Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2408 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * Quick Emulator (QEMU) built with Network Block Device (NBD) Server support was vulnerable to a null-     pointer dereference issue. The flaw could occur when releasing a client that was not initialized due to     failed negotiation. A remote user or process could exploit this flaw to crash the qemu-nbd server (denial     of service). (CVE-2017-9524)

    * An information-exposure flaw was found in Quick Emulator (QEMU) in Task Priority Register (TPR)     optimizations for 32-bit Windows guests. The flaw could occur while accessing TPR. A privileged user     inside a guest could use this issue to read portions of the host memory. (CVE-2016-4020)

    * A memory-leak flaw was found in the Quick Emulator (QEMU) built with USB xHCI controller emulation     support. The flaw could occur while doing a USB-device unplug operation. Unplugging the device repeatedly     resulted in leaking host memory, which affected other services on the host. A privileged user inside the     guest could exploit this flaw to cause a denial of service on the host or potentially crash the host's     QEMU process instance. (CVE-2016-7466)

    * Multiple CVEs were fixed as a result of rebase to QEMU 2.9.0. (CVE-2016-6888, CVE-2016-7422,     CVE-2016-8576, CVE-2016-8669, CVE-2016-8909, CVE-2016-8910, CVE-2016-9907, CVE-2016-9911, CVE-2016-9921,     CVE-2016-9922, CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, CVE-2017-6414, CVE-2017-8309, CVE-2017-8379,     CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, CVE-2017-9375)

    Red Hat would like to thank Donghai Zdh (Alibaba Inc.) for reporting CVE-2016-4020; Li Qiang (Qihoo 360     Inc.) for reporting CVE-2016-6888; Qinghao Tang (Marvel Team 360.cn Inc.) and Zhenhao Hong (Marvel Team     360.cn Inc.) for reporting CVE-2016-7422; Li Qiang (360.cn Inc.) for reporting CVE-2016-7466,     CVE-2016-10155, CVE-2017-5579, CVE-2017-5973, and CVE-2017-6414; PSIRT (Huawei Inc.) for reporting     CVE-2016-8669; Andrew Henderson (Intelligent Automation Inc.) for reporting CVE-2016-8910; Qinghao Tang     (Qihoo 360), Li Qiang (Qihoo 360), and Jiangxin (Huawei Inc.) for reporting CVE-2016-9921 and     CVE-2016-9922; Jiang Xin (PSIRT, Huawei Inc.) for reporting CVE-2017-8309 and CVE-2017-8379; and Li Qiang     (Qihoo 360 Gear Team) for reporting CVE-2017-9310, CVE-2017-9373, CVE-2017-9374, and CVE-2017-9375.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure     to define the .write method. (CVE-2015-7549)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a     denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD)     list. (CVE-2015-8558)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libcacard package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Memory leak in the vcard_apdu_new function in card_7816.c in libcacard before 2.5.3 allows local guest OS     users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU     object. (CVE-2017-6414)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libcacard package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Memory leak in the vcard_apdu_new function in     card_7816.c in libcacard before 2.5.3 allows local     guest OS users to cause a denial of service (host     memory consumption) via vectors related to allocating a     new APDU object.(CVE-2017-6414)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes several issues. These security issues were fixed :

  - A malicious 64-bit PV guest may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks by placing a IRET     hypercall in the middle of a multicall batch (XSA-213,     bsc#1034843)

  - A malicious pair of guests may be able to access all of     system memory, allowing for all of privilege escalation,     host crashes, and information leaks because of a missing     check when transfering pages via GNTTABOP_transfer     (XSA-214, bsc#1034844).

  - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local     guest OS privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) via vectors     related to copying VGA data via the     cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_     functions (bsc#1034994).

  - CVE-2016-9603: A privileged user within the guest VM     could have caused a heap overflow in the device model     process, potentially escalating their privileges to that     of the device model process (bsc#1028655)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2016-9603: A privileged user within the guest VM can     cause a heap overflow in the device model process,     potentially escalating their privileges to that of the     device model process (bsc#1028655).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

  - CVE-2017-2633: The VNC display driver support was     vulnerable to an out-of-bounds memory access issue. A     user/process inside guest could use this flaw to cause     DoS (bsc#1026636).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues: These security issues were fixed :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - XSA-206: Unprivileged guests issuing writes to xenstore     were able to stall progress of the control domain or     driver domain, possibly leading to a Denial of Service     (DoS) of the entire host (bsc#1030144).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-2633: The VNC display driver support was     vulnerable to an out-of-bounds memory access issue. A     user/process inside guest could use this flaw to cause     DoS (bsc#1026636).

  - CVE-2016-9603: A privileged user within the guest VM can     cause a heap overflow in the device model process,     potentially escalating their privileges to that of the     device model process (bsc#1028655).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following security issues :

  - CVE-2017-7228: Broken check in memory_exchange()     permited PV guest breakout (bsc#1030442).

  - CVE-2017-6414: Memory leak in the vcard_apdu_new     function in card_7816.c in libcacard allowed local guest     OS users to cause a denial of service (host memory     consumption) via vectors related to allocating a new     APDU object (bsc#1027570).

  - CVE-2017-6505: The ohci_service_ed_list function in     hw/usb/hcd-ohci.c allowed local guest OS users to cause     a denial of service (infinite loop) via vectors     involving the number of link endpoint list descriptors     (bsc#1028235).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

new upstream release 2.5.3, fixing leaks

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
210314	RHEL 7 : qemu-kvm-rhev (RHSA-2017:2408)	Nessus	Red Hat Local Security Checks	medium
198727	RHEL 7 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198718	RHEL 6 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
162372	EulerOS 2.0 SP5 : libcacard (EulerOS-SA-2022-1897)	Nessus	Huawei Local Security Checks	medium
146752	EulerOS 2.0 SP2 : libcacard (EulerOS-SA-2021-1314)	Nessus	Huawei Local Security Checks	medium
145161	EulerOS 2.0 SP3 : libcacard (EulerOS-SA-2021-1082)	Nessus	Huawei Local Security Checks	medium
99962	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:1147-1)	Nessus	SuSE Local Security Checks	critical
99580	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1081-1)	Nessus	SuSE Local Security Checks	critical
99579	SUSE SLES12 Security Update : xen (SUSE-SU-2017:1080-1)	Nessus	SuSE Local Security Checks	critical
99507	SUSE SLES11 Security Update : xen (SUSE-SU-2017:1058-1)	Nessus	SuSE Local Security Checks	high
97535	Fedora 25 : 3:libcacard (2017-5a6ed9d326)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-6414

medium

Tenable Plugins

medium

critical

critical

medium

medium

medium

critical

critical

critical

high

medium