The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3586 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * QEMU command 'transaction': Bitmap already exists: libvirt-tmp-activewrite  (BZ#1861681)

    * qemu-img convert uses possibly slow pre-zeroing on block storage (BZ#1861682)

    * from time to time virsh net-dhcp-leases <net> does not show all leases (BZ#1868271)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free memory issue was found to occur in the     libvirt API, in versions before 6.8.0, responsible for     requesting information about network interfaces of a     running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting     to the read-write socket with limited ACL permissions     could use this flaw to crash the libvirt daemon,     resulting in a denial of service, or potentially     escalate their privileges on the system. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25637)

  - A flaw was found in libvirt, where it leaked a file     descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged     operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or     process to perform operations outside of their standard     permissions, potentially causing serious damage to the     host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-14339)

  - An issue was discovered in qemuDomainGetStatsIOThread     in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the     virDomainListGetStats libvirt API that is responsible     for retrieving domain statistics when managing QEMU     guests. This flaw allows unprivileged users with a     read-only connection to cause a memory leak in the     domstats command, resulting in a potential denial of     service.(CVE-2020-12430)

  - An information disclosure vulnerability was found in     libvirt. HTTP cookies used to access network-based     disks were saved in the XML dump of the guest domain.
    This flaw allows an attacker to access potentially     sensitive information in the domain configuration via     the `dumpxml` command.(CVE-2020-14301)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4676 advisory.

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a     guest agent, which allows attackers to cause a denial of service (API blockage). (CVE-2019-20485)

  - A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows     crafted packets to cause a denial of service. (CVE-2020-1983)

  - A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0,     and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this     flaw affects storage pools created without a target path such as network-based pools like gluster and RBD.
    Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon,     resulting in a potential denial of service. (CVE-2020-10703)

  - An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used     to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker     to access potentially sensitive information in the domain configuration via the `dumpxml` command.
    (CVE-2020-14301)

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-14339)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

spec: Use a functional requires instead of explicit version requires for the new memory-related libxl APIs - bsc#1167007

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680674 advisory.

    A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
140110	RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2020:3586)	Nessus	Red Hat Local Security Checks	2020/9/1	2024/11/7	high
147481	EulerOS Virtualization 2.9.1 : libvirt (EulerOS-SA-2021-1631)	Nessus	Huawei Local Security Checks	2021/3/10	2022/5/10	high
180926	Oracle Linux 8 : virt:ol / and / virt-devel:rhel (ELSA-2020-4676)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/11/1	high
223324	Linux Distros Unpatched Vulnerability : CVE-2020-14339	Nessus	Misc.	2025/3/4	2026/8/6	high
139594	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:2233-1)	Nessus	SuSE Local Security Checks	2020/8/14	2024/2/26	high
139656	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2237-1)	Nessus	SuSE Local Security Checks	2020/8/18	2024/2/26	high
267475	Unity Linux 20.1070e Security Update: libvirt (UTSA-2025-680674)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high

検出

プラグインの検索

high

high

high

high

high

high

high