hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: net: ignore packets with large size (CVE-2018-17963)

  - Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0     allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.
    (CVE-2015-5745)

  - The MSI-X MMIO support in hw/pci/msix.c in QEMU (aka Quick Emulator) allows local guest OS privileged     users to cause a denial of service (NULL pointer dereference and QEMU process crash) by leveraging failure     to define the .write method. (CVE-2015-7549)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: ppc64: sPAPR emulator leaks the host hardware identity (CVE-2019-8934)

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check     before an ide_cancel_dma_sync call. (CVE-2020-25743)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4640 advisory.

    - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as       fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}       {CVE-2018-12130} {CVE-2019-11091}
    - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008}     {CVE-2019-8934}
    - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
    - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
    - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
    - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]     {CVE-2019-6501}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)

Fix sPAPR emulator leaks the host hardware identity (CVE-2019-8934, bsc#1126455)

Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)

Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)

For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues:
(CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1031692, bsc#1094725)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed an information leak in slirp     (bsc#1129622)

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 host information, which can be     considered a security issue (bsc#1126455)

  - CVE-2019-3812: Fixed OOB memory access and information     leak in virtual monitor interface (bsc#1125721)

  - CVE-2018-20815: Fix DOS possibility in device tree     processing (bsc#1130675)

  - Adjust fix for CVE-2019-8934 (bsc#1126455) to match the     latest upstream adjustments for the same. Basically now     the security fix is to provide a dummy host-model and     host-serial value, which overrides getting that value     from the host

  - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130     CVE-2019-11091: Added x86 cpu feature 'md-clear'     (bsc#1111331)

Other bugs fixed :

  - Use a new approach to handling the file input to -smbios     option, which accepts either legacy or per-spec formats     regardless of the machine type.

This update was imported from the SUSE:SLE-15:Update update project.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed information leak in slirp     (bsc#1129622).

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 hostinformation (bsc#1126455).

  - CVE-2019-3812: Fixed Out-of-bounds memory access and     information leak in virtual monitor interface     (bsc#1125721).

  - CVE-2018-20815: Fixed a denial of service possibility in     device tree processing (bsc#1130675).

Non-security issue fixed :

  - Backported Skylake-Server vcpu model support from qemu     v2.11 (FATE#327261 bsc#1131955).

  - Added ability to set virtqueue size using virtqueue_size     parameter (FATE#327255 bsc#1118900).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

ID	Name	Product	Family	Severity
198727	RHEL 7 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198711	RHEL 8 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
196182	RHEL 8 : qemu (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
180647	Oracle Linux 7 : qemu (ELSA-2019-4640)	Nessus	Oracle Linux Local Security Checks	critical
150203	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1829-1)	Nessus	SuSE Local Security Checks	medium
125302	openSUSE Security Update : qemu (openSUSE-2019-1405) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	critical
124311	openSUSE Security Update : qemu (openSUSE-2019-1274)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-8934

low

Tenable Plugins

critical

low

high

critical

medium

critical

critical