The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: msix: OOB access during mmio operations may lead to DoS (CVE-2020-13754)

  - The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-     by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
    (CVE-2017-17381)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host     controller driver. (CVE-2020-25624)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4289 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4285 advisory.

    - net: ignore packet size greater than INT_MAX (Jason Wang)  [Orabug: 28763782]  {CVE-2018-17963}
    - pcnet: fix possible buffer overflow (Jason Wang)  [Orabug: 28763774]  {CVE-2018-17962}
    - rtl8139: fix possible out of bound access (Jason Wang)  [Orabug: 28763765]  {CVE-2018-17958}
    - ne2000: fix possible out of bound access in ne2000_receive (Jason Wang)  [Orabug: 28763758]     {CVE-2018-10839}
    - seccomp: set the seccomp filter to all threads (Marc-Andre Lureau)  [Orabug: 28763748]  {CVE-2018-15746}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 28763710]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-3639} {CVE-2018-5683}     {CVE-2018-7550} {CVE-2018-7858}
    - multiboot.c: Document as fixed against CVE-2018-7550 (Jack Schwartz)  [Orabug: 27832332]     {CVE-2018-7550}
    - CVE-2017-18030: cirrus_invalidate_region() lets priv guest user cause DoS (Mark Kanda)  [Orabug:
    27832319]  {CVE-2017-18030}
    - vga: fix region calculation (Gerd Hoffmann)  [Orabug: 27832309]  {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4585 advisory.

    - usb-mtp: use O_NOFOLLOW and O_CLOEXEC. (Gerd Hoffmann)  [Orabug: 29216656]  {CVE-2018-16872}
    - pvrdma: add uar_read routine (Prasad J Pandit)  [Orabug: 29216658]  {CVE-2018-20191}
    - pvrdma: release ring object in case of an error (Prasad J Pandit)  [Orabug: 29216659]  {CVE-2018-20126}
    - pvrdma: check number of pages when creating rings (Prasad J Pandit)  [Orabug: 29216666]     {CVE-2018-20125}
    - pvrdma: check return value from pvrdma_idx_ring_has_ routines (Prasad J Pandit)  [Orabug: 29216672]     {CVE-2018-20216}
    - rdma: remove unused VENDOR_ERR_NO_SGE macro (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
    - rdma: check num_sge does not exceed MAX_SGE (Prasad J Pandit)  [Orabug: 29216678]  {CVE-2018-20124}
    - Document various CVEs as fixed (Mark Kanda)  [Orabug: 29212424]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-18043} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753}     {CVE-2017-5754} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309} {CVE-2017-8379}     {CVE-2017-8380} {CVE-2017-9503} {CVE-2018-10839} {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746}     {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958} {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849}     {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639} {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - qemu-kvm is an open source virtualizer that provides     hardware emulation for the KVM hypervisor. qemu-kvm     acts as a virtual machine monitor together with the KVM     kernel modules, and emulates the hardware for a full     system such as a PC and its assocated peripherals. As     qemu-kvm requires no host kernel patches to run, it is     safe and easy to use. Security Fix(es):The     ohci_service_ed_list function in hw/usb/hcd-ohci.c in     QEMU (aka Quick Emulator) before 2.9.0 allows local     guest OS users to cause a denial of service (infinite     loop) via vectors involving the number of link endpoint     list descriptors, a different vulnerability than     CVE-2017-9330.(CVE-2017-6505)** DISPUTED ** QEMU 3.0.0     has an Integer Overflow because the qga/commands*.c     files do not check the length of the argument list or     the number of environment variables. NOTE: This has     been disputed as not exploitable.(CVE-2019-12247)**     DISPUTED ** An issue was discovered in ide_dma_cb() in     hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest     system can crash the QEMU process in the host system     via a special SCSI_IOCTL_SEND_COMMAND. It hits an     assertion that implies that the size of successful DMA     transfers there must be a multiple of 512 (the size of     a sector). NOTE: a member of the QEMU security team     disputes the significance of this issue because a     'privileged guest user has many ways to cause similar     DoS effect, without triggering this     assert.'(CVE-2019-20175)Race condition in the     v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka     Quick Emulator) allows local guest OS users to obtain     sensitive information from host heap memory via vectors     related to reading extended     attributes.(cve-2017-15038)Memory leak in the     megasas_handle_dcmd function in hw/scsi/megasas.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (host     memory consumption) via MegaRAID Firmware Interface     (MFI) commands with the sglist size set to a value over     2 Gb.(cve-2017-5856)QEMU (aka Quick Emulator), when     built with the e1000e NIC emulation support, allows     local guest OS privileged users to cause a denial of     service (infinite loop) via vectors related to setting     the initial receive / transmit descriptor head     (TDH/RDH) outside the allocated descriptor     buffer.(cve-2017-9310)QEMU (aka Quick Emulator), when     built with MegaRAID SAS 8708EM2 Host Bus Adapter     emulation support, allows local guest OS privileged     users to cause a denial of service (NULL pointer     dereference and QEMU process crash) via vectors     involving megasas command processing.(cve-2017-9503)The     dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)Memory leak in the     v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU     (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (memory consumption)     via vectors involving the orig_value     variable.(CVE-2017-8086)m_cat in slirp/mbuf.c in Qemu     has a heap-based buffer overflow via incoming     fragmented datagrams.(CVE-2018-11806)In QEMU 3.1.0,     load_device_tree in device_tree.c calls the deprecated     load_image function, which has a buffer overflow     risk.(CVE-2018-20815)The pnv_lpc_do_eccb function in     hw/ppc/pnv_lpc.c in Qemu before 3.1 allows     out-of-bounds write or read access to PowerNV     memory.(cve-2018-18954)qemu_deliver_packet_iov in     net/net.c in Qemu accepts packet sizes greater than     INT_MAX, which allows attackers to cause a denial of     service or possibly have unspecified other     impact.(CVE-2018-17963)Qemu has a Buffer Overflow in     pcnet_receive in hw/net/pcnet.c because an incorrect     integer data type is used.(CVE-2018-17962)Qemu has a     Buffer Overflow in rtl8139_do_receive in     hw/net/rtl8139.c because an incorrect integer data type     is used.(CVE-2018-17958)qemu-seccomp.c in QEMU might     allow local OS guest users to cause a denial of service     (guest crash) by leveraging mishandling of the seccomp     policy for threads other than the main     thread.(CVE-2018-15746)In QEMU 1:4.1-1,     1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8,     1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and     1:2.1+dfsg-12+deb8u12 (fixed), when executing script in     lsi_execute_script(), the LSI scsi adapter emulator     advances 's->dsp' index to read next opcode. This can     lead to an infinite loop if the next opcode is empty.
    Move the existing loop exit after 10k iterations so     that it covers no-op opcodes as     well.(CVE-2019-12068)qemu-bridge-helper.c in QEMU 4.0.0     does not ensure that a network interface name (obtained     from bridge.conf or a --br=bridge option) is limited to     the IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)tcp_emu in slirp/tcp_subr.c (aka     slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized     data in an snprintf call, leading to Information     disclosure.(CVE-2019-9824)interface_release_resource in     hw/display/qxl.c in QEMU 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)The Virtio Vring     implementation in QEMU allows local OS guest users to     cause a denial of service (divide-by-zero error and     QEMU process crash) by unsetting vring alignment while     updating Virtio     rings.(CVE-2017-17381)hw/display/cirrus_vga_rop.h in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and     cirrus_bitblt_rop_fwd_ functions.(CVE-2017-7718)Memory     leak in the serial_exit_core function in     hw/char/serial.c in QEMU (aka Quick Emulator) allows     local guest OS privileged users to cause a denial of     service (host memory consumption and QEMU process     crash) via a large number of device unplug     operations.(CVE-2017-5579)Quick Emulator (aka QEMU),     when built with the Cirrus CLGD 54xx VGA Emulator     support, allows local guest OS privileged users to     cause a denial of service (out-of-bounds access and     QEMU process crash) by leveraging incorrect region     calculation when updating VGA     display.(CVE-2018-7858)qemu-nbd in QEMU (aka Quick     Emulator) does not ignore SIGPIPE, which allows remote     attackers to cause a denial of service (daemon crash)     by disconnecting during a server-to-client reply     attempt.(CVE-2017-10664)QEMU (aka Quick Emulator), when     built with the VGA display emulator support, allows     local guest OS privileged users to cause a denial of     service (out-of-bounds read and QEMU process crash) via     vectors involving display update.(CVE-2017-13672)QEMU     (aka Quick Emulator), when built with the IDE disk and     CD/DVD-ROM Emulator support, allows local guest OS     privileged users to cause a denial of service (NULL     pointer dereference and QEMU process crash) by flushing     an empty CDROM device drive.(CVE-2017-12809)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - qemu-kvm is an open source virtualizer that provides     hardware emulation for the KVM hypervisor. qemu-kvm     acts as a virtual machine monitor together with the KVM     kernel modules, and emulates the hardware for a full     system such as a PC and its assocated peripherals. As     qemu-kvm requires no host kernel patches to run, it is     safe and easy to use.Security Fix(es):Memory leak in     the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in     QEMU (aka Quick Emulator) allows local guest OS     privileged users to cause a denial of service (memory     consumption) via vectors involving the orig_value     variable.(CVE-2017-8086)The dhcp_decode function in     slirp/bootp.c in QEMU (aka Quick Emulator) allows local     guest OS users to cause a denial of service     (out-of-bounds read and QEMU process crash) via a     crafted DHCP options string.(CVE-2017-11434)** DISPUTED
    ** QEMU 3.0.0 has an Integer Overflow because the     qga/commands*.c files do not check the length of the     argument list or the number of environment variables.
    NOTE: This has been disputed as not     exploitable.(CVE-2019-12247)** DISPUTED ** An issue was     discovered in ide_dma_cb() in hw/ide/core.c in QEMU     2.4.0 through 4.2.0. The guest system can crash the     QEMU process in the host system via a special     SCSI_IOCTL_SEND_COMMAND. It hits an assertion that     implies that the size of successful DMA transfers there     must be a multiple of 512 (the size of a sector). NOTE:
    a member of the QEMU security team disputes the     significance of this issue because a 'privileged guest     user has many ways to cause similar DoS effect, without     triggering this assert.'(CVE-2019-20175)QEMU (aka Quick     Emulator), when built with the IDE disk and CD/DVD-ROM     Emulator support, allows local guest OS privileged     users to cause a denial of service (NULL pointer     dereference and QEMU process crash) by flushing an     empty CDROM device drive. (CVE-2017-12809)The Virtio     Vring implementation in QEMU allows local OS guest     users to cause a denial of service (divide-by-zero     error and QEMU process crash) by unsetting vring     alignment while updating Virtio rings.
    (CVE-2017-17381)The rc4030_write function in     hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows     local guest OS administrators to cause a denial of     service (divide-by-zero error and QEMU process crash)     via a large interval timer reload value.
    (CVE-2016-8667)Quick Emulator (aka QEMU), when built     with the Cirrus CLGD 54xx VGA Emulator support, allows     local guest OS privileged users to cause a denial of     service (out-of-bounds access and QEMU process crash)     by leveraging incorrect region calculation when     updating VGA display. (CVE-2018-7858)QEMU, when built     with the Pseudo Random Number Generator (PRNG) back-end     support, allows local guest OS users to cause a denial     of service (process crash) via an entropy request,     which triggers arbitrary stack based allocation and     memory corruption.(CVE-2016-2858)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in qemu, a fast processor emulator.

  - CVE-2017-15038     Tuomas Tynkkynen discovered an information leak in 9pfs.

  - CVE-2017-15119     Eric Blake discovered that the NBD server insufficiently     restricts large option requests, resulting in denial of     service.

  - CVE-2017-15124     Daniel Berrange discovered that the integrated VNC     server insufficiently restricted memory allocation,     which could result in denial of service.

  - CVE-2017-15268     A memory leak in websockets support may result in denial     of service.

  - CVE-2017-15289     Guoxiang Niu discovered an OOB write in the emulated     Cirrus graphics adaptor which could result in denial of     service.

  - CVE-2017-16845     Cyrille Chatras discovered an information leak in PS/2     mouse and keyboard emulation which could be exploited     during instance migration.

  - CVE-2017-17381     Dengzhan Heyuandong Bijunhua and Liweichao discovered     that an implementation error in the virtio vring     implementation could result in denial of service.

  - CVE-2017-18043     Eric Blake discovered an integer overflow in an     internally used macro which could result in denial of     service.

  - CVE-2018-5683     Jiang Xin and Lin ZheCheng discovered an OOB memory     access in the emulated VGA adaptor which could result in     denial of service.

  - CVE-2018-7550     Cyrille Chatras discovered that an OOB memory write when     using multiboot could result in the execution of     arbitrary code.

This update also backports a number of mitigations against the Spectre v2 vulnerability affecting modern CPUs (CVE-2017-5715 ). For additional information please refer to https://www.qemu.org/2018/01/04/spectre/

The remote host is affected by the vulnerability described in GLSA-201804-08 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker could execute arbitrary code, cause a Denial of Service       condition, or obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for qemu fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. (CVE-2017-5715 bsc#1068032) The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution. We replaced our initial patch by the patches from upstream. This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either
-IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used. Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient. A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see:
https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/ A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276) These two patches will be removed when we can reasonably assume everyone is running with the appropriate updates. Also security fixes for the following CVE issues are included :

  - CVE-2017-15119: The Network Block Device (NBD) server in     Quick Emulator (QEMU), was vulnerable to a denial of     service issue. It could occur if a client sent large     option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this     flaw to keep the NBD server from serving other requests,     resulting in DoS. (bsc#1070144)

  - CVE-2017-15124: VNC server implementation in Quick     Emulator (QEMU) was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause     DoS to the server host. (bsc#1073489)

  - CVE-2017-16845: The PS2 driver in Qemu did not validate     'rptr' and 'count' values during guest migration,     leading to out-of-bounds access. (bsc#1068613)

  - CVE-2017-17381: The Virtio Vring implementation in QEMU     allowed local OS guest users to cause a denial of     service (divide-by-zero error and QEMU process crash) by     unsetting vring alignment while updating Virtio rings.
    (bsc#1071228)

  - CVE-2017-18030: A problem in the Cirrus driver in Qemu     allowed local OS guest privileged users to cause a     denial of service (out-of-bounds array access and QEMU     process crash) via vectors related to negative pitch.
    (bsc#1076179)

  - CVE-2017-18043: Integer overflow in the macro ROUND_UP     (n, d) in Quick Emulator (Qemu) allowed a user to cause     a denial of service (Qemu process crash). (bsc#1076775)

  - CVE-2018-5683: The VGA driver in Qemu allowed local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation.
    (bsc#1076114)

  - CVE-2018-7550: The multiboot functionality in Quick     Emulator (aka QEMU) allowed local guest OS users to     execute arbitrary code on the QEMU host via an     out-of-bounds read or write memory access. (bsc#1083291)     Also the following bugs were fixed :

  - Eliminate bogus use of CPUID_7_0_EDX_PRED_CMD which     we've carried since the initial Spectre v2 patch was     added. EDX bit 27 of CPUID Leaf 07H, Sub-leaf 0 provides     status on STIBP, and not the PRED_CMD MSR. Exposing the     STIBP CPUID feature bit to the guest is wrong in     general, since the VM doesn't directly control the     scheduling of physical hyperthreads. This is left     strictly to the L0 hypervisor.

  - Spectre fixes for IBM Z series by providing more hw     features to guests (bsc#1076814)

  - Pre-add group kvm for qemu-tools (bsc#1040202)

  - the qemu-tools package also needs a prerequire of group     management tools, from the shadow package. (bsc#1085598)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. (CVE-2017-5715 bsc#1068032)

The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution.

We replaced our initial patch by the patches from upstream.

This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either -IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used.

Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient.

A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see:
https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/

A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276)

These two patches will be removed when we can reasonably assume everyone is running with the appropriate updates.

Spectre fixes for IBM Z Series were included by providing more hw features to guests (bsc#1076813)

Also security fixes for the following CVE issues are included :

  - CVE-2017-17381: The Virtio Vring implementation in QEMU     allowed local OS guest users to cause a denial of     service (divide-by-zero error and QEMU process crash) by     unsetting vring alignment while updating Virtio rings.
    (bsc#1071228)

  - CVE-2017-16845: The PS2 driver in Qemu did not validate     'rptr' and 'count' values during guest migration,     leading to out-of-bounds access. (bsc#1068613)

  - CVE-2017-15119: The Network Block Device (NBD) server in     Quick Emulator (QEMU), was vulnerable to a denial of     service issue. It could occur if a client sent large     option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this     flaw to keep the NBD server from serving other requests,     resulting in DoS. (bsc#1070144)

  - CVE-2017-18043: Integer overflow in the macro ROUND_UP     (n, d) in Quick Emulator (Qemu) allowed a user to cause     a denial of service (Qemu process crash). (bsc#1076775)

  - CVE-2018-5683: The VGA driver in Qemu allowed local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation.
    (bsc#1076114)

  - CVE-2018-7550: The multiboot functionality in Quick     Emulator (aka QEMU) allowed local guest OS users to     execute arbitrary code on the QEMU host via an     out-of-bounds read or write memory access. (bsc#1083291)

  - CVE-2017-15124: VNC server implementation in Quick     Emulator (QEMU) was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause     DoS to the server host. (bsc#1073489)

Additional bugs fixed :

  - Fix pcihp for 1.6 and older machine types (bsc#1074572)

  - Fix packaging dependencies (coreutils) for qemu-ksm     package (bsc#1040202)

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for qemu fixes the following issues: This update has the next round of Spectre v2 related patches, which now integrate with corresponding changes in libvirt. (CVE-2017-5715 bsc#1068032) The January 2018 release of qemu initially addressed the Spectre v2 vulnerability for KVM guests by exposing the spec-ctrl feature for all x86 vcpu types, which was the quick and dirty approach, but not the proper solution. We replaced our initial patch by the patches from upstream. This update defines spec_ctrl and ibpb cpu feature flags as well as new cpu models which are clones of existing models with either
-IBRS or -IBPB added to the end of the model name. These new vcpu models explicitly include the new feature(s), whereas the feature flags can be added to the cpu parameter as with other features. In short, for continued Spectre v2 protection, ensure that either the appropriate cpu feature flag is added to the QEMU command-line, or one of the new cpu models is used. Although migration from older versions is supported, the new cpu features won't be properly exposed to the guest until it is restarted with the cpu features explicitly added. A reboot is insufficient. A warning patch is added which attempts to detect a migration from a qemu version which had the quick and dirty fix (it only detects certain cases, but hopefully is helpful.) For additional information on Spectre v2 as it relates to QEMU, see:
https://www.qemu.org/2018/02/14/qemu-2-11-1-and-spectre-update/ A patch is added to continue to detect Spectre v2 mitigation features (as shown by cpuid), and if found provide that feature to guests, even if running on older KVM (kernel) versions which do not yet expose that feature to QEMU. (bsc#1082276) These two patches will be removed when we can reasonably assume everyone is running with the appropriate updates. Spectre fixes for IBM Z Series were included by providing more hw features to guests (bsc#1076813) Also security fixes for the following CVE issues are included :

  - CVE-2017-17381: The Virtio Vring implementation in QEMU     allowed local OS guest users to cause a denial of     service (divide-by-zero error and QEMU process crash) by     unsetting vring alignment while updating Virtio rings.
    (bsc#1071228)

  - CVE-2017-16845: The PS2 driver in Qemu did not validate     'rptr' and 'count' values during guest migration,     leading to out-of-bounds access. (bsc#1068613)

  - CVE-2017-15119: The Network Block Device (NBD) server in     Quick Emulator (QEMU), was vulnerable to a denial of     service issue. It could occur if a client sent large     option requests, making the server waste CPU time on     reading up to 4GB per request. A client could use this     flaw to keep the NBD server from serving other requests,     resulting in DoS. (bsc#1070144)

  - CVE-2017-18043: Integer overflow in the macro ROUND_UP     (n, d) in Quick Emulator (Qemu) allowed a user to cause     a denial of service (Qemu process crash). (bsc#1076775)

  - CVE-2018-5683: The VGA driver in Qemu allowed local OS     guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation.
    (bsc#1076114)

  - CVE-2018-7550: The multiboot functionality in Quick     Emulator (aka QEMU) allowed local guest OS users to     execute arbitrary code on the QEMU host via an     out-of-bounds read or write memory access. (bsc#1083291)

  - CVE-2017-15124: VNC server implementation in Quick     Emulator (QEMU) was found to be vulnerable to an     unbounded memory allocation issue, as it did not     throttle the framebuffer updates sent to its client. If     the client did not consume these updates, VNC server     allocates growing memory to hold onto this data. A     malicious remote VNC client could use this flaw to cause     DoS to the server host. (bsc#1073489) Additional bugs     fixed :

  - Fix pcihp for 1.6 and older machine types (bsc#1074572)

  - Fix packaging dependencies (coreutils) for qemu-ksm     package (bsc#1040202)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3575-1 advisory.

    It was discovered that QEMU incorrectly handled guest ram. A privileged attacker inside the guest could     use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu     14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-11334)

    David Buchanan discovered that QEMU incorrectly handled the VGA device. A privileged attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue was only     addressed in Ubuntu 17.10. (CVE-2017-13672)

    Thomas Garnier discovered that QEMU incorrectly handled multiboot. An attacker could use this issue to     cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In     the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt     AppArmor profile. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-14167)

    Tuomas Tynkkynen discovered that QEMU incorrectly handled VirtFS directory sharing. An attacker could use     this issue to obtain sensitive information from host memory. (CVE-2017-15038)

    Eric Blake discovered that QEMU incorrectly handled memory in the NBD server. An attacker could use this     issue to cause the NBD server to crash, resulting in a denial of service. This issue only affected Ubuntu     17.10. (CVE-2017-15118)

    Eric Blake discovered that QEMU incorrectly handled certain options to the NBD server. An attacker could     use this issue to cause the NBD server to crash, resulting in a denial of service. This issue only     affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-15119)

    Daniel Berrange discovered that QEMU incorrectly handled the VNC server. A remote attacker could possibly     use this issue to consume memory, resulting in a denial of service. This issue was only addressed in     Ubuntu 17.10. (CVE-2017-15124)

    Carl Brassey discovered that QEMU incorrectly handled certain websockets. A remote attacker could possibly     use this issue to consume memory, resulting in a denial of service. This issue only affected Ubuntu 17.10.
    (CVE-2017-15268)

    Guoxiang Niu discovered that QEMU incorrectly handled the Cirrus VGA device. A privileged attacker inside     the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-15289)

    Cyrille Chatras discovered that QEMU incorrectly handled certain PS2 values during migration. An attacker     could possibly use this issue to cause QEMU to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-16845)

    It was discovered that QEMU incorrectly handled the Virtio Vring implementation. An attacker could     possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 17.10. (CVE-2017-17381)

    Eric Blake discovered that QEMU incorrectly handled certain rounding operations. An attacker could     possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2017-18043)

    Jiang Xin and Lin ZheCheng discovered that QEMU incorrectly handled the VGA device. A privileged attacker     inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2018-5683)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199674	RHEL 7 : qemu-kvm-ma (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
180858	Oracle Linux 7 : qemu (ELSA-2018-4289)	Nessus	Oracle Linux Local Security Checks	critical
180778	Oracle Linux 7 : qemu (ELSA-2018-4285)	Nessus	Oracle Linux Local Security Checks	critical
180740	Oracle Linux 7 : qemu (ELSA-2019-4585)	Nessus	Oracle Linux Local Security Checks	critical
136276	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2020-1573)	Nessus	Huawei Local Security Checks	critical
135154	EulerOS Virtualization for ARM 64 3.0.6.0 : qemu-kvm (EulerOS-SA-2020-1367)	Nessus	Huawei Local Security Checks	high
110208	Debian DSA-4213-1 : qemu - security update (Spectre)	Nessus	Debian Local Security Checks	critical
108929	GLSA-201804-08 : QEMU: Multiple vulnerabilities (Spectre)	Nessus	Gentoo Local Security Checks	critical
108686	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2018:0831-1) (Spectre)	Nessus	SuSE Local Security Checks	critical
108576	openSUSE Security Update : qemu (openSUSE-2018-291) (Spectre)	Nessus	SuSE Local Security Checks	critical
108533	SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2018:0762-1) (Spectre)	Nessus	SuSE Local Security Checks	critical
106927	Ubuntu 14.04 LTS / 16.04 LTS : QEMU vulnerabilities (USN-3575-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2017-17381

medium

Tenable Plugins

medium

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical