QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance resulting in DoS.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Qemu: ps2: information leakage via post_load routine (CVE-2017-16845)

  - QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer     dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block     (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance     resulting in DoS. (CVE-2016-2197)

  - The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via     vectors involving s->state. (CVE-2016-4964)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Qemu: i386: leakage of stack memory to guest in kvmvapic.c (CVE-2016-4020)

  - QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer     dereference flaw. It occurs while unmapping the Frame Information Structure (FIS) and Command List Block     (CLB) entries. A privileged user inside guest could use this flaw to crash the QEMU process instance     resulting in DoS. (CVE-2016-2197)

  - qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a     denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
    (CVE-2017-10664)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

qemu was updated to fix 29 security issues.

These security issues were fixed :

  - CVE-2016-4439: Avoid OOB access in 53C9X emulation     (bsc#980711)

  - CVE-2016-4441: Avoid OOB access in 53C9X emulation     (bsc#980723)

  - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI     emulation (bsc#981266)

  - CVE-2015-8817: Avoid OOB access in PCI dma I/O     (bsc#969121)

  - CVE-2015-8818: Avoid OOB access in PCI dma I/O     (bsc#969122)

  - CVE-2016-3710: Fixed VGA emulation based OOB access with     potential for guest escape (bsc#978158)

  - CVE-2016-3712: Fixed VGa emulation based DOS and OOB     read access exploit (bsc#978160)

  - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)

  - CVE-2016-2538: Fixed potential OOB access in USB net     device emulation (bsc#967969)

  - CVE-2016-2841: Fixed OOB access / hang in ne2000     emulation (bsc#969350)

  - CVE-2016-2858: Avoid potential DOS when using QEMU     pseudo random number generator (bsc#970036)

  - CVE-2016-2857: Fixed OOB access when processing IP     checksums (bsc#970037)

  - CVE-2016-4001: Fixed OOB access in Stellaris enet     emulated nic (bsc#975128)

  - CVE-2016-4002: Fixed OOB access in MIPSnet emulated     controller (bsc#975136)

  - CVE-2016-4020: Fixed possible host data leakage to guest     from TPR access (bsc#975700)

  - CVE-2016-2197: Prevent AHCI NULL pointer dereference     when using FIS CLB engine (bsc#964411)

  - CVE-2015-5745: Buffer overflow in virtio-serial     (bsc#940929).

  - CVE-2015-7549: PCI NULL pointer dereferences     (bsc#958917).

  - CVE-2015-8504: VNC floating point exception     (bsc#958491).

  - CVE-2015-8558: Infinite loop in ehci_advance_state     resulting in DoS (bsc#959005).

  - CVE-2015-8567: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8568: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8613: Wrong sized memset in megasas command     handler (bsc#961358).

  - CVE-2015-8619: Potential DoS for long HMP sendkey     command argument (bsc#960334).

  - CVE-2015-8743: OOB memory access in ne2000 ioport r/w     functions (bsc#960725).

  - CVE-2015-8744: Incorrect l2 header validation could have     lead to a crash via assert(2) call (bsc#960835).

  - CVE-2015-8745: Reading IMR registers could have lead to     a crash via assert(2) call (bsc#960708).

  - CVE-2016-1568: AHCI use-after-free in aio port commands     (bsc#961332).

  - CVE-2016-1714: Potential OOB memory access in processing     firmware configuration (bsc#961691).

  - CVE-2016-1922: NULL pointer dereference when processing     hmp i/o command (bsc#962320).

  - CVE-2016-1981: Potential DoS (infinite loop) in e1000     device emulation by malicious privileged user within     guest (bsc#963782).

  - CVE-2016-2198: Malicious privileged guest user were able     to cause DoS by writing to read-only EHCI capabilities     registers (bsc#964413).

This non-security issue was fixed

  - bsc#886378: qemu truncates vhd images in virt-rescue

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

qemu was updated to fix 29 security issues.

These security issues were fixed :

  - CVE-2016-4439: Avoid OOB access in 53C9X emulation     (bsc#980711)

  - CVE-2016-4441: Avoid OOB access in 53C9X emulation     (bsc#980723)

  - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI     emulation (bsc#981266)

  - CVE-2015-8817: Avoid OOB access in PCI dma I/O     (bsc#969121)

  - CVE-2015-8818: Avoid OOB access in PCI dma I/O     (bsc#969122)

  - CVE-2016-3710: Fixed VGA emulation based OOB access with     potential for guest escape (bsc#978158)

  - CVE-2016-3712: Fixed VGa emulation based DOS and OOB     read access exploit (bsc#978160)

  - CVE-2016-4037: Fixed USB ehci based DOS (bsc#976109)

  - CVE-2016-2538: Fixed potential OOB access in USB net     device emulation (bsc#967969)

  - CVE-2016-2841: Fixed OOB access / hang in ne2000     emulation (bsc#969350)

  - CVE-2016-2858: Avoid potential DOS when using QEMU     pseudo random number generator (bsc#970036)

  - CVE-2016-2857: Fixed OOB access when processing IP     checksums (bsc#970037)

  - CVE-2016-4001: Fixed OOB access in Stellaris enet     emulated nic (bsc#975128)

  - CVE-2016-4002: Fixed OOB access in MIPSnet emulated     controller (bsc#975136)

  - CVE-2016-4020: Fixed possible host data leakage to guest     from TPR access (bsc#975700)

  - CVE-2016-2197: Prevent AHCI NULL pointer dereference     when using FIS CLB engine (bsc#964411)

  - CVE-2015-5745: Buffer overflow in virtio-serial     (bsc#940929).

  - CVE-2015-7549: PCI NULL pointer dereferences     (bsc#958917).

  - CVE-2015-8504: VNC floating point exception     (bsc#958491).

  - CVE-2015-8558: Infinite loop in ehci_advance_state     resulting in DoS (bsc#959005).

  - CVE-2015-8567: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8568: A guest repeatedly activating a vmxnet3     device can leak host memory (bsc#959386).

  - CVE-2015-8613: Wrong sized memset in megasas command     handler (bsc#961358).

  - CVE-2015-8619: Potential DoS for long HMP sendkey     command argument (bsc#960334).

  - CVE-2015-8743: OOB memory access in ne2000 ioport r/w     functions (bsc#960725).

  - CVE-2015-8744: Incorrect l2 header validation could have     lead to a crash via assert(2) call (bsc#960835).

  - CVE-2015-8745: Reading IMR registers could have lead to     a crash via assert(2) call (bsc#960708).

  - CVE-2016-1568: AHCI use-after-free in aio port commands     (bsc#961332).

  - CVE-2016-1714: Potential OOB memory access in processing     firmware configuration (bsc#961691).

  - CVE-2016-1922: NULL pointer dereference when processing     hmp i/o command (bsc#962320).

  - CVE-2016-1981: Potential DoS (infinite loop) in e1000     device emulation by malicious privileged user within     guest (bsc#963782).

  - CVE-2016-2198: Malicious privileged guest user were able     to cause DoS by writing to read-only EHCI capabilities     registers (bsc#964413).

This non-security issue was fixed

  - bsc#886378: qemu truncates vhd images in virt-rescue

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote host is affected by the vulnerability described in GLSA-201604-01 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    Local users within a guest QEMU environment can execute arbitrary code       within the host or a cause a Denial of Service condition of the QEMU       guest process.
  Workaround :

    There is no known workaround at this time.

- CVE-2015-8619: Fix sendkey out of bounds (bz #1292757) *     CVE-2016-1981: infinite loop in e1000 (bz #1299995) *     Fix Out-of-bounds read in usb-ehci (bz #1300234, bz     #1299455) * CVE-2016-2197: ahci: NULL pointer     dereference (bz #1302952) * Fix gdbstub for VSX     registers for ppc64 (bz #1304377) * Fix qemu-img vmdk     images to work with VMware (bz #1299185)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2891-1 advisory.

    Qinghao Tang discovered that QEMU incorrectly handled PCI MSI-X support. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-7549)

    Lian Yihan discovered that QEMU incorrectly handled the VNC server. A remote attacker could use this issue     to cause QEMU to crash, resulting in a denial of service. (CVE-2015-8504)

    Felix Wilhelm discovered a race condition in the Xen paravirtualized drivers which can cause double fetch     vulnerabilities. An attacker in the paravirtualized guest could exploit this flaw to cause a denial of     service (crash the host) or potentially execute arbitrary code on the host. (CVE-2015-8550)

    Qinghao Tang discovered that QEMU incorrectly handled USB EHCI emulation support. An attacker inside the     guest could use this issue to cause QEMU to consume resources, resulting in a denial of service.
    (CVE-2015-8558)

    Qinghao Tang discovered that QEMU incorrectly handled the vmxnet3 device. An attacker inside the guest     could use this issue to cause QEMU to consume resources, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8567, CVE-2015-8568)

    Qinghao Tang discovered that QEMU incorrectly handled SCSI MegaRAID SAS HBA emulation. An attacker inside     the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8613)

    Ling Liu discovered that QEMU incorrectly handled the Human Monitor Interface. A local attacker could use     this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04     LTS and Ubuntu 15.10. (CVE-2015-8619, CVE-2016-1922)

    David Alan Gilbert discovered that QEMU incorrectly handled the Q35 chipset emulation when performing VM     guest migrations. An attacker could use this issue to cause QEMU to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2015-8666)

    Ling Liu discovered that QEMU incorrectly handled the NE2000 device. An attacker inside the guest could     use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2015-8743)

    It was discovered that QEMU incorrectly handled the vmxnet3 device. An attacker inside the guest could use     this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04     LTS and Ubuntu 15.10. (CVE-2015-8744, CVE-2015-8745)

    Qinghao Tang discovered that QEMU incorrect handled IDE AHCI emulation. An attacker inside the guest could     use this issue to cause a denial of service, or possibly execute arbitrary code on the host as the user     running the QEMU process. In the default installation, when QEMU is used with libvirt, attackers would be     isolated by the libvirt AppArmor profile. (CVE-2016-1568)

    Donghai Zhu discovered that QEMU incorrect handled the firmware configuration device. An attacker inside     the guest could use this issue to cause a denial of service, or possibly execute arbitrary code on the     host as the user running the QEMU process. In the default installation, when QEMU is used with libvirt,     attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-1714)

    It was discovered that QEMU incorrectly handled the e1000 device. An attacker inside the guest could use     this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-1981)

    Zuozhi Fzz discovered that QEMU incorrectly handled IDE AHCI emulation. An attacker inside the guest could     use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu     15.10. (CVE-2016-2197)

    Zuozhi Fzz discovered that QEMU incorrectly handled USB EHCI emulation. An attacker inside the guest could     use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu     14.04 LTS and Ubuntu 15.10. (CVE-2016-2198)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198555	RHEL 7 : qemu-kvm-rhev (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198548	RHEL 6 : qemu-kvm-rhev (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
93170	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)	Nessus	SuSE Local Security Checks	critical
91980	openSUSE Security Update : qemu (openSUSE-2016-839)	Nessus	SuSE Local Security Checks	critical
90339	GLSA-201604-01 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
89605	Fedora 22 : qemu-2.3.1-12.fc22 (2016-be042f7e6f)	Nessus	Fedora Local Security Checks	high
89599	Fedora 23 : qemu-2.4.1-7.fc23 (2016-b49aaf2c56)	Nessus	Fedora Local Security Checks	high
88576	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2891-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-2197

medium

Tenable Plugins

critical

medium

critical

critical

high

high

high

high