ID CVE-2017-2620
Summary Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
References
Vulnerable Configurations
  • QEMU
    cpe:2.3:a:qemu:qemu
  • QEMU 0.1
    cpe:2.3:a:qemu:qemu:0.1
  • QEMU 0.1.0
    cpe:2.3:a:qemu:qemu:0.1.0
  • QEMU 0.1.1
    cpe:2.3:a:qemu:qemu:0.1.1
  • QEMU 0.1.2
    cpe:2.3:a:qemu:qemu:0.1.2
  • QEMU 0.1.3
    cpe:2.3:a:qemu:qemu:0.1.3
  • QEMU 0.1.4
    cpe:2.3:a:qemu:qemu:0.1.4
  • QEMU 0.1.5
    cpe:2.3:a:qemu:qemu:0.1.5
  • QEMU 0.1.6
    cpe:2.3:a:qemu:qemu:0.1.6
  • QEMU 0.2
    cpe:2.3:a:qemu:qemu:0.2
  • QEMU 0.2.0
    cpe:2.3:a:qemu:qemu:0.2.0
  • QEMU 0.3
    cpe:2.3:a:qemu:qemu:0.3
  • QEMU 0.3.0
    cpe:2.3:a:qemu:qemu:0.3.0
  • QEMU 0.4
    cpe:2.3:a:qemu:qemu:0.4
  • QEMU 0.4.0
    cpe:2.3:a:qemu:qemu:0.4.0
  • QEMU 0.4.1
    cpe:2.3:a:qemu:qemu:0.4.1
  • QEMU 0.4.2
    cpe:2.3:a:qemu:qemu:0.4.2
  • QEMU 0.4.3
    cpe:2.3:a:qemu:qemu:0.4.3
  • QEMU 0.4.4
    cpe:2.3:a:qemu:qemu:0.4.4
  • QEMU 0.5.0
    cpe:2.3:a:qemu:qemu:0.5.0
  • QEMU 0.5.1
    cpe:2.3:a:qemu:qemu:0.5.1
  • QEMU 0.5.2
    cpe:2.3:a:qemu:qemu:0.5.2
  • QEMU 0.5.3
    cpe:2.3:a:qemu:qemu:0.5.3
  • QEMU 0.5.4
    cpe:2.3:a:qemu:qemu:0.5.4
  • QEMU 0.5.5
    cpe:2.3:a:qemu:qemu:0.5.5
  • QEMU 0.6.0
    cpe:2.3:a:qemu:qemu:0.6.0
  • QEMU 0.6.1
    cpe:2.3:a:qemu:qemu:0.6.1
  • QEMU 0.7.0
    cpe:2.3:a:qemu:qemu:0.7.0
  • QEMU 0.7.1
    cpe:2.3:a:qemu:qemu:0.7.1
  • QEMU 0.7.2
    cpe:2.3:a:qemu:qemu:0.7.2
  • QEMU 0.8.0
    cpe:2.3:a:qemu:qemu:0.8.0
  • QEMU 0.8.1
    cpe:2.3:a:qemu:qemu:0.8.1
  • QEMU 0.8.2
    cpe:2.3:a:qemu:qemu:0.8.2
  • QEMU 0.9.0
    cpe:2.3:a:qemu:qemu:0.9.0
  • QEMU 0.9.1
    cpe:2.3:a:qemu:qemu:0.9.1
  • QEMU 0.9.1-5
    cpe:2.3:a:qemu:qemu:0.9.1-5
  • QEMU 0.10.0
    cpe:2.3:a:qemu:qemu:0.10.0
  • QEMU 0.10.1
    cpe:2.3:a:qemu:qemu:0.10.1
  • QEMU 0.10.2
    cpe:2.3:a:qemu:qemu:0.10.2
  • QEMU 0.10.3
    cpe:2.3:a:qemu:qemu:0.10.3
  • QEMU 0.10.4
    cpe:2.3:a:qemu:qemu:0.10.4
  • QEMU 0.10.5
    cpe:2.3:a:qemu:qemu:0.10.5
  • QEMU 0.10.6
    cpe:2.3:a:qemu:qemu:0.10.6
  • QEMU 0.11.0
    cpe:2.3:a:qemu:qemu:0.11.0
  • QEMU 0.11.0-rc0
    cpe:2.3:a:qemu:qemu:0.11.0:rc0
  • QEMU 0.11.0 release candidate 1
    cpe:2.3:a:qemu:qemu:0.11.0:rc1
  • QEMU 0.11.0 release candidate 2
    cpe:2.3:a:qemu:qemu:0.11.0:rc2
  • QEMU 0.11.0-rc0
    cpe:2.3:a:qemu:qemu:0.11.0-rc0
  • QEMU 0.11.0-rc1
    cpe:2.3:a:qemu:qemu:0.11.0-rc1
  • QEMU 0.11.0-rc2
    cpe:2.3:a:qemu:qemu:0.11.0-rc2
  • QEMU 0.11.1
    cpe:2.3:a:qemu:qemu:0.11.1
  • QEMU 0.12.0
    cpe:2.3:a:qemu:qemu:0.12.0
  • QEMU 0.12.0 release candidate 1
    cpe:2.3:a:qemu:qemu:0.12.0:rc1
  • QEMU 0.12.0 release candidate 2
    cpe:2.3:a:qemu:qemu:0.12.0:rc2
  • QEMU 0.12.1
    cpe:2.3:a:qemu:qemu:0.12.1
  • QEMU 0.12.2
    cpe:2.3:a:qemu:qemu:0.12.2
  • QEMU 0.12.3
    cpe:2.3:a:qemu:qemu:0.12.3
  • QEMU 0.12.4
    cpe:2.3:a:qemu:qemu:0.12.4
  • QEMU 0.12.5
    cpe:2.3:a:qemu:qemu:0.12.5
  • QEMU 0.13.0
    cpe:2.3:a:qemu:qemu:0.13.0
  • QEMU 0.13.0 release candidate 0
    cpe:2.3:a:qemu:qemu:0.13.0:rc0
  • QEMU 0.13.0 release candidate 1
    cpe:2.3:a:qemu:qemu:0.13.0:rc1
  • QEMU 0.14.0
    cpe:2.3:a:qemu:qemu:0.14.0
  • QEMU 0.14.0 release candidate 0
    cpe:2.3:a:qemu:qemu:0.14.0:rc0
  • QEMU 0.14.0 release candidate 1
    cpe:2.3:a:qemu:qemu:0.14.0:rc1
  • QEMU 0.14.0 release candidate 2
    cpe:2.3:a:qemu:qemu:0.14.0:rc2
  • QEMU 0.14.1
    cpe:2.3:a:qemu:qemu:0.14.1
  • QEMU 0.15.0
    cpe:2.3:a:qemu:qemu:0.15.0
  • QEMU 0.15.0 release candidate 1
    cpe:2.3:a:qemu:qemu:0.15.0:rc1
  • QEMU 0.15.0 release candidate 2
    cpe:2.3:a:qemu:qemu:0.15.0:rc2
  • QEMU 0.15.1
    cpe:2.3:a:qemu:qemu:0.15.1
  • QEMU 0.15.2
    cpe:2.3:a:qemu:qemu:0.15.2
  • QEMU 1.0
    cpe:2.3:a:qemu:qemu:1.0
  • QEMU 1.0 release candidate 1
    cpe:2.3:a:qemu:qemu:1.0:rc1
  • QEMU 1.0 release candidate 2
    cpe:2.3:a:qemu:qemu:1.0:rc2
  • QEMU 1.0 release candidate 3
    cpe:2.3:a:qemu:qemu:1.0:rc3
  • QEMU 1.0 release candidate 4
    cpe:2.3:a:qemu:qemu:1.0:rc4
  • QEMU 1.0.1
    cpe:2.3:a:qemu:qemu:1.0.1
  • QEMU 1.1
    cpe:2.3:a:qemu:qemu:1.1
  • QEMU 1.1 release candidate 1
    cpe:2.3:a:qemu:qemu:1.1:rc1
  • QEMU 1.1 release candidate 2
    cpe:2.3:a:qemu:qemu:1.1:rc2
  • QEMU 1.1 release candidate 3
    cpe:2.3:a:qemu:qemu:1.1:rc3
  • QEMU 1.1 release candidate 4
    cpe:2.3:a:qemu:qemu:1.1:rc4
  • QEMU 1.1.0
    cpe:2.3:a:qemu:qemu:1.1.0
  • QEMU 1.1.1
    cpe:2.3:a:qemu:qemu:1.1.1
  • QEMU 1.1.2
    cpe:2.3:a:qemu:qemu:1.1.2
  • QEMU 1.2.0
    cpe:2.3:a:qemu:qemu:1.2.0
  • QEMU 1.2.1
    cpe:2.3:a:qemu:qemu:1.2.1
  • QEMU 1.2.2
    cpe:2.3:a:qemu:qemu:1.2.2
  • QEMU 1.3.0
    cpe:2.3:a:qemu:qemu:1.3.0
  • QEMU 1.3.1
    cpe:2.3:a:qemu:qemu:1.3.1
  • QEMU 1.4.0
    cpe:2.3:a:qemu:qemu:1.4.0
  • QEMU 1.4.1
    cpe:2.3:a:qemu:qemu:1.4.1
  • QEMU 1.4.2
    cpe:2.3:a:qemu:qemu:1.4.2
  • QEMU 1.5.0
    cpe:2.3:a:qemu:qemu:1.5.0
  • QEMU 1.5.0 release candidate 1
    cpe:2.3:a:qemu:qemu:1.5.0:rc1
  • QEMU 1.5.0 release candidate 2
    cpe:2.3:a:qemu:qemu:1.5.0:rc2
  • QEMU 1.5.0 release candidate 3
    cpe:2.3:a:qemu:qemu:1.5.0:rc3
  • QEMU 1.5.1
    cpe:2.3:a:qemu:qemu:1.5.1
  • QEMU 1.5.2
    cpe:2.3:a:qemu:qemu:1.5.2
  • QEMU 1.5.3
    cpe:2.3:a:qemu:qemu:1.5.3
  • QEMU 1.6.0
    cpe:2.3:a:qemu:qemu:1.6.0
  • QEMU 1.6.0 release candidate 1
    cpe:2.3:a:qemu:qemu:1.6.0:rc1
  • QEMU 1.6.0 release candidate 2
    cpe:2.3:a:qemu:qemu:1.6.0:rc2
  • QEMU 1.6.0 release candidate 3
    cpe:2.3:a:qemu:qemu:1.6.0:rc3
  • QEMU 1.6.1
    cpe:2.3:a:qemu:qemu:1.6.1
  • QEMU 1.6.2
    cpe:2.3:a:qemu:qemu:1.6.2
  • QEMU 1.7.0
    cpe:2.3:a:qemu:qemu:1.7.0
  • QEMU 1.7.1
    cpe:2.3:a:qemu:qemu:1.7.1
  • QEMU 1.7.2
    cpe:2.3:a:qemu:qemu:1.7.2
  • QEMU 2.0.0
    cpe:2.3:a:qemu:qemu:2.0.0
  • QEMU 2.0.0
    cpe:2.3:a:qemu:qemu:2.0.0
  • QEMU 2.0.0 release candidate 0
    cpe:2.3:a:qemu:qemu:2.0.0:rc0
  • QEMU 2.0.0 release candidate 1
    cpe:2.3:a:qemu:qemu:2.0.0:rc1
  • QEMU 2.0.0 release candidate 2
    cpe:2.3:a:qemu:qemu:2.0.0:rc2
  • QEMU 2.0.0 release candidate 3
    cpe:2.3:a:qemu:qemu:2.0.0:rc3
  • QEMU 2.0.1
    cpe:2.3:a:qemu:qemu:2.0.1
  • QEMU QEMU 2.0.2
    cpe:2.3:a:qemu:qemu:2.0.2
  • QEMU QEMU 2.1.0
    cpe:2.3:a:qemu:qemu:2.1.0
  • QEMU QEMU 2.1.0 release candidate 0
    cpe:2.3:a:qemu:qemu:2.1.0:rc0
  • QEMU QEMU 2.1.0 release candidate 1
    cpe:2.3:a:qemu:qemu:2.1.0:rc1
  • QEMU QEMU 2.1.0 release candidate 2
    cpe:2.3:a:qemu:qemu:2.1.0:rc2
  • QEMU QEMU 2.1.0 release candidate 3
    cpe:2.3:a:qemu:qemu:2.1.0:rc3
  • QEMU QEMU 2.1.0 release candidate 5
    cpe:2.3:a:qemu:qemu:2.1.0:rc5
  • QEMU QEMU 2.1.1
    cpe:2.3:a:qemu:qemu:2.1.1
  • QEMU QEMU 2.1.2
    cpe:2.3:a:qemu:qemu:2.1.2
  • QEMU 2.1.3
    cpe:2.3:a:qemu:qemu:2.1.3
  • QEMU 2.2.0
    cpe:2.3:a:qemu:qemu:2.2.0
  • QEMU 2.2.1
    cpe:2.3:a:qemu:qemu:2.2.1
  • QEMU 2.3.0
    cpe:2.3:a:qemu:qemu:2.3.0
  • QEMU 2.3.1
    cpe:2.3:a:qemu:qemu:2.3.1
  • QEMU 2.4.0
    cpe:2.3:a:qemu:qemu:2.4.0
  • QEMU 2.4.0.1
    cpe:2.3:a:qemu:qemu:2.4.0.1
  • QEMU 2.4.1
    cpe:2.3:a:qemu:qemu:2.4.1
  • QEMU 2.5.0
    cpe:2.3:a:qemu:qemu:2.5.0
  • QEMU 2.5.1
    cpe:2.3:a:qemu:qemu:2.5.1
  • QEMU 2.5.1.1
    cpe:2.3:a:qemu:qemu:2.5.1.1
  • QEMU 2.6.0
    cpe:2.3:a:qemu:qemu:2.6.0
  • QEMU 2.6.1
    cpe:2.3:a:qemu:qemu:2.6.1
  • QEMU 2.6.2
    cpe:2.3:a:qemu:qemu:2.6.2
  • QEMU 2.7.0
    cpe:2.3:a:qemu:qemu:2.7.0
  • QEMU 2.7.1
    cpe:2.3:a:qemu:qemu:2.7.1
  • Citrix XenServer 6.0.2
    cpe:2.3:a:citrix:xenserver:6.0.2
  • Citrix XenServer 6.2.0 Service Pack 1
    cpe:2.3:a:citrix:xenserver:6.2.0:sp1
  • Citrix XenServer 6.5 Service Pack 1
    cpe:2.3:a:citrix:xenserver:6.5:sp1
  • Citrix XenServer 7.0
    cpe:2.3:a:citrix:xenserver:7.0
  • Citrix XenServer 7.1
    cpe:2.3:a:citrix:xenserver:7.1
  • Red Hat OpenStack 5.0
    cpe:2.3:a:redhat:openstack:5.0
  • cpe:2.3:a:redhat:openstack:6.0
    cpe:2.3:a:redhat:openstack:6.0
  • Red Hat OpenStack 7.0
    cpe:2.3:a:redhat:openstack:7.0
  • cpe:2.3:a:redhat:openstack:8.0
    cpe:2.3:a:redhat:openstack:8.0
  • cpe:2.3:a:redhat:openstack:9.0
    cpe:2.3:a:redhat:openstack:9.0
  • cpe:2.3:a:redhat:openstack:10.0
    cpe:2.3:a:redhat:openstack:10.0
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Red Hat Enterprise Linux Desktop 6.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • Red Hat Enterprise Linux Server 6.0
    cpe:2.3:o:redhat:enterprise_linux_server:6.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Advanced mission critical Update Support (AUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3
  • Red Hat Enterprise Linux Server Advanced mission critical Update Support (AUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.3
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.4
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4
  • Red Hat Enterprise Linux Server Extended Update Support (EUS) 7.5
    cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5
  • Red Hat Enterprise Linux Workstation 6.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
  • Xen 4.7.1
    cpe:2.3:o:xen:xen:4.7.1
  • cpe:2.3:o:xen:xen:4.7.1:r1
    cpe:2.3:o:xen:xen:4.7.1:r1
  • cpe:2.3:o:xen:xen:4.7.1:r2
    cpe:2.3:o:xen:xen:4.7.1:r2
  • cpe:2.3:o:xen:xen:4.7.1:r3
    cpe:2.3:o:xen:xen:4.7.1:r3
  • cpe:2.3:o:xen:xen:4.7.1:r4
    cpe:2.3:o:xen:xen:4.7.1:r4
  • cpe:2.3:o:xen:xen:4.7.1:r5
    cpe:2.3:o:xen:xen:4.7.1:r5
  • cpe:2.3:o:xen:xen:4.7.1:r6
    cpe:2.3:o:xen:xen:4.7.1:r6
  • cpe:2.3:o:xen:xen:4.7.1:r7
    cpe:2.3:o:xen:xen:4.7.1:r7
CVSS
Base: 9.0
Impact:
Exploitability:
CWE CWE-787
CAPEC
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201703-07.NASL
    description The remote host is affected by the vulnerability described in GLSA-201703-07 (Xen: Privilege Escalation) In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check wethehr the specified memory region is safe. Impact : A local attacker could potentially execute arbitrary code with privileges of Xen (QEMU) process on the host, gain privileges on the host system, or cause a Denial of Service condition. Workaround : Running guests in Paravirtualization (PV) mode, or running guests in Hardware-assisted virtualizion (HVM) utilizing stub domains mitigate the issue. Running HVM guests with the device model in a stubdomain will mitigate the issue. Changing the video card emulation to stdvga (stdvga=1, vga=”stdvga”, in the xl domain configuration) will avoid the vulnerability.
    last seen 2019-02-21
    modified 2018-09-12
    plugin id 99014
    published 2017-03-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99014
    title GLSA-201703-07 : Xen: Privilege Escalation
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170301_QEMU_KVM_ON_SL6_X.NASL
    description Security Fix(es) : - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 97493
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97493
    title Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_8CBD9C08F8B911E6AE1B002590263BF5.NASL
    description The Xen Project reports : In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check whether the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97312
    published 2017-02-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97312
    title FreeBSD : xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe (8cbd9c08-f8b9-11e6-ae1b-002590263bf5)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-842.NASL
    description Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests. CVE-2017-2615 The Cirrus CLGD 54xx VGA Emulator in qemu-kvm is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially execute arbitrary code on the host with privileges of qemu-kvm process on the host. CVE-2017-2620 The Cirrus CLGD 54xx VGA Emulator in qemu-kvm is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially execute arbitrary code on the host with privileges of qemu-kvm process on the host. CVE-2017-5898 The CCID Card device emulator support is vulnerable to an integer overflow flaw. It could occur while passing message via command/responses packets to and from the host. A privileged user inside guest could use this flaw to crash the qemu-kvm process on the host resulting in a DoS. This issue does not affect the qemu-kvm binaries in Debian but we apply the patch to the sources to stay in sync with the qemu package. CVE-2017-5973 The USB xHCI controller emulator support in qemu-kvm is vulnerable to an infinite loop issue. It could occur while processing control transfer descriptors' sequence in xhci_kick_epctx. A privileged user inside guest could use this flaw to crash the qemu-kvm process resulting in a DoS. This update also updates the fix CVE-2016-9921 since it was too strict and broke certain guests. For Debian 7 'Wheezy', these problems have been fixed in version 1.1.2+dfsg-6+deb7u20. We recommend that you upgrade your qemu-kvm packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97439
    published 2017-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97439
    title Debian DLA-842-1 : qemu-kvm security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0350.NASL
    description An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-7 and RHEV 4.X RHEV-H and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) * An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). (CVE-2016-2857) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615 and Ling Liu (Qihoo 360 Inc.) for reporting CVE-2016-2857. Bug Fix(es) : * Prior to this update, after migrating a guest virtual machine on the little-endian variant of IBM Power Systems and resetting the guest, the guest boot process failed with a 'tcmalloc: large alloc' error message. This update fixes the bug, and the described problem no longer occurs. (BZ# 1420456) * The qemu-kvm-rhev package depends on the usbredir and libcacard packages. However, on the little-endian variant of IBM Power Systems, smartcard use is not supported and usbredir and libcacard are thus only available in the Optional channel. As a consequence, qemu-kvm-rhev was previously not installable on these systems if the Optional channel was not available for the user. This update removes usbredir and libcacard as dependencies of qemu-kvm-rhev on little-endian IBM Power Systems, and qemu-kvm-rhev can now be installed as expected in the described scenario. (BZ#1420428)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97488
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97488
    title RHEL 7 : qemu-kvm-rhev (RHSA-2017:0350)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201704-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201704-01 (QEMU: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in QEMU. Please review the CVE identifiers referenced below for details. Impact : Remote server can cause a crash in the client causing execution of arbitrary code, and a Denial of Service within the QEMU process. Remote or Local users within a guest QEMU environment can cause a Denial of Service condition of the QEMU guest process. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-09-12
    plugin id 99274
    published 2017-04-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99274
    title GLSA-201704-01 : QEMU: Multiple vulnerabilities
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0153.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0153 for details.
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 103830
    published 2017-10-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103830
    title OracleVM 3.4 : xen (OVMSA-2017-0153)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1270.NASL
    description Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation. For Debian 7 'Wheezy', these problems have been fixed in version 4.1.6.lts1-12. We recommend that you upgrade your xen packages. Please note that CVE-2017-15590 (XSA-237) will *not* be fixed in wheezy as the patches are too intrusive to backport. The vulnerability can be mitigated by not passing through physical devices to untrusted guests. More information can be found on https://xenbits.xen.org/xsa/advisory-237.html NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 106633
    published 2018-02-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=106633
    title Debian DLA-1270-1 : xen security update
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0571-1.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004). - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169 The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97433
    published 2017-02-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97433
    title SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0571-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-266AB882CD.NASL
    description cirrus_bitblt_cputovideo does not check if memory region is safe [XSA-209, CVE-2017-2620] (#1425420) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97451
    published 2017-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97451
    title Fedora 25 : xen (2017-266ab882cd)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-1607A3A78E.NASL
    description cirrus_bitblt_cputovideo does not check if memory region is safe [XSA-209, CVE-2017-2620] (#1425420) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97616
    published 2017-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97616
    title Fedora 24 : xen (2017-1607a3a78e)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0352.NASL
    description From Red Hat Security Advisory 2017:0352 : An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97485
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97485
    title Oracle Linux 6 : qemu-kvm (ELSA-2017-0352)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2017-0352.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-20
    plugin id 101430
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101430
    title Virtuozzo 6 : qemu-guest-agent / qemu-img / qemu-kvm / etc (VZLSA-2017-0352)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0248.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 111992
    published 2018-08-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111992
    title OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0095.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0095 for details.
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 99976
    published 2017-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99976
    title OracleVM 3.3 : xen (OVMSA-2017-0095)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0454.NASL
    description From Red Hat Security Advisory 2017:0454 : An update for kvm is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97593
    published 2017-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97593
    title Oracle Linux 5 : kvm (ELSA-2017-0454)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-3084-1.NASL
    description This update for kvm fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9602: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper link following issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1020427) - CVE-2016-9603: A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028656) - CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt (bsc#1046636) - CVE-2017-10806: Stack-based buffer overflow allowed local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages (bsc#1047674) - CVE-2017-11334: The address_space_write_continue function allowed local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area (bsc#1048902) - CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP options string (bsc#1049381) - CVE-2017-13672: The VGA display emulator support allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update (bsc#1056334) - CVE-2017-14167: Integer overflow in the load_multiboot function allowed local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write (bsc#1057585) - CVE-2017-15038: Race condition in the v9fs_xattrwalk function local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes (bsc#1062069) - CVE-2017-15289: The mode4and5 write functions allowed local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation (bsc#1063122) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021741) - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025109) - CVE-2017-6505: The ohci_service_ed_list function allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028184) - CVE-2017-7471: The VirtFS host directory sharing via Plan 9 File System(9pfs) support was vulnerable to an improper access control issue which allowed a privileged user inside guest to access host file system beyond the shared folder and potentially escalating their privileges on a host (bsc#1034866) - CVE-2017-7493: The VirtFS, host directory sharing via Plan 9 File System(9pfs) support, was vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could have used this flaw to escalate their privileges inside guest (bsc#1039495) - CVE-2017-7718: hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions (bsc#1034908) - CVE-2017-7980: An out-of-bounds r/w access issues in the Cirrus CLGD 54xx VGA Emulator support allowed privileged user inside guest to use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code on a host with privileges of Qemu process on the host (bsc#1035406) - CVE-2017-8086: A memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c allowed local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the orig_value variable (bsc#1035950) - CVE-2017-8309: Memory leak in the audio/audio.c allowed remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture (bsc#1037242) - CVE-2017-9330: USB OHCI Emulation in qemu allowed local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value (bsc#1042159) - CVE-2017-9373: The IDE AHCI Emulation support was vulnerable to a host memory leakage issue, which allowed a privileged user inside guest to leak host memory resulting in DoS (bsc#1042801) - CVE-2017-9375: The USB xHCI controller emulator support was vulnerable to an infinite recursive call loop issue, which allowed a privileged user inside guest to crash the Qemu process resulting in DoS (bsc#1042800) - CVE-2017-9503: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a NULL pointer dereference issue which allowed a privileged user inside guest to crash the Qemu process on the host resulting in DoS (bsc#1043296) - Fix privilege escalation in TCG mode (bsc#1030624) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 104780
    published 2017-11-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=104780
    title SUSE SLES11 Security Update : kvm (SUSE-SU-2017:3084-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0352.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97490
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97490
    title RHEL 6 : qemu-kvm (RHSA-2017:0352)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0582-1.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025188) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1024186) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805). - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1022627) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014490) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97467
    published 2017-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97467
    title SUSE SLES12 Security Update : xen (SUSE-SU-2017:0582-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-349.NASL
    description This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1023907). - CVE-2017-5857: The Virtio GPU Device emulator support was vulnerable to a host memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1023073). - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-10029: The Virtio GPU Device emulator support was vulnerable to an OOB read issue allowing a guest user to crash the Qemu process instance resulting in Dos (bsc#1017081). - CVE-2016-10028: The Virtio GPU Device emulator support was vulnerable to an out of bounds memory access issue allowing a guest user to crash the Qemu process instance on a host, resulting in DoS (bsc#1017084). - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5552: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1021195). - CVE-2017-5578: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1021481). - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020589). - CVE-2017-5525: The ac97 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020491). - CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) These non-security issues were fixed : - Fix name of s390x specific sysctl configuration file to end with .conf (bsc#1026583) - XHCI fixes (bsc#977027) - Fixed rare race during s390x guest reboot - Fixed various inaccuracies in cirrus vga device emulation - Fixed cause of infrequent migration failures from bad virtio device state (bsc#1020928) - Fixed graphical update errors introduced by previous security fix (bsc#1016779) This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 97791
    published 2017-03-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97791
    title openSUSE Security Update : qemu (openSUSE-2017-349)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1497.NASL
    description Several vulnerabilities were found in qemu, a fast processor emulator : CVE-2015-8666 Heap-based buffer overflow in QEMU when built with the Q35-chipset-based PC system emulator CVE-2016-2198 NULL pointer dereference in ehci_caps_write in the USB EHCI support that may result in denial of service CVE-2016-6833 Use after free while writing in the vmxnet3 device that could be used to cause a denial of service CVE-2016-6835 Buffer overflow in vmxnet_tx_pkt_parse_headers() in vmxnet3 device that could result in denial of service CVE-2016-8576 Infinite loop vulnerability in xhci_ring_fetch in the USB xHCI support CVE-2016-8667 / CVE-2016-8669 Divide by zero errors in set_next_tick in the JAZZ RC4030 chipset emulator, and in serial_update_parameters of some serial devices, that could result in denial of service CVE-2016-9602 Improper link following with VirtFS CVE-2016-9603 Heap buffer overflow via vnc connection in the Cirrus CLGD 54xx VGA emulator support CVE-2016-9776 Infinite loop while receiving data in the ColdFire Fast Ethernet Controller emulator CVE-2016-9907 Memory leakage in the USB redirector usb-guest support CVE-2016-9911 Memory leakage in ehci_init_transfer in the USB EHCI support CVE-2016-9914 / CVE-2016-9915 / CVE-2016-9916 Plan 9 File System (9pfs): add missing cleanup operation in FileOperations, in the handle backend and in the proxy backend driver CVE-2016-9921 / CVE-2016-9922 Divide by zero in cirrus_do_copy in the Cirrus CLGD 54xx VGA Emulator support CVE-2016-10155 Memory leak in hw/watchdog/wdt_i6300esb.c allowing local guest OS privileged users to cause a denial of service via a large number of device unplug operations. CVE-2017-2615 / CVE-2017-2620 / CVE-2017-18030 / CVE-2018-5683 / CVE-2017-7718 Out-of-bounds access issues in the Cirrus CLGD 54xx VGA emulator support, that could result in denial of service CVE-2017-5525 / CVE-2017-5526 Memory leakage issues in the ac97 and es1370 device emulation CVE-2017-5579 Most memory leakage in the 16550A UART emulation CVE-2017-5667 Out-of-bounds access during multi block SDMA transfer in the SDHCI emulation support. CVE-2017-5715 Mitigations against the Spectre v2 vulnerability. For more information please refer to https://www.qemu.org/2018/01/04/spectre/ CVE-2017-5856 Memory leak in the MegaRAID SAS 8708EM2 Host Bus Adapter emulation support CVE-2017-5973 / CVE-2017-5987 / CVE-2017-6505 Infinite loop issues in the USB xHCI, in the transfer mode register of the SDHCI protocol, and the USB ohci_service_ed_list CVE-2017-7377 9pfs: host memory leakage via v9fs_create CVE-2017-7493 Improper access control issues in the host directory sharing via 9pfs support. CVE-2017-7980 Heap-based buffer overflow in the Cirrus VGA device that could allow local guest OS users to execute arbitrary code or cause a denial of service CVE-2017-8086 9pfs: host memory leakage via v9pfs_list_xattr CVE-2017-8112 Infinite loop in the VMWare PVSCSI emulation CVE-2017-8309 / CVE-2017-8379 Host memory leakage issues via the audio capture buffer and the keyboard input event handlers CVE-2017-9330 Infinite loop due to incorrect return value in USB OHCI that may result in denial of service CVE-2017-9373 / CVE-2017-9374 Host memory leakage during hot unplug in IDE AHCI and USB emulated devices that could result in denial of service CVE-2017-9503 NULL pointer dereference while processing megasas command CVE-2017-10806 Stack buffer overflow in USB redirector CVE-2017-10911 Xen disk may leak stack data via response ring CVE-2017-11434 Out-of-bounds read while parsing Slirp/DHCP options CVE-2017-14167 Out-of-bounds access while processing multiboot headers that could result in the execution of arbitrary code CVE-2017-15038 9pfs: information disclosure when reading extended attributes CVE-2017-15289 Out-of-bounds write access issue in the Cirrus graphic adaptor that could result in denial of service CVE-2017-16845 Information leak in the PS/2 mouse and keyboard emulation support that could be exploited during instance migration CVE-2017-18043 Integer overflow in the macro ROUND_UP (n, d) that could result in denial of service CVE-2018-7550 Incorrect handling of memory during multiboot that could may result in execution of arbitrary code For Debian 8 'Jessie', these problems have been fixed in version 1:2.1+dfsg-12+deb8u7. We recommend that you upgrade your qemu packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 117351
    published 2018-09-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117351
    title Debian DLA-1497-1 : qemu security update (Spectre)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-62AC1230F7.NASL
    description - CVE-2017-5525: audio: memory leakage in ac97 (bz #1414110) - CVE-2017-5526: audio: memory leakage in es1370 (bz #1414210) - CVE-2016-10155 watchdog: memory leakage in i6300esb (bz #1415200) - CVE-2017-5552: virtio-gpu-3d: memory leakage (bz #1415283) - CVE-2017-5667: sd: sdhci OOB access during multi block transfer (bz #1417560) - CVE-2017-5857: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref (bz #1418383) - CVE-2017-5856: scsi: megasas: memory leakage (bz #1418344) - CVE-2017-5898: usb: integer overflow in emulated_apdu_from_guest (bz #1419700) - CVE-2017-5987: sd: infinite loop issue in multi block transfers (bz #1422001) - CVE-2017-6505: usb: an infinite loop issue in ohci_service_ed_list (bz #1429434) - CVE-2017-2615: cirrus: oob access while doing bitblt copy backward (bz #1418206) - CVE-2017-2620: cirrus: potential arbitrary code execution (bz #1425419) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-12
    plugin id 97865
    published 2017-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97865
    title Fedora 24 : 2:qemu (2017-62ac1230f7)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2017-0396.NASL
    description From Red Hat Security Advisory 2017:0396 : An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615. Bug Fix(es) : * When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049)
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97508
    published 2017-03-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97508
    title Oracle Linux 7 : qemu-kvm (ELSA-2017-0396)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1038.NASL
    description According to the versions of the qemu-kvm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-29
    plugin id 99883
    published 2017-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99883
    title EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2017-1038)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-845.NASL
    description Several vulnerabilities were discovered in qemu, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-2615 The Cirrus CLGD 54xx VGA Emulator in qemu is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially execute arbitrary code on the host with privileges of Qemu process on the host. CVE-2017-2620 The Cirrus CLGD 54xx VGA Emulator in qemu is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS OR potentially execute arbitrary code on the host with privileges of Qemu process on the host. CVE-2017-5898 The CCID Card device emulator support is vulnerable to an integer overflow flaw. It could occur while passing message via command/responses packets to and from the host. A privileged user inside guest could use this flaw to crash the Qemu process on host resulting in DoS. CVE-2017-5973 The USB xHCI controller emulator support in qemu is vulnerable to an infinite loop issue. It could occur while processing control transfer descriptors' sequence in xhci_kick_epctx. A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS. This update also updates the fix CVE-2016-9921 since it was too strict and broke certain guests. For Debian 7 'Wheezy', these problems have been fixed in version 1.1.2+dfsg-6+deb7u20. We recommend that you upgrade your qemu packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97473
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97473
    title Debian DLA-845-1 : qemu security update
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0396.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615. Bug Fix(es) : * When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97512
    published 2017-03-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97512
    title RHEL 7 : qemu-kvm (RHSA-2017:0396)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0142.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0142 for details.
    last seen 2019-02-21
    modified 2018-11-19
    plugin id 102835
    published 2017-08-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102835
    title OracleVM 3.4 : xen (OVMSA-2017-0142)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-31B976672B.NASL
    description - CVE-2016-7907: net: imx: infinite loop (bz #1381182) - CVE-2017-5525: audio: memory leakage in ac97 (bz #1414110) - CVE-2017-5526: audio: memory leakage in es1370 (bz #1414210) - CVE-2016-10155 watchdog: memory leakage in i6300esb (bz #1415200) - CVE-2017-5552: virtio-gpu-3d: memory leakage (bz #1415283) - CVE-2017-5578: virtio-gpu: memory leakage (bz #1415797) - CVE-2017-5667: sd: sdhci OOB access during multi block transfer (bz #1417560) - CVE-2017-5856: scsi: megasas: memory leakage (bz #1418344) - CVE-2017-5857: virtio-gpu-3d: host memory leakage in virgl_cmd_resource_unref (bz #1418383) - CVE-2017-5898: usb: integer overflow in emulated_apdu_from_guest (bz #1419700) - CVE-2017-5987: sd: infinite loop issue in multi block transfers (bz #1422001) - CVE-2017-6058: vmxnet3: OOB access when doing vlan stripping (bz #1423359) - CVE-2017-6505: usb: an infinite loop issue in ohci_service_ed_list (bz #1429434) - CVE-2017-2615: cirrus: oob access while doing bitblt copy backward (bz #1418206) - CVE-2017-2620: cirrus: potential arbitrary code execution (bz #1425419) - Fix spice GL with new mesa/libglvnd (bz #1431905) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97804
    published 2017-03-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97804
    title Fedora 25 : 2:qemu (2017-31b976672b)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0625-1.NASL
    description This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1023907). - CVE-2017-5857: The Virtio GPU Device emulator support was vulnerable to a host memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1023073). - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-10029: The Virtio GPU Device emulator support was vulnerable to an OOB read issue allowing a guest user to crash the Qemu process instance resulting in Dos (bsc#1017081). - CVE-2016-10028: The Virtio GPU Device emulator support was vulnerable to an out of bounds memory access issue allowing a guest user to crash the Qemu process instance on a host, resulting in DoS (bsc#1017084). - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5552: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1021195). - CVE-2017-5578: The Virtio GPU Device emulator support was vulnerable to a memory leakage issue allowing a guest user to leak host memory resulting in DoS (bsc#1021481). - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020589). - CVE-2017-5525: The ac97 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020491). - CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97599
    published 2017-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97599
    title SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:0625-1)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0096.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0096 for details.
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 99977
    published 2017-05-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99977
    title OracleVM 3.2 : xen (OVMSA-2017-0096)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2017-0396.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615. Bug Fix(es) : * When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049) Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-19
    plugin id 101433
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101433
    title Virtuozzo 7 : qemu-img / qemu-kvm / qemu-kvm-common / etc (VZLSA-2017-0396)
  • NASL family Virtuozzo Local Security Checks
    NASL id VIRTUOZZO_VZLSA-2017-0454.NASL
    description An update for kvm is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615. Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-19
    plugin id 101434
    published 2017-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101434
    title Virtuozzo 7 : kmod-kvm / kmod-kvm-debug / kvm / kvm-qemu-img / etc (VZLSA-2017-0454)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2017-1037.NASL
    description According to the versions of the qemu-kvm package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-05
    plugin id 99882
    published 2017-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99882
    title EulerOS 2.0 SP1 : qemu-kvm (EulerOS-SA-2017-1037)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0352.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97472
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97472
    title CentOS 6 : qemu-kvm (CESA-2017:0352)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170307_KVM_ON_SL5_X.NASL
    description Security Fix(es) : - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 97597
    published 2017-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97597
    title Scientific Linux Security Update : kvm on SL5.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0351.NASL
    description An update for qemu-kvm-rhev is now available for RHEV 3.X Hypervisor and Agents for RHEL-6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines that use KVM in environments managed by Red Hat products. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97489
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97489
    title RHEL 6 : qemu-kvm-rhev (RHSA-2017:0351)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0047.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420486 bz#1420488] - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil .patch - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput .patch - Resolves: bz#1420486 (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.8.z]) - Resolves: bz#1420488 (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.8.z])
    last seen 2019-02-21
    modified 2018-09-07
    plugin id 97486
    published 2017-03-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97486
    title OracleVM 3.4 : qemu-kvm (OVMSA-2017-0047)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0661-1.NASL
    description This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) - CVE-2016-10155: The i6300esb watchdog emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to leak memory on the host resulting in DoS (bnc#1021129) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97696
    published 2017-03-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97696
    title SUSE SLES12 Security Update : qemu (SUSE-SU-2017:0661-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0647-1.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025188) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1024186) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1022627) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014490) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97657
    published 2017-03-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97657
    title SUSE SLES11 Security Update : xen (SUSE-SU-2017:0647-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-1241-1.NASL
    description This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020589) - CVE-2017-5525: The ac97 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020491) - CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 100149
    published 2017-05-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100149
    title SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:1241-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-1135-1.NASL
    description This update for kvm fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 99758
    published 2017-05-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99758
    title SUSE SLES11 Security Update : kvm (SUSE-SU-2017:1135-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-329.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004). - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169 These non-security issues were fixed : - bsc#1000195: Prevent panic on CPU0 while booting on SLES 11 SP3 - bsc#1002496: Added support for reloading clvm in block-dmmd block-dmmd - bsc#1005028: Fixed building Xen RPMs from Sources This update was imported from the SUSE:SLE-12-SP2:Update update project.
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 97712
    published 2017-03-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97712
    title openSUSE Security Update : xen (openSUSE-2017-329)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2017-589.NASL
    description This update for qemu fixes several issues. These security issues were fixed : - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024972) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1023053) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013285) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014111) - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014109) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1014702) - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1021129) - CVE-2017-5526: The ES1370 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020589) - CVE-2017-5525: The ac97 audio device emulation support was vulnerable to a memory leakage issue allowing a privileged user inside the guest to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1020491) - CVE-2017-5667: The SDHCI device emulation support was vulnerable to an OOB heap access issue allowing a privileged user inside the guest to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host (bsc#1022541) - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow allowing a privileged user inside the guest to crash the Qemu process resulting in DoS (bnc#1023907) These non-security issues were fixed : - Fix post script for qemu-guest-agent rpm to actually activate the guest agent at rpm install time - Fixed various inaccuracies in cirrus vga device emulation - Fixed cause of infrequent migration failures from bad virtio device state (bsc#1020928) - Fixed virtio interface failure (bsc#1015048) - Fixed graphical update errors introduced by previous security fix (bsc#1016779) - Fixed uint64 property parsing and add regression tests (bsc#937125) This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 100232
    published 2017-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100232
    title openSUSE Security Update : qemu (openSUSE-2017-589)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0718-1.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183) - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - CVE-2014-8106: A heap-based buffer overflow in the Cirrus VGA emulator allowed local guest users to execute arbitrary code via vectors related to blit regions (bsc#907805) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-10013: Xen allowed local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation (bsc#1016340). - CVE-2016-9932: CMPXCHG8B emulation on x86 systems allowed local HVM guest OS users to obtain sensitive information from host stack memory via a 'supposedly-ignored' operand size prefix (bsc#1012651). - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668) - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2016-10024: Xen allowed local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations (bsc#1014298) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97828
    published 2017-03-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97828
    title SUSE SLES11 Security Update : xen (SUSE-SU-2017:0718-1)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2017-0055.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420487 bz#1420489] - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil .patch - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput .patch - Resolves: bz#1420487 (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9]) - Resolves: bz#1420489 (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9]) - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop .patch - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.p atch - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.pa tch - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i .patch - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re .patch - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops. patch - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418231 bz#1419417] - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418231 bz#1419417] - Resolves: bz#1418231 (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9]) - Resolves: bz#1419417 (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9]) - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882] - kvm-Revert-block-commit-speed-is-an-optional-parameter.p atch [bz#1405882] - kvm-Revert-iotests-Disable-086.patch [bz#1405882] - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882] - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882] - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882] - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patc h [bz#1405882] - kvm-net-check-packet-payload-length.patch [bz#1398214] - Resolves: bz#1398214 (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate [rhel-6.9]) - Reverts: bz#1405882 (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6) - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882] - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882] - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882] - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882] - kvm-iotests-Disable-086.patch [bz#1405882] - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882] - kvm-iotests-Use-_img_info.patch [bz#1405882] - Resolves: bz#1405882 (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6) - kvm-rename-qemu_aio_context-to-match-upstream.patch [bz#876993] - kvm-block-stop-relying-on-io_flush-in-bdrv_drain_all.pat ch [bz#876993] - kvm-block-add-bdrv_drain.patch [bz#876993] - kvm-block-avoid-very-long-pauses-at-the-end-of-mirroring .patch [bz#876993] - Resolves: bz#876993 (qemu-kvm: vm's become non-responsive during migrate disk load from 2 domains to a 3ed) - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1392520] - kvm-virtio-introduce-virtqueue_discard.patch [bz#1392520] - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1392520] - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patc h [bz#1392520] - kvm-virtio-balloon-discard-virtqueue-element-on-reset.pa tch [bz#1392520] - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1392520] - kvm-PATCH-1-4-e1000-pre-initialize-RAH-RAL-registers.pat ch [bz#1300626] - kvm-net-update-nic-info-during-device-reset.patch [bz#1300626] - kvm-net-e1000-update-network-information-when-macaddr-is .patch - kvm-net-rtl8139-update-network-information-when-macaddr- .patch - Resolves: bz#1300626 (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest) - Resolves: bz#1392520 ([RHEL6.9] KVM guest shuts itself down after 128th reboot) - kvm-vmstate-fix-breakage-by-7e72abc382b700a72549e8147bde .patch - Resolves: bz#1294941 (QEMU crash on snapshot revert when using Cirrus) - kvm-virtio-blk-Release-s-rq-queue-at-system_reset.patch [bz#1361490] - kvm-virtio-scsi-Prevent-assertion-on-missed-events.patch [bz#1333697] - Resolves: bz#1333697 (qemu-kvm: /builddir/build/BUILD/qemu-kvm-0.12.1.2/hw/virtio-scsi.c :724: virtio_scsi_push_event: Assertion `event == 0' failed) - Resolves: bz#1361490 (system_reset should clear pending request for error (virtio-blk)) - kvm-qemu-img-add-support-for-fully-allocated-images.patc h [bz#1297653] - kvm-qemu-img-fix-usage-instruction-for-qemu-img-convert. patch [bz#1297653] - kvm-target-i386-warns-users-when-CPU-threads-1-for-non-I .patch - Resolves: bz#1292678 (Qemu should report error when cmdline set threads=2 in amd host) - Resolves: bz#1297653 ('qemu-img convert' can't create a fully allocated image passed a '-S 0' option) - Resolves: bz#1320066 (Qemu should not report error when cmdline set threads=2 in Intel host) - kvm-rtl8139-flush-queued-packets-when-RxBufPtr-is-writte .patch - kvm-block-Detect-unaligned-length-in-bdrv_qiov_is_aligne .patch - kvm-ide-fix-halted-IO-segfault-at-reset.patch [bz#1281713] - kvm-atapi-fix-halted-DMA-reset.patch [bz#1281713] - Resolves: bz#1281713 (system_reset should clear pending request for error (IDE)) - Resolves: bz#1321862 (Backport 'block: Detect unaligned length in bdrv_qiov_is_aligned') - Resolves: bz#1356924 (rtl8139 driver hangs in widows guests) - kvm-virtio-error-out-if-guest-exceeds-virtqueue-size.pat ch [bz#1359725] - Resolves: bz#1359725 (CVE-2016-5403 qemu-kvm: Qemu: virtio: unbounded memory allocation on host via guest leading to DoS [rhel-6.9]) - kvm-Add-vga.h-unmodified-from-Linux.patch [bz#1331408] - kvm-vga.h-remove-unused-stuff-and-reformat.patch [bz#1331408] - kvm-vga-use-constants-from-vga.h.patch [bz#1331408] - kvm-vga-Remove-some-should-be-done-in-BIOS-comments.patc h [bz#1331408] - kvm-vga-fix-banked-access-bounds-checking-CVE-2016-3710. patch [bz#1331408] - kvm-vga-add-vbe_enabled-helper.patch [bz#1331408] - kvm-vga-factor-out-vga-register-setup.patch [bz#1331408] - kvm-vga-update-vga-register-setup-on-vbe-changes.patch [bz#1331408] - kvm-vga-make-sure-vga-register-setup-for-vbe-stays-intac .patch - kvm-vga-add-sr_vbe-register-set.patch [bz#1331408 bz#1346981] - Resolves: bz#1331408 (CVE-2016-3710 qemu-kvm: qemu: incorrect banked access bounds checking in vga module [rhel-6.9]) - Resolves: bz#1346981 (Regression from CVE-2016-3712: windows installer fails to start)
    last seen 2019-02-21
    modified 2018-09-10
    plugin id 99082
    published 2017-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99082
    title OracleVM 3.4 : qemu-kvm (OVMSA-2017-0055)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0454.NASL
    description An update for kvm is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97611
    published 2017-03-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97611
    title CentOS 5 : kvm (CESA-2017:0454)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3261-1.NASL
    description Zhenhao Hong discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10028, CVE-2016-10029) Li Qiang discovered that QEMU incorrectly handled the 6300esb watchdog. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-10155) Li Qiang discovered that QEMU incorrectly handled the i.MX Fast Ethernet Controller. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7907) It was discovered that QEMU incorrectly handled the JAZZ RC4030 device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-8667) It was discovered that QEMU incorrectly handled the 16550A UART device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-8669) It was discovered that QEMU incorrectly handled the shared rings when used with Xen. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. (CVE-2016-9381) Jann Horn discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to access files on the host file system outside of the shared directory and possibly escalate their privileges. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-9602) Gerd Hoffmann discovered that QEMU incorrectly handled the Cirrus VGA device when being used with a VNC connection. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2016-9603) It was discovered that QEMU incorrectly handled the ColdFire Fast Ethernet Controller. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-9776) Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to leak contents of host memory. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9845, CVE-2016-9908) Li Qiang discovered that QEMU incorrectly handled the Virtio GPU device. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9846, CVE-2016-9912, CVE-2017-5552, CVE-2017-5578, CVE-2017-5857) Li Qiang discovered that QEMU incorrectly handled the USB redirector. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9907) Li Qiang discovered that QEMU incorrectly handled USB EHCI emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-9911) Li Qiang discovered that QEMU incorrectly handled VirtFS directory sharing. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-9913, CVE-2016-9914, CVE-2016-9915, CVE-2016-9916) Qinghao Tang, Li Qiang, and Jiangxin discovered that QEMU incorrectly handled the Cirrus VGA device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-9921, CVE-2016-9922) Wjjzhang and Li Qiang discovered that QEMU incorrectly handled the Cirrus VGA device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2017-2615) It was discovered that QEMU incorrectly handled the Cirrus VGA device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2017-2620) It was discovered that QEMU incorrectly handled VNC connections. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-2633) Li Qiang discovered that QEMU incorrectly handled the ac97 audio device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5525) Li Qiang discovered that QEMU incorrectly handled the es1370 audio device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5526) Li Qiang discovered that QEMU incorrectly handled the 16550A UART device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5579) Jiang Xin discovered that QEMU incorrectly handled SDHCI device emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2017-5667) Li Qiang discovered that QEMU incorrectly handled the MegaRAID SAS device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5856) Li Qiang discovered that QEMU incorrectly handled the CCID Card device. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5898) Li Qiang discovered that QEMU incorrectly handled USB xHCI controller emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5973) Jiang Xin and Wjjzhang discovered that QEMU incorrectly handled SDHCI device emulation. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2017-5987) Li Qiang discovered that QEMU incorrectly handled USB OHCI controller emulation. A privileged attacker inside the guest could use this issue to cause QEMU to hang, resulting in a denial of service. (CVE-2017-6505). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 99581
    published 2017-04-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=99581
    title Ubuntu 14.04 LTS / 16.04 LTS / 16.10 : qemu vulnerabilities (USN-3261-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2017-0396.NASL
    description An update for qemu-kvm is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615. Bug Fix(es) : * When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected. (BZ#1420049)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97528
    published 2017-03-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97528
    title CentOS 7 : qemu-kvm (CESA-2017:0396)
  • NASL family Misc.
    NASL id CITRIX_XENSERVER_CTX220771.NASL
    description The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the blit_region_is_unsafe() function within file hw/display/cirrus_vga.c when handling a backward mode bitblt copy. A guest attacker with administrative privileges can exploit this to crash the QEMU process or potentially execute arbitrary code with elevated privileges. (CVE-2017-2615) - A flaw exists in the cirrus_bitblt_cputovideo() function within file hw/display/cirrus_vga.c when running in CIRRUS_BLTMODE_MEMSYSSRC mode due to improper memory region checks. A guest attacker with administrative privileges can exploit this to crash the QEMU process or potentially execute arbitrary code with elevated privileges. (CVE-2017-2620)
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 97525
    published 2017-03-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97525
    title Citrix XenServer Multiple Vulnerabilities (CTX220771)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20170302_QEMU_KVM_ON_SL7_X.NASL
    description Security Fix(es) : - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) - Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Bug Fix(es) : - When using the virtio-blk driver on a guest virtual machine with no space on the virtual hard drive, the guest terminated unexpectedly with a 'block I/O error in device' message and the qemu-kvm process exited with a segmentation fault. This update fixes how the system_reset QEMU signal is handled in the above scenario. As a result, if a guest crashes due to no space left on the device, qemu-kvm continues running and the guest can be reset as expected.
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 97517
    published 2017-03-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97517
    title Scientific Linux Security Update : qemu-kvm on SL7.x x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-0454.NASL
    description An update for kvm is now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, etc. Security Fix(es) : * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. (CVE-2017-2615) * Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. (CVE-2017-2620) Red Hat would like to thank Wjjzhang (Tencent.com Inc.) and Li Qiang (360.cn Inc.) for reporting CVE-2017-2615.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 97594
    published 2017-03-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97594
    title RHEL 5 : kvm (RHSA-2017:0454)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2017-0570-1.NASL
    description This update for xen fixes several issues. These security issues were fixed : - CVE-2017-5973: A infinite loop while doing control transfer in xhci_kick_epctx allowed privileged user inside the guest to crash the host process resulting in DoS (bsc#1025188). - CVE-2016-10155: The virtual hardware watchdog 'wdt_i6300esb' was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1024183). - CVE-2017-2620: In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo failed to check the memory region, allowing for an out-of-bounds write that allows for privilege escalation (bsc#1024834) - CVE-2017-5856: The MegaRAID SAS 8708EM2 Host Bus Adapter emulation support was vulnerable to a memory leakage issue allowing a privileged user to leak host memory resulting in DoS (bsc#1024186). - CVE-2017-5898: The CCID Card device emulator support was vulnerable to an integer overflow flaw allowing a privileged user to crash the Qemu process on the host resulting in DoS (bsc#1024307). - CVE-2017-2615: An error in the bitblt copy operation could have allowed a malicious guest administrator to cause an out of bounds memory access, possibly leading to information disclosure or privilege escalation (bsc#1023004) - A malicious guest could have, by frequently rebooting over extended periods of time, run the host system out of memory, resulting in a Denial of Service (DoS) (bsc#1022871) - CVE-2017-5579: The 16550A UART serial device emulation support was vulnerable to a memory leakage issue allowing a privileged user to cause a DoS and/or potentially crash the Qemu process on the host (bsc#1022627). - CVE-2016-9907: The USB redirector usb-guest support was vulnerable to a memory leakage flaw when destroying the USB redirector in 'usbredir_handle_destroy'. A guest user/process could have used this issue to leak host memory, resulting in DoS for a host (bsc#1014490) - CVE-2016-9911: The USB EHCI Emulation support was vulnerable to a memory leakage issue while processing packet data in 'ehci_init_transfer'. A guest user/process could have used this issue to leak host memory, resulting in DoS for the host (bsc#1014507) - CVE-2016-9921: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9922: The Cirrus CLGD 54xx VGA Emulator support was vulnerable to a divide by zero issue while copying VGA data. A privileged user inside guest could have used this flaw to crash the process instance on the host, resulting in DoS (bsc#1015169) - CVE-2016-9101: A memory leak in hw/net/eepro100.c allowed local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by repeatedly unplugging an i8255x (PRO100) NIC device (bsc#1013668). - CVE-2016-9776: The ColdFire Fast Ethernet Controller emulator support was vulnerable to an infinite loop issue while receiving packets in 'mcf_fec_receive'. A privileged user/process inside guest could have used this issue to crash the Qemu process on the host leading to DoS (bsc#1013657) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-30
    plugin id 97432
    published 2017-02-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=97432
    title SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:0570-1)
redhat via4
advisories
  • bugzilla
    id 1420484
    title CVE-2017-2620 Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment qemu-guest-agent is earlier than 2:0.12.1.2-2.491.el6_8.7
          oval oval:com.redhat.rhsa:tst:20170352005
        • comment qemu-guest-agent is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20121234008
      • AND
        • comment qemu-img is earlier than 2:0.12.1.2-2.491.el6_8.7
          oval oval:com.redhat.rhsa:tst:20170352007
        • comment qemu-img is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345008
      • AND
        • comment qemu-kvm is earlier than 2:0.12.1.2-2.491.el6_8.7
          oval oval:com.redhat.rhsa:tst:20170352009
        • comment qemu-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345006
      • AND
        • comment qemu-kvm-tools is earlier than 2:0.12.1.2-2.491.el6_8.7
          oval oval:com.redhat.rhsa:tst:20170352011
        • comment qemu-kvm-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345010
    rhsa
    id RHSA-2017:0352
    released 2017-03-01
    severity Important
    title RHSA-2017:0352: qemu-kvm security update (Important)
  • bugzilla
    id 1420484
    title CVE-2017-2620 Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment qemu-img is earlier than 10:1.5.3-126.el7_3.5
          oval oval:com.redhat.rhsa:tst:20170396011
        • comment qemu-img is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345008
      • AND
        • comment qemu-kvm is earlier than 10:1.5.3-126.el7_3.5
          oval oval:com.redhat.rhsa:tst:20170396009
        • comment qemu-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345006
      • AND
        • comment qemu-kvm-common is earlier than 10:1.5.3-126.el7_3.5
          oval oval:com.redhat.rhsa:tst:20170396007
        • comment qemu-kvm-common is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20140704018
      • AND
        • comment qemu-kvm-tools is earlier than 10:1.5.3-126.el7_3.5
          oval oval:com.redhat.rhsa:tst:20170396005
        • comment qemu-kvm-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345010
    rhsa
    id RHSA-2017:0396
    released 2017-03-02
    severity Important
    title RHSA-2017:0396: qemu-kvm security and bug fix update (Important)
  • bugzilla
    id 1420484
    title CVE-2017-2620 Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment kmod-kvm is earlier than 0:83-277.el5_11
          oval oval:com.redhat.rhsa:tst:20170454010
        • comment kmod-kvm is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20091465005
      • AND
        • comment kmod-kvm-debug is earlier than 0:83-277.el5_11
          oval oval:com.redhat.rhsa:tst:20170454008
        • comment kmod-kvm-debug is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20110028007
      • AND
        • comment kvm is earlier than 0:83-277.el5_11
          oval oval:com.redhat.rhsa:tst:20170454006
        • comment kvm is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20091465003
      • AND
        • comment kvm-qemu-img is earlier than 0:83-277.el5_11
          oval oval:com.redhat.rhsa:tst:20170454004
        • comment kvm-qemu-img is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20091465007
      • AND
        • comment kvm-tools is earlier than 0:83-277.el5_11
          oval oval:com.redhat.rhsa:tst:20170454002
        • comment kvm-tools is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20091465009
    rhsa
    id RHSA-2017:0454
    released 2017-03-07
    severity Important
    title RHSA-2017:0454: kvm security update (Important)
  • rhsa
    id RHSA-2017:0328
  • rhsa
    id RHSA-2017:0329
  • rhsa
    id RHSA-2017:0330
  • rhsa
    id RHSA-2017:0331
  • rhsa
    id RHSA-2017:0332
  • rhsa
    id RHSA-2017:0333
  • rhsa
    id RHSA-2017:0334
  • rhsa
    id RHSA-2017:0350
  • rhsa
    id RHSA-2017:0351
rpms
  • qemu-guest-agent-2:0.12.1.2-2.491.el6_8.7
  • qemu-img-2:0.12.1.2-2.491.el6_8.7
  • qemu-kvm-2:0.12.1.2-2.491.el6_8.7
  • qemu-kvm-tools-2:0.12.1.2-2.491.el6_8.7
  • qemu-img-10:1.5.3-126.el7_3.5
  • qemu-kvm-10:1.5.3-126.el7_3.5
  • qemu-kvm-common-10:1.5.3-126.el7_3.5
  • qemu-kvm-tools-10:1.5.3-126.el7_3.5
  • kmod-kvm-0:83-277.el5_11
  • kmod-kvm-debug-0:83-277.el5_11
  • kvm-0:83-277.el5_11
  • kvm-qemu-img-0:83-277.el5_11
  • kvm-tools-0:83-277.el5_11
refmap via4
bid 96378
confirm
gentoo
  • GLSA-201703-07
  • GLSA-201704-01
mlist
  • [debian-lts-announce] 20180206 [SECURITY] [DLA 1270-1] xen security update
  • [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
  • [oss-security] 20170221 CVE-2017-2620 Qemu: display: cirrus: out-of-bounds access issue while in cirrus_bitblt_cputovideo
  • [qemu-devel] 20170221 [PATCH] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo (CVE-2017-2620)
sectrack 1037870
Last major update 27-07-2018 - 15:29
Published 27-07-2018 - 15:29
Last modified 07-09-2018 - 06:29
Back to Top