFS, host     directory sharing via Plan 9 File System(9pfs) support,     is vulnerable to an improper access control issue. It     could occur while accessing virtfs metadata files in     mapped-file security mode. A guest user could use this     flaw to escalate their privileges inside     guest.(CVE-2017-7493)

  - qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that     a network interface name (obtained from bridge.conf or     a --br=bridge option) is limited to the IFNAMSIZ size,     which can lead to an ACL bypass.(CVE-2019-13164)

  - Qemu has a Buffer Overflow in pcnet_receive in     hw/net/pcnet.c because an incorrect integer data type     is used.(CVE-2018-17962)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - qemu_deliver_packet_iov in net/net.c in Qemu accepts     packet sizes greater than INT_MAX, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-17963)

  - In QEMU 3.1.0, load_device_tree in device_tree.c calls     the deprecated load_image function, which has a buffer     overflow risk.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     4.0.0 has a NULL pointer dereference.(CVE-2019-12155)

  - An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)

  - Use-after-free vulnerability in the sofree function in     slirp/socket.c in QEMU (aka Quick Emulator) allows     attackers to cause a denial of service (QEMU instance     crash) by leveraging failure to properly clear ifq_so     from pending packets.(CVE-2017-13711)

  - Qemu has a Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)

  - ip_reass in ip_input.c in libslirp 4.0.0 has a     heap-based buffer overflow via a large packet because     it mishandles a case involving the first     fragment.(CVE-2019-14378)

  - m_cat in slirp/mbuf.c in Qemu has a heap-based buffer     overflow via incoming fragmented     datagrams.(CVE-2018-11806)

  - Memory leak in the audio/audio.c in QEMU (aka Quick     Emulator) allows remote attackers to cause a denial of     service (memory consumption) by repeatedly starting and     stopping audio capture.(CVE-2017-8309)

  - Memory leak in the keyboard input event handlers     support in QEMU (aka Quick Emulator) allows local guest     OS privileged users to cause a denial of service (host     memory consumption) by rapidly generating large     keyboard events.(CVE-2017-8379)

  - hw/input/ps2.c in Qemu does not validate 'rptr' and     'count' values during guest migration, leading to     out-of-bounds access(CVE-2017-16845)

  - The cirrus_invalidate_region function in     hw/display/cirrus_vga.c in Qemu allows local OS guest     privileged users to cause a denial of service     (out-of-bounds array access and QEMU process crash) via     vectors related to negative pitch.(CVE-2017-18030)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201706-03 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker might cause a Denial of Service or gain escalated       privileges from a guest VM.
  Workaround :

    There is no known workaround at this time.

This update for qemu fixes several issues. These security issues were fixed :

  - CVE-2017-9330: USB OHCI Emulation in qemu allowed local     guest OS users to cause a denial of service (infinite     loop) by leveraging an incorrect return value     (bsc#1042159).

  - CVE-2017-8379: Memory leak in the keyboard input event     handlers support allowed local guest OS privileged users     to cause a denial of service (host memory consumption)     by rapidly generating large keyboard events     (bsc#1037334).

  - CVE-2017-8309: Memory leak in the audio/audio.c allowed     remote attackers to cause a denial of service (memory     consumption) by repeatedly starting and stopping audio     capture (bsc#1037242).

  - CVE-2017-7493: The VirtFS, host directory sharing via     Plan 9 File System(9pfs) support, was vulnerable to an     improper access control issue. It could occur while     accessing virtfs metadata files in mapped-file security     mode. A guest user could have used this flaw to escalate     their privileges inside guest (bsc#1039495).

  - CVE-2017-7377: The v9fs_create and v9fs_lcreate     functions in hw/9pfs/9p.c allowed local guest OS     privileged users to cause a denial of service (file     descriptor or memory consumption) via vectors related to     an already in-use fid (bsc#1032075).

  - CVE-2017-8086: A memory leak in the v9fs_list_xattr     function in hw/9pfs/9p-xattr.c allowed local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable (bsc#1035950).

  - CVE-2017-5973: A infinite loop while doing control     transfer in xhci_kick_epctx allowed privileged user     inside the guest to crash the host process resulting in     DoS (bsc#1025109)

  - CVE-2017-5987: The sdhci_sdma_transfer_multi_blocks     function in hw/sd/sdhci.c allowed local OS guest     privileged users to cause a denial of service (infinite     loop and QEMU process crash) via vectors involving the     transfer mode register during multi block transfer     (bsc#1025311).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028184)

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028656)

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034908)

  - CVE-2017-7980: An out-of-bounds r/w access issues in the     Cirrus CLGD 54xx VGA Emulator support allowed privileged     user inside guest to use this flaw to crash the Qemu     process resulting in DoS or potentially execute     arbitrary code on a host with privileges of Qemu process     on the host (bsc#1035406)

  - CVE-2017-8112: hw/scsi/vmw_pvscsi.c allowed local guest     OS privileged users to cause a denial of service     (infinite loop and CPU consumption) via the message ring     page count (bsc#1036211).

  - CVE-2017-9375: The USB xHCI controller emulator support     was vulnerable to an infinite recursive call loop issue,     which allowed a privileged user inside guest to crash     the Qemu process resulting in DoS (bsc#1042800).

  - CVE-2017-9374: Missing free of 's->ipacket', causes a     host memory leak, allowing for DoS (bsc#1043073).

  - CVE-2017-9373: The IDE AHCI Emulation support was     vulnerable to a host memory leakage issue, which allowed     a privileged user inside guest to leak host memory     resulting in DoS (bsc#1042801).

  - CVE-2017-8380: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to an out-of-bounds     read access issue which allowed a privileged user inside     guest to read host memory resulting in DoS     (bsc#1037336).

  - CVE-2016-9602: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper link following issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1020427).

  - CVE-2017-7471: The VirtFS host directory sharing via     Plan 9 File System(9pfs) support was vulnerable to an     improper access control issue which allowed a privileged     user inside guest to access host file system beyond the     shared folder and potentially escalating their     privileges on a host (bsc#1034866).

  - Fix privilege escalation in TCG mode of QEMU. This is     not considered a security issue by the upstream project,     but is included as additional hardening (bsc#1030624)

  - Fix potential DoS in virtfs

  - CVE-2016-10028: The Virtio GPU Device emulator support     was vulnerable to an out of bounds memory access issue     allowing a guest user to crash the Qemu process instance     on a host, resulting in DoS (bsc#1017084, bsc#1016503)

  - CVE-2016-10029: The Virtio GPU Device emulator support     was vulnerable to an OOB read issue allowing a guest     user to crash the Qemu process instance resulting in Dos     (bsc#1017081, bsc#1016504)

  - CVE-2017-5579: The 16550A UART serial device emulation     support was vulnerable to a memory leakage issue     allowing a privileged user to cause a DoS and/or     potentially crash the Qemu process on the host     (bsc#1021741)

  - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support was vulnerable to a NULL pointer     dereference issue which allowed a privileged user inside     guest to crash the Qemu process on the host resulting in     DoS (bsc#1043296).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
104471	SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2946-1)	Nessus	SuSE Local Security Checks	11/9/2017	1/6/2021	critical
151383	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2021-2166)	Nessus	Huawei Local Security Checks	7/6/2021	12/11/2023	critical
101758	openSUSE Security Update : qemu (openSUSE-2017-822)	Nessus	SuSE Local Security Checks	7/17/2017	1/19/2021	critical
180740	Oracle Linux 7 : qemu (ELSA-2019-4585)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/8/2023	critical
180778	Oracle Linux 7 : qemu (ELSA-2018-4285)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/8/2023	critical
102008	Fedora 25 : 2:qemu (2017-f941184db1)	Nessus	Fedora Local Security Checks	7/27/2017	1/6/2021	critical
103217	Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3414-1)	Nessus	Ubuntu Local Security Checks	9/14/2017	10/20/2023	critical
103372	Ubuntu 14.04 LTS / 16.04 LTS : QEMU regression (USN-3414-2)	Nessus	Ubuntu Local Security Checks	9/21/2017	10/20/2023	critical
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/8/2023	critical
138009	EulerOS Virtualization 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1790)	Nessus	Huawei Local Security Checks	7/1/2020	3/5/2024	critical
144829	EulerOS Virtualization 3.0.2.6 : qemu (EulerOS-SA-2021-1057)	Nessus	Huawei Local Security Checks	1/11/2021	5/11/2022	critical
100630	GLSA-201706-03 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	6/6/2017	1/11/2021	critical
101227	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:1774-1)	Nessus	SuSE Local Security Checks	7/5/2017	1/6/2021	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical