The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3635-1 advisory.

    Security issues fixed:

    - Fix heap use-after-free in virtio_net_receive_rcu (bsc#1189938, CVE-2021-3748)
    - Fix out-of-bounds write in UAS (USB Attached SCSI) device emulation (bsc#1189702, CVE-2021-3713)
    - usbredir: free call on invalid pointer in bufp_alloc (bsc#1189145, CVE-2021-3682)
    - NULL pointer dereference in ESP (bsc#1180433, CVE-2020-35504) (bsc#1180434, CVE-2020-35505)     (bsc#1180435, CVE-2020-35506)
    - NULL pointer dereference issue in megasas-gen2 host bus adapter (bsc#1180432, CVE-2020-35503)
    - eepro100: stack overflow via infinite recursion (bsc#1182651, CVE-2021-20255)
    - usb: unbounded stack allocation in usbredir (bsc#1186012, CVE-2021-3527)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3605-1 advisory.

  - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions     prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-     bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this     flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the     host. (CVE-2021-3713)

  - QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu (CVE-2021-3748)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2753 advisory.

  - A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a     single, large transfer request, to reduce the overhead and improve performance. The combined size of the     bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper     validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the     array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a     denial of service. (CVE-2021-3527)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the bootp_input() function and could occur while processing a udp packet that is smaller than     the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of     uninitialized heap memory from the host. The highest threat from this vulnerability is to data     confidentiality. This flaw affects libslirp versions prior to 4.6.0. (CVE-2021-3592)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the udp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0. (CVE-2021-3594)

  - An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw     exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the     size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory     disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw     affects libslirp versions prior to 4.6.0. (CVE-2021-3595)

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions     prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-     bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this     flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the     host. (CVE-2021-3713)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5307-1 advisory.

    Gaoning Pan discovered that QEMU incorrectly handled the floppy disk emulator. An attacker inside the     guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20196)

    Gaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly handled certain values. An attacker     inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service.
    (CVE-2021-20203)

    It was discovered that the QEMU vhost-user GPU device contained several security issues. An attacker     inside the guest could use these issues to cause QEMU to crash, resulting in a denial of service, leak     sensitive information, or possibly execute arbitrary code. This issue only affected Ubuntu 21.10.
    (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)

    It was discovered that QEMU incorrectly handled bulk transfers from SPICE clients. A remote attacker could     use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2021-3682)

    It was discovered that the QEMU UAS device emulation incorrectly handled certain stream numbers. An     attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 21.10. (CVE-2021-3713)

    It was discovered that the QEMU virtio-net device incorrectly handled certain buffer addresses. An     attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service,     or possibly execute arbitrary code.

    (CVE-2021-3748)

    It was discovered that the QEMU SCSI device emulation incorrectly handled certain MODE SELECT commands. An     attacker inside the guest could possibly use this issue to cause QEMU to crash, resulting in a denial of     service. (CVE-2021-3930)

    It was discovered that the QEMU ACPI logic incorrectly handled certain values. An attacker inside the     guest could possibly use this issue to cause QEMU to crash, resulting in a denial of service. This issue     only affected Ubuntu 21.10. (CVE-2021-4158)

    Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU virtiofsd device incorrectly     handled permissions when creating files. An attacker inside the guest could use this issue to create files     inside the directory shared by virtiofs with unintended permissions, possibly allowing privilege     escalation. This issue only affected Ubuntu 21.10. (CVE-2022-0358)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has qemu packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs     when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A     malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata,     resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the     host. (CVE-2021-3682)

  - In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2,     and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter     emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode     is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
    (CVE-2019-12068)

  - libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. (CVE-2019-15890)

  - An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before     5.2.0. This issue occurs while processing USB packets from a guest when USBDevice 'setup_len' exceeds its     'data_buf[4096]' in the do_token_in, do_token_out routines. This flaw allows a guest user to crash the     QEMU process, resulting in a denial of service, or the potential execution of arbitrary code with the     privileges of the QEMU process on the host. (CVE-2020-14364)

  - An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions     2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical     Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the     QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of     the QEMU process on the host. (CVE-2020-1711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3099 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3099-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     September 05, 2022                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : qemu     Version        : 1:3.1+dfsg-8+deb10u9     CVE ID         : CVE-2020-13253 CVE-2020-15469 CVE-2020-15859 CVE-2020-25084                      CVE-2020-25085 CVE-2020-25624 CVE-2020-25625 CVE-2020-25723                      CVE-2020-27617 CVE-2020-27821 CVE-2020-28916 CVE-2020-29129                      CVE-2020-29443 CVE-2020-35504 CVE-2020-35505 CVE-2021-3392                      CVE-2021-3416 CVE-2021-3507 CVE-2021-3527 CVE-2021-3582                      CVE-2021-3607 CVE-2021-3608 CVE-2021-3682 CVE-2021-3713                      CVE-2021-3748 CVE-2021-3930 CVE-2021-4206 CVE-2021-4207                      CVE-2021-20181 CVE-2021-20196 CVE-2021-20203 CVE-2021-20221                      CVE-2021-20257 CVE-2022-26354 CVE-2022-35414

    Multiple security issues were discovered in QEMU, a fast processor     emulator, which could result in denial of service or the the execution     of arbitrary code.

    For Debian 10 buster, these problems have been fixed in version     1:3.1+dfsg-8+deb10u9.

    We recommend that you upgrade your qemu packages.

    For the detailed security status of qemu please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/qemu

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
155004	SUSE SLES12: qemu / qemu-arm / qemu-block-curl / qemu-block-iscsi / etc (SUSE-SU-2021:3635-1)	Nessus	SuSE Local Security Checks	2021/11/10	2026/6/25	high
154892	openSUSE 15 Security Update : qemu (openSUSE-SU-2021:3605-1)	Nessus	SuSE Local Security Checks	2021/11/4	2023/1/10	high
152982	Debian DLA-2753-1 : qemu - LTS security update	Nessus	Debian Local Security Checks	2021/9/3	2021/9/3	high
158457	Ubuntu 18.04 LTS / 20.04 LTS : QEMU vulnerabilities (USN-5307-1)	Nessus	Ubuntu Local Security Checks	2022/2/28	2025/9/3	high
301223	NewStart CGSL MAIN 6.06 (SP) : qemu Multiple Vulnerabilities (NS-SA-2026-0014)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/6	high
164678	Debian dla-3099 : qemu - security update	Nessus	Debian Local Security Checks	2022/9/5	2025/1/22	high

検出

プラグインの検索

high

high

high

high

high

high