EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3820)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346769);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/17");

  script_cve_id(
    "CVE-2024-4693",
    "CVE-2024-6519",
    "CVE-2024-8354",
    "CVE-2025-11234",
    "CVE-2025-12464",
    "CVE-2025-14876",
    "CVE-2026-0665",
    "CVE-2026-2243",
    "CVE-2026-3195",
    "CVE-2026-3196",
    "CVE-2026-3842",
    "CVE-2026-3886",
    "CVE-2026-48914"
  );

  script_name(english:"EulerOS 2.0 SP15 : qemu (EulerOS-SA-2026-3820)");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the qemu packages installed, the EulerOS installation on the remote host is affected by the
following vulnerabilities :

    A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly
    validate the size of input descriptors before writing data. A malicious guest with high privileges could
    exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds
    write in the host heap memory and a potential denial of service (DoS) for the QEMU
    process.(CVE-2026-48914)

    NA(CVE-2026-3886)

    A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a
    missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a
    denial of service (DoS) on the host system by causing the QEMU process to terminate
    unexpectedly.(CVE-2025-14876)

    An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to
    trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface,
    leading to a denial of service or potential memory corruption.(CVE-2026-0665)

    A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short
    frames was dropped from individual network devices and moved to the net core code. The issue stems from
    the device's receive code still being able to process a short frame in loopback mode. This could lead to a
    buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user
    could use this vulnerability to crash the QEMU process on the host, resulting in a denial of
    service.(CVE-2025-12464)

    A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a
    handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-
    free in the use of the channel. This can be abused by a malicious client with network access to the VNC
    WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client
    authentication.(CVE-2025-11234)

    A flaw was found in QEMU. A specially crafted VMDK image could trigger an out-of-bounds read
    vulnerability, potentially leading to a 12-byte leak of sensitive information or a denial of service
    condition (DoS).(CVE-2026-2243)

    A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of
    the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop().
    This flaw allows a malicious guest to crash the QEMU process on the host.(CVE-2024-4693)

    A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This
    issue can lead to a crash or VM escape.(CVE-2024-6519)

    A vulnerability was found in QEMU (Virtualization Software) (the affected version unknown). It has been
    declared as critical.The CWE definition for the vulnerability is CWE-787. The product writes data past the
    end, or before the beginning, of the intended buffer.As an impact it is known to affect confidentiality,
    integrity, and availability.Applying the patch 4f28b87fdd24df2049626106b7c24d0180952115 is able to
    eliminate this problem. The bugfix is ready for download at gitlab.com.(CVE-2026-3842)

    A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c
    when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest
    user to crash the QEMU process on the host and cause a denial of service condition.(CVE-2024-8354)

    An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest.
    A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory
    allocation on the host and a denial of service condition.(CVE-2026-3196)

    A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the
    `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially
    leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for
    CVE-2024-7730.(CVE-2026-3195)

Tenable has extracted the preceding description block directly from the EulerOS qemu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2026-3820
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?32d7e47c");
  script_set_attribute(attribute:"solution", value:
"Update the affected qemu packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-8354");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/05/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/17");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:qemu");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:qemu-img");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
  script_exclude_keys("Host/EulerOS/uvp_version");

  exit(0);
}

include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var _release = get_kb_item("Host/EulerOS/release");
if (isnull(_release) || _release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
var uvp = get_kb_item("Host/EulerOS/uvp_version");
if (_release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

var sp = get_kb_item("Host/EulerOS/sp");
if (isnull(sp) || sp !~ "^(15)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15");

if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP15", "EulerOS UVP " + uvp);

if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu && "x86" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

var flag = 0;

var pkgs = [
  "qemu-8.2.0-27.h21510.440.eulerosv2r15",
  "qemu-img-8.2.0-27.h21510.440.eulerosv2r15"
];

foreach (var pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", sp:"15", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "qemu");
}