A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - QEMU: usbredir: free() call on invalid pointer in bufp_alloc() (CVE-2021-3682)

  - qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from     bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
    (CVE-2019-13164)

  - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer     dereference. (CVE-2020-15469)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12407 advisory.

    - ui/clipboard: add asserts for update and request (Fiona Ebner) [Orabug: 36323175] {CVE-2023-6683}
    - ui/clipboard: mark type as not available when there is no data (Fiona Ebner) [Orabug: 36323175]     {CVE-2023-6683}
    - virtio-net: correctly copy vnet header when flushing TX (Jason Wang) [Orabug: 36154459] {CVE-2023-6693}
    - esp: restrict non-DMA transfer length to that of available data (Mark Cave-Ayland) [Orabug: 36322141]     {CVE-2024-24474}
    - net: Update MemReentrancyGuard for NIC (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
    - net: Provide MemReentrancyGuard * to qemu_new_nic() (Akihiko Odaki) [Orabug: 35644197] {CVE-2023-3019}
    - lsi53c895a: disable reentrancy detection for MMIO region, too (Thomas Huth) [Orabug: 33774027]     {CVE-2021-3750}
    - memory: stricter checks prior to unsetting engaged_in_io (Alexander Bulekov) [Orabug: 33774027]     {CVE-2021-3750}
    - async: avoid use-after-free on re-entrancy guard (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
    - apic: disable reentrancy detection for apic-msi (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
    - raven: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
    - bcm2835_property: disable reentrancy detection for iomem (Alexander Bulekov) [Orabug: 33774027]     {CVE-2021-3750}
    - lsi53c895a: disable reentrancy detection for script RAM (Alexander Bulekov) [Orabug: 33774027]     {CVE-2021-3750}
    - hw: replace most qemu_bh_new calls with qemu_bh_new_guarded (Alexander Bulekov) [Orabug: 33774027]     {CVE-2021-3750}
    - checkpatch: add qemu_bh_new/aio_bh_new checks (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
    - async: Add an optional reentrancy guard to the BH API (Alexander Bulekov) [Orabug: 33774027]     {CVE-2021-3750}
    - memory: prevent dma-reentracy issues (Alexander Bulekov) [Orabug: 33774027] {CVE-2021-3750}
    - hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] (Thomas Huth) [Orabug:
    35808564] {CVE-2023-42467}
    - tests/qtest: ahci-test: add test exposing reset issue with pending callback (Fiona Ebner) [Orabug:
    35977245] {CVE-2023-5088}
    - hw/ide: reset: cancel async DMA operation before resetting state (Fiona Ebner) [Orabug: 35977245]     {CVE-2023-5088}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2962 advisory.

    - Fix CVE-2022-2211 Denial of Service in --key parameter       resolves: rhbz#2101280
    - Fixes: CVE-2022-40284
    - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,       CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789       resolves: rhbz#2127240 rhbz#2127248       (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)
    - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,       CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,       CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254       resolves: rhbz#2004490
    - Fix for CVE-2019-9755       (heap-based buffer overflow leads to local root privilege escalation)       resolves: rhbz#1698503
    - Fix CVE-2022-0485: Fail nbdcopy if NBD read or write fails       resolves: rhbz#2045718
    - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
    - Resolves: RHEL-19628       (CVE-2023-6683 virt:rhel/qemu-kvm: QEMU: VNC: NULL pointer dereference in qemu_clipboard_request()     [rhel-8])
    - Resolves: RHEL-19496       (CVE-2023-6693 virt:rhel/qemu-kvm: QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx()     [rhel-8])
    - Resolves: RHEL-15437       (CVE-2023-5088 virt:rhel/qemu-kvm: QEMU: improper IDE controller reset can lead to MBR overwrite     [rhel-8])
    - Resolves: RHEL-7309       (CVE-2023-3019 virt:rhel/qemu-kvm: QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest()     [rhel-8])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2962 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)

    * QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)

    * QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)

    * QEMU: virtio-net: stack buffer overflow in virtio_net_flush_tx() (CVE-2023-6693)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:2135 advisory.

  - A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in     QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a     denial of service. (CVE-2023-3019)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service. (CVE-2023-3255)

  - QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately. (CVE-2023-42467)

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2135 advisory.

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683)

  - QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately. (CVE-2023-42467)

  - A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in     QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a     denial of service. (CVE-2023-3019)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service. (CVE-2023-3255)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2135 advisory.

    Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm packages provide the user-space component for running virtual machines that     use KVM.

    Security Fix(es):

    * QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)

    * QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)

    * QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)

    * QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)

    * QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-12276 advisory.

  - A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing     TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and     VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables     allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory     and send it to the wire, causing an information leak. (CVE-2023-6693)

  - An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number     of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending specially     crafted data to the libvirt daemon, allowing an unprivileged client to perform a denial of service attack     by causing the libvirt daemon to crash. (CVE-2024-1441)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The     qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the     chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a     malicious authenticated VNC client to crash QEMU and trigger a denial of service. (CVE-2023-6683)

  - QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately. (CVE-2023-42467)

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

  - A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the     Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be     written to the controller's registers and trigger undesirable actions (such as reset) while the device is     still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could     use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or     potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects     QEMU versions before 7.0.0. (CVE-2021-3750)

  - A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in     QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a     denial of service. (CVE-2023-3019)

  - QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an     expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in     esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len. (CVE-2024-24474)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3759 advisory.

  - A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not     prohibit opening special files on the host side, potentially allowing a malicious client to escape from     the exported 9p tree by creating and opening a device file in the shared folder. (CVE-2023-2861)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6567-1 advisory.

  - An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of     the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process     on the host, resulting in a denial of service. (CVE-2020-14394)

  - An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary     code, escalate privileges, and cause a denial of service (DoS). (CVE-2020-24165)

  - A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious     guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service     condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU     versions prior to 7.0.0. (CVE-2021-3611)

  - An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in     the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for     the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the     host, resulting in a denial of service. (CVE-2021-3638)

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a     crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of     descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
    (CVE-2023-1544)

  - A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not     prohibit opening special files on the host side, potentially allowing a malicious client to escape from     the exported 9p tree by creating and opening a device file in the shared folder. (CVE-2023-2861)

  - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
    (CVE-2023-3180)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service. (CVE-2023-3255)

  - A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device     backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this     time window to trigger an assertion and cause a denial of service. (CVE-2023-3301)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

  - QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no     check for whether an endurance group is configured before checking whether Flexible Data Placement is     enabled. (CVE-2023-40360)

  - A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does     not validate an offset provided by the guest before computing a host heap pointer, which is used for     copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.
    (CVE-2023-4135)

  - QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because     scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the     guest immediately. (CVE-2023-42467)

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2336 advisory.

  - A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be     targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for     example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor     to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.
    (CVE-2023-5088)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
202320	RHEL 8 : qemu-kvm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
200094	Oracle Linux 9 : qemu-kvm (ELSA-2024-12407)	Nessus	Oracle Linux Local Security Checks	high
198009	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2024-2962)	Nessus	Oracle Linux Local Security Checks	high
197771	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2024:2962)	Nessus	Red Hat Local Security Checks	high
196971	Rocky Linux 9 : qemu-kvm (RLSA-2024:2135)	Nessus	Rocky Linux Local Security Checks	high
195037	Oracle Linux 9 : qemu-kvm (ELSA-2024-2135)	Nessus	Oracle Linux Local Security Checks	high
194756	RHEL 9 : qemu-kvm (RHSA-2024:2135)	Nessus	Red Hat Local Security Checks	high
193168	Oracle Linux 8 : virt:kvm_utils3 (ELSA-2024-12276)	Nessus	Oracle Linux Local Security Checks	high
191790	Debian dla-3759 : qemu - security update	Nessus	Debian Local Security Checks	high
187683	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : QEMU vulnerabilities (USN-6567-1)	Nessus	Ubuntu Local Security Checks	high
185791	Amazon Linux 2 : qemu (ALAS-2023-2336)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-5088

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high