hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the     /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest. (CVE-2019-8934)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4640 advisory.

    - x86: Document CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091 as       fixed (Mark Kanda)  [Orabug: 29744956]  {CVE-2018-12126} {CVE-2018-12127}       {CVE-2018-12130} {CVE-2019-11091}
    - Document CVE-2019-8934 and CVE-2019-5008 as fixed (Mark Kanda)  [Orabug: 29715605]  {CVE-2019-5008}     {CVE-2019-8934}
    - device_tree.c: Don't use load_image() (Peter Maydell)  [Orabug: 29715527]  {CVE-2018-20815}
    - slirp: check sscanf result when emulating ident (William Bowling)  [Orabug: 29715525]  {CVE-2019-9824}
    - i2c-ddc: fix oob read (Gerd Hoffmann)  [Orabug: 29715520]  {CVE-2019-3812}
    - scsi-generic: avoid possible out-of-bounds access to r->buf (Paolo Bonzini)  [Orabug: 29259700]     {CVE-2019-6501}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)

Fix sPAPR emulator leaks the host hardware identity (CVE-2019-8934, bsc#1126455)

Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)

Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)

For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues:
(CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1031692, bsc#1094725)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed an information leak in slirp     (bsc#1129622)

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 host information, which can be     considered a security issue (bsc#1126455)

  - CVE-2019-3812: Fixed OOB memory access and information     leak in virtual monitor interface (bsc#1125721)

  - CVE-2018-20815: Fix DOS possibility in device tree     processing (bsc#1130675)

  - Adjust fix for CVE-2019-8934 (bsc#1126455) to match the     latest upstream adjustments for the same. Basically now     the security fix is to provide a dummy host-model and     host-serial value, which overrides getting that value     from the host

  - CVE-2018-12126 CVE-2018-12127 CVE-2018-12130     CVE-2019-11091: Added x86 cpu feature 'md-clear'     (bsc#1111331)

Other bugs fixed :

  - Use a new approach to handling the file input to -smbios     option, which accepts either legacy or per-spec formats     regardless of the machine type.

This update was imported from the SUSE:SLE-15:Update update project.

This update for qemu fixes the following issues :

Security issues fixed :

  - CVE-2019-9824: Fixed information leak in slirp     (bsc#1129622).

  - CVE-2019-8934: Added method to specify whether or not to     expose certain ppc64 hostinformation (bsc#1126455).

  - CVE-2019-3812: Fixed Out-of-bounds memory access and     information leak in virtual monitor interface     (bsc#1125721).

  - CVE-2018-20815: Fixed a denial of service possibility in     device tree processing (bsc#1130675).

Non-security issue fixed :

  - Backported Skylake-Server vcpu model support from qemu     v2.11 (FATE#327261 bsc#1131955).

  - Added ability to set virtqueue size using virtqueue_size     parameter (FATE#327255 bsc#1118900).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

ID	Name	Product	Family	Severity
223178	Linux Distros Unpatched Vulnerability : CVE-2019-8934	Nessus	Misc.	low
180647	Oracle Linux 7 : qemu (ELSA-2019-4640)	Nessus	Oracle Linux Local Security Checks	critical
150203	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1829-1)	Nessus	SuSE Local Security Checks	medium
125302	openSUSE Security Update : qemu (openSUSE-2019-1405) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	critical
124311	openSUSE Security Update : qemu (openSUSE-2019-1274)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-8934

low

Tenable Plugins

low

critical

medium

critical

critical