The remote host is affected by the vulnerability described in GLSA-202101-22 (libvirt: Unintended access to /dev/mapper/control)

    A file descriptor for /dev/mapper/control was insufficiently protected.
  Impact :

    A local attacker may be able to escalate to root privileges.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4676 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution for Linux on numerous hardware     platforms. The virt:rhel module contains packages which provide user-space components used to run virtual     machines using KVM. The packages also provide APIs for managing and interacting with the virtualized     systems.

    The following packages have been upgraded to a later upstream version: hivex (1.3.18), libguestfs     (1.40.2), libguestfs-winsupport (8.2), libvirt (6.0.0), libvirt-dbus (1.3.0), libvirt-python (6.0.0),     nbdkit (1.16.2), perl-Sys-Virt (6.0.0), qemu-kvm (4.2.0), seabios (1.13.0), SLOF (20191022). (BZ#1810193,     BZ#1844296)

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: Slirp: use-after-free during packet reassembly (CVE-2019-15890)

    * libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent (CVE-2019-20485)

    * QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

    * libvirt: Potential denial of service via active pool without target path (CVE-2020-10703)

    * libvirt: leak of sensitive cookie information via dumpxml (CVE-2020-14301)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libvirt packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A double free memory issue was found to occur in the     libvirt API, in versions before 6.8.0, responsible for     requesting information about network interfaces of a     running QEMU domain. This flaw affects the polkit     access control driver. Specifically, clients connecting     to the read-write socket with limited ACL permissions     could use this flaw to crash the libvirt daemon,     resulting in a denial of service, or potentially     escalate their privileges on the system. The highest     threat from this vulnerability is to data     confidentiality and integrity as well as system     availability.(CVE-2020-25637)

  - A flaw was found in libvirt, where it leaked a file     descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged     operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or     process to perform operations outside of their standard     permissions, potentially causing serious damage to the     host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well     as system availability.(CVE-2020-14339)

  - An issue was discovered in qemuDomainGetStatsIOThread     in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x     before 6.1.0. A memory leak was found in the     virDomainListGetStats libvirt API that is responsible     for retrieving domain statistics when managing QEMU     guests. This flaw allows unprivileged users with a     read-only connection to cause a memory leak in the     domstats command, resulting in a potential denial of     service.(CVE-2020-12430)

  - An information disclosure vulnerability was found in     libvirt. HTTP cookies used to access network-based     disks were saved in the XML dump of the guest domain.
    This flaw allows an attacker to access potentially     sensitive information in the domain configuration via     the `dumpxml` command.(CVE-2020-14301)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3586 advisory.

    The Advanced Virtualization module provides the user-space component for running virtual machines that use     KVM in environments managed by Red Hat products.

    Security Fix(es):

    * libvirt: leak of /dev/mapper/control into QEMU guests (CVE-2020-14339)

    * QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * QEMU command 'transaction': Bitmap already exists: libvirt-tmp-activewrite  (BZ#1861681)

    * qemu-img convert uses possibly slow pre-zeroing on block storage (BZ#1861682)

    * from time to time virsh net-dhcp-leases <net> does not show all leases (BZ#1868271)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libvirt fixes the following issues :

CVE-2020-14339: Don't leak /dev/mapper/control into QEMU. Use ioctl's to obtain the dependency tree of disks and drop use of libdevmapper. - bsc#1161883, bsc#1174458

qemu: Setup emulator thread and cpuset.mems before exec - bsc#1171946

libxl: Normalize MAC address in device conf on netdev hotplug - bsc#1172052

spec: Use a functional requires instead of explicit version requires for the new memory-related libxl APIs - bsc#1167007

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-680674 advisory.

    A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU     process. This file descriptor allows for privileged operations to happen against the device-mapper on the     host. This flaw allows a malicious guest user or process to perform operations outside of their standard     permissions, potentially causing serious damage to the host operating system. The highest threat from this     vulnerability is to confidentiality, integrity, as well as system availability.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
145425	GLSA-202101-22 : libvirt: Unintended access to /dev/mapper/control	Nessus	Gentoo Local Security Checks	2021/1/26	2024/1/26	high
142449	RHEL 8 : virt:rhel and virt-devel:rhel (RHSA-2020:4676)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/15	high
147481	EulerOS Virtualization 2.9.1 : libvirt (EulerOS-SA-2021-1631)	Nessus	Huawei Local Security Checks	2021/3/10	2022/5/10	high
140110	RHEL 8 : virt:8.2 and virt-devel:8.2 (RHSA-2020:3586)	Nessus	Red Hat Local Security Checks	2020/9/1	2024/11/7	high
139594	SUSE SLES12 Security Update : libvirt (SUSE-SU-2020:2233-1)	Nessus	SuSE Local Security Checks	2020/8/14	2024/2/26	high
139656	SUSE SLED15 / SLES15 Security Update : libvirt (SUSE-SU-2020:2237-1)	Nessus	SuSE Local Security Checks	2020/8/18	2024/2/26	high
267475	Unity Linux 20.1070e Security Update: libvirt (UTSA-2025-680674)	Nessus	Unity Linux Local Security Checks	2025/10/7	2025/10/10	high

検出

プラグインの検索

high

high

high

high

high

high

high