TencentOS Server 4: qemu (TSSA-2024:0869)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2024:0869.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(238947);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/20");

  script_cve_id(
    "CVE-2021-3750",
    "CVE-2021-3929",
    "CVE-2021-4158",
    "CVE-2021-4206",
    "CVE-2021-4207",
    "CVE-2022-0358",
    "CVE-2022-2962",
    "CVE-2022-3165",
    "CVE-2022-35414",
    "CVE-2022-3872",
    "CVE-2022-4144",
    "CVE-2023-1544",
    "CVE-2023-3180",
    "CVE-2023-3255",
    "CVE-2023-3301",
    "CVE-2023-3354",
    "CVE-2023-40360",
    "CVE-2023-4135",
    "CVE-2023-42467",
    "CVE-2023-5088",
    "CVE-2023-6683",
    "CVE-2023-6693"
  );

  script_name(english:"TencentOS Server 4: qemu (TSSA-2024:0869)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0869 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-5088:
    A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be
    targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for
    example, by L2 guests with a virtual disk (vdiskL2) stored on a virtual disk of an L1 (vdiskL1) hypervisor
    to read and/or write data to LBA 0 of vdiskL1, potentially gaining control of L1 at its next reboot.

    CVE-2023-40360:
    A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device
    backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this
    time window to trigger an assertion and cause a denial of service.

    CVE-2023-3180:
    QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no
    check for whether an endurance group is configured before checking whether Flexible Data Placement is
    enabled.

    CVE-2023-42467:
    A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does
    not validate an offset provided by the guest before computing a host heap pointer, which is used for
    copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

    CVE-2023-3354:
    A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks
    whether the current number of connections crosses a certain threshold and if so, cleans up the previous
    connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the
    connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated
    client to cause a denial of service.

    CVE-2023-3301:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit
    condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the
    `inflate_buffer` function. This could allow a remote authenticated client who is able to send a clipboard
    to the VNC server to trigger a denial of service.

    CVE-2023-4135:
    A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in
    virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in
    virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

    CVE-2023-3255:
    QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because
    scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the
    guest immediately.

    CVE-2021-3750:
    A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the
    Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be
    written to the controller/'s registers and trigger undesirable actions (such as reset) while the device is
    still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could
    use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or
    potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects
    QEMU versions before 7.0.0.

    CVE-2021-3929:
    A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is
    similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function
    nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could
    use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or,
    potentially, executing arbitrary code within the context of the QEMU process on the host.

    CVE-2021-4158:
    A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within
    the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service
    condition.

    CVE-2021-4206:
    A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc()
    function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer
    overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or
    potentially execute arbitrary code within the context of the QEMU process.

    CVE-2021-4207:
    A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values
    `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object
    followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw
    to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU
    process.

    CVE-2022-0358:
    A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is
    strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by
    virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and
    is writable by a user who is not a member of the group. This could allow a malicious unprivileged user
    inside the guest to gain access to resources accessible to the root group, potentially escalating their
    privileges within the guest. A malicious local user in the host might also leverage this unexpected
    executable file created by the guest to escalate their privileges on the host system.

    CVE-2022-2962:
    A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the
    rx/tx descriptor or copies the rx/tx frame, it doesn/'t check whether the destination address is its own
    MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a
    stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host,
    resulting in a denial of service condition.

    CVE-2022-3165:
    An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the
    extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially
    crafted payload message, resulting in a denial of service.

    CVE-2022-35414:
    ** DISPUTED ** softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the
    translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-
    virtualization Use Case in the qemu.org reference applies here, i.e., Bugs affecting the non-
    virtualization use case are not considered security bugs at this time.

    CVE-2022-3872:
    An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the
    Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count ==
    block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a
    denial of service condition.

    CVE-2022-4144:
    An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt()
    function does not check the size of the structure pointed to by the guest physical address, potentially
    reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to
    crash the QEMU process on the host causing a denial of service condition.

    CVE-2023-1544:
    A flaw was found in the QEMU implementation of VMWare/'s paravirtual RDMA device. This flaw allows a
    crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of
    descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.

    CVE-2023-6683:
    A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The
    qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the
    chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a
    malicious authenticated VNC client to crash QEMU and trigger a denial of service.

    CVE-2023-6693:
    A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing
    TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and
    VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious user to overwrite local variables
    allocated on the stack. Specifically, the `out_sg` variable could be used to read a part of process memory
    and send it to the wire, causing an information leak.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20240869.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-35414");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:qemu");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'qemu-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-alsa-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-alsa-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-alsa-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-alsa-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-oss-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-oss-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-oss-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-oss-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-pa-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-pa-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-pa-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-pa-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-sdl-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-sdl-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-sdl-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-audio-sdl-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-curl-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-curl-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-curl-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-curl-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-dmg-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-dmg-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-dmg-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-dmg-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-iscsi-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-iscsi-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-iscsi-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-iscsi-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-rbd-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-rbd-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-rbd-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-rbd-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-ssh-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-ssh-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-ssh-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-block-ssh-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-common-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-common-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-common-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-common-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-debugsource-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-debugsource-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-ccw-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-ccw-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-ccw-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-ccw-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-pci-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-pci-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-pci-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-gpu-pci-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-gl-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-gl-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-gl-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-display-virtio-vga-gl-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-usb-host-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-usb-host-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-usb-host-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-device-usb-host-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-docs-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-docs-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-guest-agent-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-guest-agent-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-guest-agent-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-guest-agent-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-img-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-img-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-img-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-img-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-kvm-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-kvm-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-kvm-core-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-kvm-core-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-pr-helper-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-pr-helper-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-pr-helper-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-pr-helper-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-aarch64-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-aarch64-core-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-aarch64-core-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-x86-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-x86-core-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-system-x86-core-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tests-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tests-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tests-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tests-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tools-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tools-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tools-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-tools-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-curses-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-curses-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-curses-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-curses-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-egl-headless-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-egl-headless-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-egl-headless-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-egl-headless-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-gtk-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-gtk-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-gtk-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-gtk-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-opengl-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-opengl-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-opengl-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-opengl-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-sdl-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-sdl-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-sdl-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-ui-sdl-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-binfmt-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-binfmt-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-static-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-static-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-static-debuginfo-8.0.2-12.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'qemu-user-static-debuginfo-8.0.2-12.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'qemu / qemu-audio-alsa / qemu-audio-alsa-debuginfo / etc');
}