QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: usbredir: free() call on invalid pointer in bufp_alloc() (CVE-2021-3682)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
    (CVE-2019-13164)

  - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer     dereference. (CVE-2020-15469)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - Qemu: qemu-bridge-helper ACL can be bypassed when names are too long (CVE-2019-13164)

  - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer     dereference. (CVE-2020-15469)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - QEMU: usb: use-after-free issue while setting up packet (CVE-2020-25084)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K41301038 advisory.

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3099 advisory.

  - sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read     during sdhci_write() operations. A guest OS user can crash the QEMU process. (CVE-2020-13253)

  - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer     dereference. (CVE-2020-15469)

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

  - QEMU 5.0.0 has a heap-based Buffer Overflow in flatview_read_continue in exec.c because hw/sd/sdhci.c     mishandles a write operation in the SDHC_BLKSIZE case. (CVE-2020-25085)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host     controller driver. (CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. (CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service. (CVE-2020-25723)

  - eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest     can crash the QEMU process via packet data that lacks a valid Layer 3 protocol. (CVE-2020-27617)

  - A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.
    This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO     operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial     of service. This flaw affects QEMU versions prior to 5.2.0. (CVE-2020-27821)

  - hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
    (CVE-2020-28916)

  - ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29129)

  - ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated. (CVE-2020-29443)

  - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2020-35504)

  - A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw     allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-35505)

  - A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This     flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges     on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as     system availability. (CVE-2021-20181)

  - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

  - An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It     may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A     privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
    (CVE-2021-20203)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing     transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid     values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The     highest threat from this vulnerability is to system availability. (CVE-2021-20257)

  - A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI     I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req'     from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the     host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
    (CVE-2021-3392)

  - A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions     up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get     bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the     host resulting in DoS scenario. (CVE-2021-3416)

  - A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could     occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the     floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on     the host resulting in DoS scenario, or potential information leakage from the host memory. (CVE-2021-3507)

  - A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a     single, large transfer request, to reduce the overhead and improve performance. The combined size of the     bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a     denial of service. (CVE-2021-3527)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while     handling a PVRDMA_CMD_CREATE_MR command due to improper memory remapping (mremap). This flaw allows a     malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to     system availability. (CVE-2021-3582)

  - An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions     prior to 6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest due to     improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount     of memory, resulting in a denial of service. The highest threat from this vulnerability is to system     availability. (CVE-2021-3607)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to     6.1.0. The issue occurs while handling a PVRDMA_REG_DSRHIGH write from the guest and may result in a     crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest     threat from this vulnerability is to system availability. (CVE-2021-3608)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions     prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-     bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this     flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the     host. (CVE-2021-3713)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

  - An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE     SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious     guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
    (CVE-2021-3930)

  - A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()     function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer     overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or     potentially execute arbitrary code within the context of the QEMU process. (CVE-2021-4206)

  - A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values     `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object     followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw     to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU     process. (CVE-2021-4207)

  - A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached     from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
    Affected QEMU versions <= 6.2.0. (CVE-2022-26354)

  - softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path,     leading to an io_readx or io_writex crash. (CVE-2022-35414)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL     dereference) when the command header 'ad->cur_cmd' is null. (CVE-2019-12067)

  - QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e     packet with the data's address set to the e1000e's MMIO address. (CVE-2020-15859)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

  - pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because     pci_get_bus() might not return a valid pointer. (CVE-2020-25742)

  - hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check     before an ide_cancel_dma_sync call. (CVE-2020-25743)

  - A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2020-35504)

  - A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw     allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
    The highest threat from this vulnerability is to system availability. (CVE-2020-35505)

  - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while     processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
    This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is to system availability. (CVE-2021-20196)

  - An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It     may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A     privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
    (CVE-2021-20203)

  - An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of     QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an     interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said     issue while updating controller state fields and their subsequent processing. A privileged guest user may     use this flaw to crash the QEMU process on the host resulting in DoS scenario. (CVE-2021-20221)

  - A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator     of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw     allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a     denial of service. The highest threat from this vulnerability is to system availability. (CVE-2021-20255)

  - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions     up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-     gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. (CVE-2021-3544)

  - An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-     user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit     this issue to leak memory from the host. (CVE-2021-3545)

  - An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET'     command from the guest. It could allow a privileged guest user to crash the QEMU process on the host,     resulting in a denial of service condition, or potential code execution with the privileges of the QEMU     process. (CVE-2021-3546)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the     descriptor's address belongs to the non direct access region, due to num_buffers being set after the     virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a     denial of service condition, or potentially execute code on the host with the privileges of the QEMU     process. (CVE-2021-3748)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in the SCSI     emulation support of QEMU in versions before 6.0.0.
    This flaw allows a privileged guest user to crash the     QEMU process on the host, resulting in a denial of     service. The highest threat from this vulnerability is     to system availability.(CVE-2020-35504)

  - An out-of-bounds heap buffer access issue was found in     the ARM Generic Interrupt Controller emulator of QEMU     up to and including qemu 4.2.0on aarch64 platform. The     issue occurs because while writing an interrupt ID to     the controller memory area, it is not masked to be 4     bits wide. It may lead to the said issue while updating     controller state fields and their subsequent     processing. A privileged guest user may use this flaw     to crash the QEMU process on the host resulting in DoS     scenario.(CVE-2021-20221)

  - A flaw was found in the USB redirector device     (usb-redir) of QEMU. Small USB packets are combined     into a single, large transfer request, to reduce the     overhead and improve performance. The combined size of     the bulk transfer is used to dynamically allocate a     variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a     malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an     excessive allocation on the(CVE-2021-3527)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c     because the usb_packet_map return value is not     checked.(CVE-2020-25084)

  - A NULL pointer dereference flaw was found in the     am53c974 SCSI host bus adapter emulation of QEMU in     versions before 6.0.0. This issue occurs while handling     the 'Information Transfer' command. This flaw allows a     privileged guest user to crash the QEMU process on the     host, resulting in a denial of service. The highest     threat from this vulnerability is to system     availability.(CVE-2020-35505)

  - An information disclosure vulnerability was found in     the virtio vhost-user GPU device (vhost-user-gpu) of     QEMU in versions up to and including 6.0. The flaw     exists in virgl_cmd_get_capset_info() in     contrib/vhost-user-gpu/virgl.c and could occur due to     the read of uninitialized memory. A malicious guest     could exploit this issue to leak memory from the host.
    (CVE-2021-3545)

  - Several memory leaks were found in the virtio     vhost-user GPU device (vhost-user-gpu) of QEMU in     versions up to and including 6.0. They exist in     contrib/vhost-user-gpu/vhost-user-gpu.c and     contrib/vhost-user-gpu/virgl.c due to improper release     of memory (i.e., free) after effective     lifetime.(CVE-2021-3544)

  - A flaw was found in vhost-user-gpu of QEMU in versions     up to and including 6.0. An out-of-bounds write     vulnerability can allow a malicious guest to crash the     QEMU process on the host resulting in a denial of     service or potentially execute arbitrary code on the     host with the privileges of the QEMU process. The     highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2021-3546)

  - A race condition flaw was found in the 9pfs server     implementation of QEMU up to and including 5.2.0. This     flaw allows a malicious 9p client to cause a     use-after-free error, potentially escalating their     privileges on the system. The highest threat from this     vulnerability is to confidentiality, integrity as well     as system availability.(CVE-2021-20181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU     (aka Quick Emulator) does not properly limit the buffer     descriptor count when transmitting packets, which     allows local guest OS administrators to cause a denial     of service (infinite loop and QEMU process crash) via     vectors involving a buffer descriptor with a length of     0 and crafted values in bd.flags.(CVE-2016-7907)

  - Stack-based buffer overflow in hw/usb/redirect.c in     QEMU (aka Quick Emulator) allows local guest OS users     to cause a denial of service (QEMU process crash) via     vectors related to logging debug     messages.(CVE-2017-10806)

  - The dhcp_decode function in slirp/bootp.c in QEMU (aka     Quick Emulator) allows local guest OS users to cause a     denial of service (out-of-bounds read and QEMU process     crash) via a crafted DHCP options     string.(CVE-2017-11434)

  - A use-after-free issue was found in the Slirp     networking implementation of the Quick emulator (QEMU).
    It occurs when a Socket referenced from multiple     packets is freed while responding to a message. A     user/process could use this flaw to crash the QEMU     process on the host resulting in denial of     service.(CVE-2017-13711)

  - Buffer overflow in the 'megasas_mmio_write' function in     Qemu 2.9.0 allows remote attackers to have unspecified     impact via unknown vectors.(CVE-2017-8380)

  - A heap buffer overflow issue was found in the way SLiRP     networking back-end in QEMU processes fragmented     packets. It could occur while reassembling the     fragmented datagrams of an incoming packet. A     privileged user/process inside guest could use this     flaw to crash the QEMU process resulting in DoS or     potentially leverage it to execute arbitrary code on     the host with privileges of the QEMU     process.(CVE-2018-11806)

  - qemu-seccomp.c in QEMU might allow local OS guest users     to cause a denial of service (guest crash) by     leveraging mishandling of the seccomp policy for     threads other than the main thread.(CVE-2018-15746)

  - An integer overflow issue was found in the RTL8139 NIC     emulation in QEMU. It could occur while receiving     packets over the network if the size value is greater     than INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process, resulting in DoS     scenario.(CVE-2018-17958)

  - An integer overflow issue was found in the AMD PC-Net     II NIC emulation in QEMU. It could occur while     receiving packets, if the size value was greater than     INT_MAX. Such overflow would lead to stack buffer     overflow issue. A user inside guest could use this flaw     to crash the QEMU process resulting in     DoS.(CVE-2018-17962)

  - A heap buffer overflow issue was found in the     load_device_tree() function of QEMU, which is invoked     to load a device tree blob at boot time. It occurs due     to device tree size manipulation before buffer     allocation, which could overflow a signed int type. A     user/process could use this flaw to potentially execute     arbitrary code on a host system with privileges of the     QEMU process.(CVE-2018-20815)

  - interface_release_resource in hw/display/qxl.c in QEMU     3.1.x through 4.0.0 has a NULL pointer     dereference.(CVE-2019-12155)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not     ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the     IFNAMSIZ size, which can lead to an ACL     bypass.(CVE-2019-13164)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the ip_reass() routine while     reassembling incoming packets if the first fragment is     bigger than the m->m_dat[] buffer. An attacker could     use this flaw to crash the QEMU process on the host,     resulting in a Denial of Service or potentially     executing arbitrary code with privileges of the QEMU     process.(CVE-2019-14378)

  - tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c)     in QEMU 3.0.0 uses uninitialized data in an snprintf     call, leading to Information disclosure.(CVE-2019-9824)

  - An out-of-bounds read vulnerability was found in the     SLiRP networking implementation of the QEMU emulator.
    This flaw occurs in the icmp6_send_echoreply() routine     while replying to an ICMP echo request, also known as     ping. This flaw allows a malicious guest to leak the     contents of the host memory, resulting in possible     information disclosure.(CVE-2020-10756)

  - A heap buffer overflow issue was found in the SLiRP     networking implementation of the QEMU emulator. This     flaw occurs in the tcp_emu() routine while emulating     IRC and other protocols. An attacker could use this     flaw to crash the QEMU process on the host, resulting     in a denial of service or potential execution of     arbitrary code with privileges of the QEMU     process.(CVE-2020-7039)

  - An out-of-bound write access flaw was found in the way     QEMU loads ROM contents at boot time. This flaw occurs     in the rom_copy() routine while loading the contents of     a 32-bit -kernel image into memory. Running an     untrusted -kernel image may load contents at arbitrary     memory locations, potentially leading to code execution     with the privileges of the QEMU     process.(CVE-2020-13765)

  - A use-after-free flaw was found in the USB(xHCI/eHCI)     controller emulators of QEMU. This flaw occurs while     setting up the USB packet as a usb_packet_map() routine     and returns an error that was not checked. This flaw     allows a guest user or process to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-25084)

  - An infinite loop flaw was found in the USB OHCI     controller emulator of QEMU. This flaw occurs while     servicing OHCI isochronous transfer descriptors (TD) in     the ohci_service_iso_td routine, as it retires a TD if     it has passed its time frame. It does not check if the     TD was already processed and holds an error code in     TD_CC. This issue may happen if the TD list has a loop.
    This flaw allows a guest user or process to consume CPU     cycles on the host, resulting in a denial of     service.(CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI     emulation code of QEMU. It could occur while processing     USB requests due to missing handling of DMA memory map     failure. A malicious privileged user within the guest     may abuse this flaw to send bogus USB requests and     crash the QEMU process on the host, resulting in a     denial of service.(CVE-2020-25723)

  - A potential directory traversal issue was found in the     tftp server of the SLiRP user-mode networking     implementation used by QEMU. It could occur on a     Windows host, as it allows the use of both forward     ('/') and backward slash('\') tokens as separators in a     file path. A user able to access the tftp server could     use this flaw to access undue files by using relative     paths.(CVE-2020-7211)

  - An out-of-bounds read/write access flaw was found in     the USB emulator of the QEMU in versions before 5.2.0.
    This issue occurs while processing USB packets from a     guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out     routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the     potential execution of arbitrary code with the     privileges of the QEMU process on the     host.(CVE-2020-14364)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in QEMU. A heap-based buffer overflow     vulnerability was found in the SDHCI device emulation     support allowing a guest user or process to crash the     QEMU process on the host resulting in a denial of     service condition, or potentially execute arbitrary     code with privileges of the QEMU process on the host.
    The highest threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-17380)

  - A flaw was found in QEMU. An out-of-bounds read/write     access issue was found in the SDHCI Controller emulator     of QEMU. It may occur while doing multi block SDMA, if     transfer block size exceeds the     's->fifo_buffer[s->buf_maxsz]' size which would leave     the current element pointer 's->data_count' pointing     out of bounds. This would lead the subsequent DMA r/w     operation to an OOB access issue where a guest     user/process may use this flaw to crash the QEMU     process resulting in DoS scenario. The highest threat     from this vulnerability is to data confidentiality and     integrity as well as system     availability.(CVE-2020-25085)

  - The patch for CVE-2020-17380 and CVE-2020-25085, both     involving a heap buffer overflow in the SDHCI     controller emulation code of QEMU, was found to be     incomplete. A malicious privileged guest could     reproduce the same issues with specially crafted input,     inducing a bogus transfer and subsequent out-of-bounds     read/write access in sdhci_do_adma() or     sdhci_sdma_transfer_multi_blocks(). CVE-2021-3409 was     assigned to facilitate the tracking and backporting of     the new patch.(CVE-2021-3409)

  - A potential stack overflow via infinite loop issue was     found in various NIC emulators of QEMU. The issue     occurs in loopback mode of a NIC wherein reentrant DMA     checks get bypassed. A guest user/process may use this     flaw to consume CPU cycles or crash the QEMU process on     the host resulting in DoS scenario.(CVE-2021-3416)

  - An infinite loop flaw was found in the USB OHCI     controller emulator of QEMU. This flaw occurs while     servicing OHCI isochronous transfer descriptors (TD) in     the ohci_service_iso_td routine, as it retires a TD if     it has passed its time frame. It does not check if the     TD was already processed and holds an error code in     TD_CC. This issue may happen if the TD list has a loop.
    This flaw allows a guest user or process to consume CPU     cycles on the host, resulting in a denial of     service.(CVE-2020-25625)

  - An infinite loop flaw was found in the e1000e device     emulator in QEMU. This issue could occur while     receiving packets via the     e1000e_write_packet_to_guest() routine, if the     receive(RX) descriptor has a NULL buffer address. This     flaw allows a privileged guest user to cause a denial     of service. The highest threat from this vulnerability     is to system availability.(CVE-2020-28916)

  - An assert(3) failure flaw was found in the networking     helper functions of QEMU. This vulnerability can occur     in the eth_get_gso_type() routine if a packet does not     have a valid networking L3 protocol (ex. IPv4, IPv6)     value. This flaw allows a guest user to crash the QEMU     process on the host, resulting in a denial of     service.(CVE-2020-27617)

  - A use-after-free flaw was found in the USB(xHCI/eHCI)     controller emulators of QEMU. This flaw occurs while     setting up the USB packet as a usb_packet_map() routine     and returns an error that was not checked. This flaw     allows a guest user or process to crash the QEMU     process, resulting in a denial of     service.(CVE-2020-25084)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:14704-1 advisory.

  - The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory     locations and gain privileges via unspecified parameters related to rectangle handling. (CVE-2014-3689)

  - The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and     CPU consumption) via a large (1) websocket payload or (2) HTTP headers section. (CVE-2015-1779)

  - In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw     occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write()     callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in     hw/display/sm501.c on the host, resulting in a denial of service. (CVE-2020-12829)

  - In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame     count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
    (CVE-2020-13361)

  - In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a     crafted reply_queue_head field from a guest OS user. (CVE-2020-13362)

  - rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two     addresses, which allows attackers to trigger an invalid memory copy operation. (CVE-2020-13765)

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

  - QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not     checked. (CVE-2020-25084)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host     controller driver. (CVE-2020-25624)

  - hw/usb/hcd-ohci.c in QEMU 5.0.0 has an infinite loop when a TD list has a loop. (CVE-2020-25625)

  - A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while     processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user     within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host,     resulting in a denial of service. (CVE-2020-25723)

  - slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of     header data even if that exceeds the total packet length. (CVE-2020-29130)

  - ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer     index is not validated. (CVE-2020-29443)

  - A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This     flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges     on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as     system availability. (CVE-2021-20181)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for qemu fixes the following issues :

  - CVE-2020-12829: Fix OOB access in sm501 device emulation     (bsc#1172385)

  - CVE-2020-25723: Fix use-after-free in usb xhci packet     handling (bsc#1178934)

  - CVE-2020-25084: Fix use-after-free in usb ehci packet     handling (bsc#1176673)

  - CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci     emulation (bsc#1176684)

  - CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation     (bsc#1176682)

  - CVE-2020-27617: Fix guest triggerable assert in shared     network handling code (bsc#1178174)

  - CVE-2020-28916: Fix infinite loop (DoS) in e1000e device     emulation (bsc#1179468)

  - CVE-2020-29443: Fix OOB access in atapi emulation     (bsc#1181108)

  - CVE-2020-27821: Fix heap overflow in MSIx emulation     (bsc#1179686)

  - CVE-2020-15469: Fix NULL pointer deref. (DoS) in mmio     ops (bsc#1173612)

  - CVE-2021-20257: Fix infinite loop (DoS) in e1000 device     emulation (bsc#1182577)

  - CVE-2021-3416: Fix OOB access (stack overflow) in     rtl8139 NIC emulation (bsc#1182968)

  - CVE-2021-3416: Fix OOB access (stack overflow) in other     NIC emulations (bsc#1182968)

  - CVE-2020-27616: Fix OOB access in ati-vga emulation     (bsc#1178400)

  - CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet     processing (bsc#1179466, CVE-2020-29130, bsc#1179467)

  - Fix package scripts to not use hard coded paths for     temporary working directories and log files     (bsc#1182425)

  - Add split-provides through forsplits/13 to cover updates     of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents     (bsc#1184064)

  - Added a few more usability improvements for our git     packaging workflow

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362, bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659, bsc#1172386)

Fix OOB access in iscsi (CVE-2020-11947, bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203, bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863, bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092, bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364, bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181, bsc#1182137)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361, bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765, bsc#1172478)

Fix qemu-testsuite failure

Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

Fix OOB access in ARM interrupt handling (CVE-2021-20221, bsc#1181933)

Fix slowness in arm32 emulation (bsc#1112499)

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362, bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659, bsc#1172386)

Fix OOB access in iscsi (CVE-2020-11947, bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203, bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863, bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092, bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364, bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181, bsc#1182137)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361, bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765, bsc#1172478)

Fix qemu-testsuite failure

Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)

Fix OOB access in ARM interrupt handling (CVE-2021-20221, bsc#1181933)

Fix slowness in arm32 emulation (bsc#1112499)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP packet processing (CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863, bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Drop the 'ampersand 0x25 shift altgr' line in pt-br keymap file (bsc#1129962)

Fix migration failure with error message: 'error while loading state section id 3(ram) (bsc#1154790)

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Use '%service_del_postun_without_restart' instead of '%service_del_postun' to avoid 'Failed to try-restart qemu-ga@.service' error while updating the qemu-guest-agent.
(bsc#1178565)

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

CVE-2020-12829: Fix OOB access in sm501 device emulation (bsc#1172385)

CVE-2020-25723: Fix use-after-free in usb xhci packet handling (bsc#1178934)

CVE-2020-25084: Fix use-after-free in usb ehci packet handling (bsc#1176673)

CVE-2020-25625: Fix infinite loop (DoS) in usb hcd-ohci emulation (bsc#1176684)

CVE-2020-25624: Fix OOB access in usb hcd-ohci emulation (bsc#1176682)

CVE-2020-27617: Fix guest triggerable assert in shared network handling code (bsc#1178174)

CVE-2020-28916: Fix infinite loop (DoS) in e1000e device emulation (bsc#1179468)

CVE-2020-29443: Fix OOB access in atapi emulation (bsc#1181108)

CVE-2020-27821: Fix heap overflow in MSIx emulation (bsc#1179686)

CVE-2020-15469: Fix NULL pointer deref. (DoS) in mmio ops (bsc#1173612)

CVE-2021-20257: Fix infinite loop (DoS) in e1000 device emulation (bsc#1182577)

CVE-2021-3416: Fix OOB access (stack overflow) in rtl8139 NIC emulation (bsc#1182968)

CVE-2021-3416: Fix OOB access (stack overflow) in other NIC emulations (bsc#1182968)

CVE-2020-27616: Fix OOB access in ati-vga emulation (bsc#1178400)

CVE-2020-29129: Fix OOB access in SLIRP ARP/NCSI packet processing (bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Add split-provides through forsplits/13 to cover updates of SLE15-SP2 to SLE15-SP3, and openSUSE equivalents (bsc#1184064)

Added a few more usability improvements for our git packaging workflow

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb ehci packet handling (CVE-2020-25084, bsc#1176673)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386)

Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Apply fixes to qemu scsi passthrough with respect to timeout and error conditions, including using more correct status codes. (bsc#1178049)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Fix OOB access possibility in ES1370 audio device emulation (CVE-2020-13361 bsc#1172384)

Fix OOB access in ROM loading (CVE-2020-13765 bsc#1172478)

Fix OOB access while processing USB packets (CVE-2020-14364 bsc#1175441)

Fix DoS in packet processing of various emulated NICs (CVE-2020-16092 bsc#1174641)

Fix buffer overflow in the XGMAC device (CVE-2020-15863 bsc#1174386)

Use '%service_del_postun_without_restart' instead of '%service_del_postun' to avoid 'Failed to try-restart qemu-ga@.service' error while updating the qemu-guest-agent.
(bsc#1178565)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for qemu fixes the following issues :

Fix OOB access in sm501 device emulation (CVE-2020-12829, bsc#1172385)

Fix OOB access possibility in MegaRAID SAS 8708EM2 emulation (CVE-2020-13362 bsc#1172383)

Fix use-after-free in usb xhci packet handling (CVE-2020-25723, bsc#1178934)

Fix use-after-free in usb iehci packet handling (CVE-2020-25084, bsc#1176673)

Fix infinite loop (DoS) in usb hcd-ohci emulation (CVE-2020-25625, bsc#1176684)

Fix OOB access in usb hcd-ohci emulation (CVE-2020-25624, bsc#1176682)

Fix guest triggerable assert in shared network handling code (CVE-2020-27617, bsc#1178174)

Fix infinite loop (DoS) in e1000e device emulation (CVE-2020-28916, bsc#1179468)

Fix OOB access in atapi emulation (CVE-2020-29443, bsc#1181108)

Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)

Fix NULL pointer deref. (DoS) in mmio ops (CVE-2020-15469, bsc#1173612)

Fix infinite loop (DoS) in e1000 device emulation (CVE-2021-20257, bsc#1182577)

Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)

Fix OOB access (stack overflow) in other NIC emulations (CVE-2021-3416)

Fix OOB access in SLIRP ARP/NCSI packet processing (CVE-2020-29129, bsc#1179466, CVE-2020-29130, bsc#1179467)

Fix NULL pointer dereference possibility (DoS) in MegaRAID SAS 8708EM2 emulation (CVE-2020-13659 bsc#1172386)

Fix issue where s390 guest fails to find zipl boot menu index (bsc#1183979)

Fix OOB access in iscsi (CVE-2020-11947 bsc#1180523)

Fix OOB access in vmxnet3 emulation (CVE-2021-20203 bsc#1181639)

Fix package scripts to not use hard-coded paths for temporary working directories and log files (bsc#1182425)

Fix potential privilege escalation in virtfs (CVE-2021-20181 bsc#1182137)

Apply fixes to qemu scsi passthrough with respect to timeout and error conditions, including using more correct status codes. (bsc#1178049)

Fix OOB access in ARM interrupt handling (CVE-2021-20221 bsc#1181933)

Make note that this patch previously included addresses (CVE-2020-13765 bsc#1172478)

Tweaks to spec file for better formatting, and remove not needed BuildRequires for e2fsprogs-devel and libpcap-devel

Fix vfio-pci device on s390 enters error state (bsc#1179725)

Fix PCI devices are unavailable after a subsystem reset. (bsc#1179726)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in QEMU, a fast processor emulator (notably used in KVM and Xen HVM virtualization). An attacker could trigger a denial of service (DoS), information leak, and possibly execute arbitrary code with the privileges of the QEMU process on the host.

CVE-2020-15469

A MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

CVE-2020-15859

QEMU has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.

CVE-2020-25084

QEMU has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.

CVE-2020-28916

hw/net/e1000e_core.c has an infinite loop via an RX descriptor with a NULL buffer address.

CVE-2020-29130

slirp.c has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the total packet length.

CVE-2020-29443

ide_atapi_cmd_reply_end in hw/ide/atapi.c allows out-of-bounds read access because a buffer index is not validated.

CVE-2021-20181

9pfs: ZDI-CAN-10904: QEMU Plan 9 file system TOCTOU privilege escalation vulnerability.

CVE-2021-20221

aarch64: GIC: out-of-bound heap buffer access via an interrupt ID field.

For Debian 9 stretch, these problems have been fixed in version 1:2.8+dfsg-6+deb9u13.

We recommend that you upgrade your qemu packages.

For the detailed security status of qemu please refer to its security tracker page at: https://security-tracker.debian.org/tracker/qemu

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9034 advisory.

    - Document CVE-2020-25723 as fixed (Mark Kanda)  [Orabug: 32222397]  {CVE-2020-25084} {CVE-2020-25723}
    - hw/net/e1000e: advance desc_offset in case of null descriptor (Prasad J Pandit)  [Orabug: 32217517]     {CVE-2020-28916}
    - libslirp: Update version to include CVE fixes (Mark Kanda)  [Orabug: 32208456] [Orabug: 32208462]     {CVE-2020-29129} {CVE-2020-29130}
    - Document CVE-2020-25624 as fixed (Mark Kanda)  [Orabug: 32212527]  {CVE-2020-25624} {CVE-2020-25625}
    - ati: check x y display parameter values (Prasad J Pandit)  [Orabug: 32108251]  {CVE-2020-27616}
    - hw: usb: hcd-ohci: check for processed TD before retire (Prasad J Pandit)  [Orabug: 31901690]     {CVE-2020-25625}
    - hw: usb: hcd-ohci: check len and frame_number variables (Prasad J Pandit)  [Orabug: 31901690]     {CVE-2020-25625}
    - hw: ehci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
    - hw: xhci: check return value of 'usb_packet_map' (Li Qiang)  [Orabug: 31901649]  {CVE-2020-25084}
    - usb: fix setup_len init (CVE-2020-14364) (Gerd Hoffmann)  [Orabug: 31848849]  {CVE-2020-14364}
    - Document CVE-2020-12829 and CVE-2020-14415 as fixed (Mark Kanda)  [Orabug: 31855502] [Orabug: 31855427]     {CVE-2020-12829} {CVE-2020-14415}
    - hw/net/xgmac: Fix buffer overflow in xgmac_enet_send() (Mauro Matteo Cascella)  [Orabug: 31667649]     {CVE-2020-15863}
    - hw/net/net_tx_pkt: fix assertion failure in net_tx_pkt_add_raw_fragment() (Mauro Matteo Cascella)     [Orabug: 31737809]  {CVE-2020-16092}
    - hw/sd/sdcard: Do not switch to ReceivingData if address is invalid (Philippe Mathieu-Daude)  [Orabug:
    31414336]  {CVE-2020-13253}
    - hw/sd/sdcard: Do not allow invalid SD card sizes (Philippe Mathieu-Daude)  [Orabug: 31414336]     {CVE-2020-13253}
    - libslirp: Update to v4.3.1 to fix CVE-2020-10756 (Karl Heubaum)  [Orabug: 31604999]  {CVE-2020-10756}
    - Document CVEs as fixed 2/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-18043} {CVE-2018-10839}     {CVE-2018-11806} {CVE-2018-12617} {CVE-2018-15746} {CVE-2018-16847} {CVE-2018-16867} {CVE-2018-17958}     {CVE-2018-17962} {CVE-2018-17963} {CVE-2018-18849} {CVE-2018-19364} {CVE-2018-19489} {CVE-2018-3639}     {CVE-2018-5683} {CVE-2018-7550} {CVE-2018-7858} {CVE-2019-12068} {CVE-2019-15034} {CVE-2019-15890}     {CVE-2019-20382} {CVE-2020-10702} {CVE-2020-10761} {CVE-2020-11102} {CVE-2020-11869} {CVE-2020-13361}     {CVE-2020-13765} {CVE-2020-13800} {CVE-2020-1711} {CVE-2020-1983} {CVE-2020-8608}
    - Document CVEs as fixed 1/2 (Karl Heubaum)  [Orabug: 30618035]  {CVE-2017-10806} {CVE-2017-11334}     {CVE-2017-12809} {CVE-2017-13672} {CVE-2017-13673} {CVE-2017-13711} {CVE-2017-14167} {CVE-2017-15038}     {CVE-2017-15119} {CVE-2017-15124} {CVE-2017-15268} {CVE-2017-15289} {CVE-2017-16845} {CVE-2017-17381}     {CVE-2017-18030} {CVE-2017-2630} {CVE-2017-2633} {CVE-2017-5715} {CVE-2017-5753} {CVE-2017-5754}     {CVE-2017-5931} {CVE-2017-6058} {CVE-2017-7471} {CVE-2017-7493} {CVE-2017-8112} {CVE-2017-8309}     {CVE-2017-8379} {CVE-2017-8380} {CVE-2017-9503} {CVE-2017-9524} {CVE-2018-12126} {CVE-2018-12127}     {CVE-2018-12130} {CVE-2018-16872} {CVE-2018-20123} {CVE-2018-20124} {CVE-2018-20125} {CVE-2018-20126}     {CVE-2018-20191} {CVE-2018-20216} {CVE-2018-20815} {CVE-2019-11091} {CVE-2019-12155} {CVE-2019-14378}     {CVE-2019-3812} {CVE-2019-5008} {CVE-2019-6501} {CVE-2019-6778} {CVE-2019-8934} {CVE-2019-9824}
    - exec: set map length to zero when returning NULL (Prasad J Pandit)  [Orabug: 31439733]  {CVE-2020-13659}
    - megasas: use unsigned type for reply_queue_head and check index (Prasad J Pandit)  [Orabug: 31414338]     {CVE-2020-13362}
    - memory: Revert 'memory: accept mismatching sizes in memory_region_access_valid' (Michael S. Tsirkin)     [Orabug: 31439736] [Orabug: 31452202]  {CVE-2020-13754} {CVE-2020-13791}
    - Document CVE-2020-13765 as fixed (Karl Heubaum)  [Orabug: 31463250]  {CVE-2020-13765}
    - ati-vga: check mm_index before recursive call (CVE-2020-13800) (Prasad J Pandit)  [Orabug: 31452206]     {CVE-2020-13800}
    - es1370: check total frame count against current frame (Prasad J Pandit)  [Orabug: 31463235]     {CVE-2020-13361}
    - ati-vga: Fix checks in ati_2d_blt() to avoid crash (BALATON Zoltan)  [Orabug: 31238432]     {CVE-2020-11869}
    - libslirp: Update to stable-4.2 to fix CVE-2020-1983 (Karl Heubaum)  [Orabug: 31241227]  {CVE-2020-1983}
    - Document CVEs as fixed (Karl Heubaum)   {CVE-2019-12068} {CVE-2019-15034}
    - libslirp: Update to version 4.2.0 to fix CVEs (Karl Heubaum)  [Orabug: 30274592] [Orabug: 30869830]     {CVE-2019-15890} {CVE-2020-8608}
    - vnc: fix memory leak when vnc disconnect (Li Qiang)  [Orabug: 30996427]  {CVE-2019-20382}
    - iscsi: Cap block count from GET LBA STATUS (CVE-2020-1711) (Felipe Franciosi)  [Orabug: 31124035]     {CVE-2020-1711}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4650-1 advisory.

    Alexander Bulekov discovered that QEMU incorrectly handled SDHCI device emulation. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute     arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would     be isolated by the libvirt AppArmor profile.

    (CVE-2020-17380)

    Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled USB device     emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial     of service. (CVE-2020-25084)

    Sergej Schumilo, Cornelius Aschermann, and Simon Wrner discovered that QEMU incorrectly handled SDHCI     device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a     denial of service. (CVE-2020-25085)

    Gaoning Pan, Yongkang Jia, and Yi Ren discovered that QEMU incorrectly handled USB device emulation. An     attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2020-25624)

    It was discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest could     use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2020-25625)

    Cheolwoo Myung discovered that QEMU incorrectly handled USB device emulation. An attacker inside the guest     could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-25723)

    Gaoning Pan discovered that QEMU incorrectly handled ATI graphics device emulation. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only     affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-27616)

    Gaoning Pan discovered that QEMU incorrectly handled networking. An attacker inside the guest could use     this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2020-27617)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202320	RHEL 8 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
202315	RHEL 7 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
202314	RHEL 6 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	low
196182	RHEL 8 : qemu (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
184250	F5 Networks BIG-IP : QEMU vulnerability (K41301038)	Nessus	F5 Networks Local Security Checks	low
164678	Debian DLA-3099-1 : qemu - LTS security update	Nessus	Debian Local Security Checks	high
159876	EulerOS Virtualization 2.10.0 : qemu (EulerOS-SA-2022-1418)	Nessus	Huawei Local Security Checks	high
159867	EulerOS Virtualization 2.10.1 : qemu (EulerOS-SA-2022-1392)	Nessus	Huawei Local Security Checks	high
151564	EulerOS Virtualization 2.9.1 : qemu (EulerOS-SA-2021-2192)	Nessus	Huawei Local Security Checks	high
151557	EulerOS Virtualization 2.9.0 : qemu (EulerOS-SA-2021-2211)	Nessus	Huawei Local Security Checks	high
151383	EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2021-2166)	Nessus	Huawei Local Security Checks	critical
151333	EulerOS Virtualization for ARM 64 3.0.2.0 : qemu-kvm (EulerOS-SA-2021-2125)	Nessus	Huawei Local Security Checks	medium
150537	SUSE SLES11 Security Update : kvm (SUSE-SU-2021:14704-1)	Nessus	SuSE Local Security Checks	high
149640	openSUSE Security Update : qemu (openSUSE-2021-600)	Nessus	SuSE Local Security Checks	medium
148966	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1305-1)	Nessus	SuSE Local Security Checks	high
148761	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1241-1)	Nessus	SuSE Local Security Checks	high
148758	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1240-1)	Nessus	SuSE Local Security Checks	high
148757	SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1244-1)	Nessus	SuSE Local Security Checks	high
148755	SUSE SLED15 / SLES15 Security Update : qemu (SUSE-SU-2021:1243-1)	Nessus	SuSE Local Security Checks	medium
148752	SUSE SLES15 Security Update : qemu (SUSE-SU-2021:1245-1)	Nessus	SuSE Local Security Checks	high
148751	SUSE SLES12 Security Update : qemu (SUSE-SU-2021:1242-1)	Nessus	SuSE Local Security Checks	high
146609	Debian DLA-2560-1 : qemu security update	Nessus	Debian Local Security Checks	high
146269	Oracle Linux 7 : qemu (ELSA-2021-9034)	Nessus	Oracle Linux Local Security Checks	medium
143376	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-4650-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2020-25084

low

Tenable Plugins

high

high

low

high

low

high

high

high

high

high

critical

medium

high

medium

high

high

high

high

medium

high

high

high

medium

medium