This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the qemu-kvm-8.0.0-8.el9 build changelog.

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - memory corruption issues in read_erst_record and write_erst_record [rhel-9]) (CVE-2022-4172)

  - DMA reentrancy issue (incomplete fix for CVE-2021-3750) [rhel-9]) (CVE-2023-2680)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-6368 advisory.

    - Resolves: bz#2216504       (CVE-2023-3354 qemu-kvm: QEMU: VNC: improper I/O watch removal in TLS handshake can lead to remote     unauthenticated denial of service [rhel-9.3.0])
    - Resolves: RHEL-516       (CVE-2023-2680 qemu-kvm: QEMU: hcd-ehci: DMA reentrancy issue (incomplete fix for CVE-2021-3750)     [rhel-9])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6368 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    The following packages have been upgraded to a later upstream version: qemu-kvm (8.0.0). (BZ#2180898)

    Security Fix(es):

    * QEMU: hcd-ehci: DMA reentrancy issue (incomplete fix for CVE-2021-3750) (CVE-2023-2680)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
191424	CentOS 9 : qemu-kvm-8.0.0-8.el9	Nessus	CentOS Local Security Checks	high
185820	Oracle Linux 9 : qemu-kvm (ELSA-2023-6368)	Nessus	Oracle Linux Local Security Checks	high
185130	RHEL 9 : qemu-kvm (RHSA-2023:6368)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2023-2680

high

Tenable Plugins

high

high

high