According to the versions of the qemu package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a     crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading     to a use-after-free condition. (CVE-2022-1050)

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

  - A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not     prohibit opening special files on the host side, potentially allowing a malicious client to escape from     the exported 9p tree by creating and opening a device file in the shared folder. (CVE-2023-2861)

  - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
    (CVE-2023-3180)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate     the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.

  - A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-e5a35f7197 advisory.

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - QEMU: local privilege escalation via the QEMU Guest Agent on Windows (CVE-2023-0664)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-371519fd09 advisory.

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-68df3f4b02 advisory.

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

  - A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks     whether the current number of connections crosses a certain threshold and if so, cleans up the previous     connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the     connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated     client to cause a denial of service. (CVE-2023-3354)

  - A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit     condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the     `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard     to the VNC server to trigger a denial of service. (CVE-2023-3255)

  - A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in     virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in     virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
    (CVE-2023-3180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12368 advisory.

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

  - An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12342 advisory.

  - A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to     manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges     on the system. (CVE-2023-0664)

  - An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()     function does not check the size of the structure pointed to by the guest physical address, potentially     reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to     crash the QEMU process on the host causing a denial of service condition. (CVE-2022-4144)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
189011	EulerOS 2.0 SP9 : qemu (EulerOS-SA-2023-2887)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	high
177307	QEMU < 8.0.0 Multiple Vulnerabilites (CVE-2023-0664)	Nessus	Windows	6/14/2023	8/3/2023	high
175758	Fedora 38 : qemu (2023-e5a35f7197)	Nessus	Fedora Local Security Checks	5/16/2023	8/3/2023	high
199336	RHEL 8 : virtio-win (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
173478	Fedora 37 : qemu (2023-371519fd09)	Nessus	Fedora Local Security Checks	3/28/2023	4/29/2024	high
180225	Fedora 38 : qemu (2023-68df3f4b02)	Nessus	Fedora Local Security Checks	8/29/2023	4/29/2024	high
189008	EulerOS 2.0 SP9 : qemu (EulerOS-SA-2023-2906)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	high
176634	Oracle Linux 7 : qemu (ELSA-2023-12368)	Nessus	Oracle Linux Local Security Checks	6/2/2023	9/28/2023	high
180935	Oracle Linux 8 : virt:kvm_utils (ELSA-2023-12342)	Nessus	Oracle Linux Local Security Checks	9/7/2023	9/7/2023	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high