Detections
Analytics
EulerOS Virtualization 3.0.2.2 : qemu-kvm (EulerOS-SA-2023-1289)
high Nessus Plugin ID 170819
Synopsis
The remote EulerOS Virtualization host is missing multiple security updates.Description
According to the versions of the qemu-kvm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :- A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability. (CVE-2021-20181)
- A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service. (CVE-2021-3527)
- A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host. (CVE-2021-3682)
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected qemu-kvm packages.See Also
Plugin Details
Severity: High
ID: 170819
File Name: EulerOS_SA-2023-1289.nasl
Version: 1.0
Type: local
Family: Huawei Local Security Checks
Published: 1/30/2023
Updated: 1/30/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: Medium
Base Score: 6.9
Temporal Score: 5.1
Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2021-20181
CVSS v3
Risk Factor: High
Base Score: 8.5
Temporal Score: 7.4
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS Score Source: CVE-2021-3682
Vulnerability Information
CPE: cpe:/o:huawei:euleros:uvp:3.0.2.2, p-cpe:/a:huawei:euleros:qemu-kvm-common, p-cpe:/a:huawei:euleros:qemu-kvm, p-cpe:/a:huawei:euleros:qemu-kvm-tools
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version
Exploit Ease: No known exploits are available
Patch Publication Date: 1/30/2023
Vulnerability Publication Date: 5/13/2021