Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. It could occur while hotplug and unplugging the device in the guest. A guest user/process could use this flaw to crash a Qemu process on the host resulting in DoS.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure     to define the .write method. (CVE-2015-7549)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD)     list. (CVE-2015-8558)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201701-49 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    A privileged user/process within a guest QEMU environment can cause a       Denial of Service condition against the QEMU guest process or the host.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
198727	RHEL 7 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198718	RHEL 6 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
96684	GLSA-201701-49 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2016-9923

medium

Tenable Plugins

critical

critical

medium