AlmaLinux 8 : virt:rhel and virt-devel:rhel (ALSA-2021:0711)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:0711 advisory. QEMU: virtiofsd: potential privileged host device access from guest CVE-2020-35517 Tenable has extracted the preceding description block directly from the AlmaLinu...

virtio-win bug fix and enhancement update

An update is available for virtio-win. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The virtio-win package provides paravirtualized network drivers for most...

Mageia: Security Advisory (MGASA-2017-0258)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2017-0242)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2017-0234)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-0358

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

Mageia: Security Advisory (MGASA-2017-0259)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

QEMU Elevation of Privilege Vulnerability (CNVD-2022-84163)

QEMU is a suite of emulation processor software from Fabrice Bellard, a French personal developer. The software is fast and cross-platform.QEMU suffers from an elevation of privilege vulnerability, which stems from a flaw found in the QEMU virtio-fs shared file system daemon implementation. An...

CVE-2022-0358

A flaw was found in the QEMU virtio-fs shared file system daemon virtiofsd implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certa...

GSD-2021-1002723 i2c: virtio: fix completion handling

i2c: virtio: fix completion handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.10 by commit 9cbb957441ed8873577d7d313a3d79d69f1dad5c...

PT-2022-2824 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to an integer overflow flaw in the Linux kernel's virtio device driver code, specifically in the way a user triggers the vhost vdpa config validate function. This...

The vulnerability of the VIRTIO_GPU_CMD_GET_CAPSET command in the QEMU hardware emulation software involves writing beyond the buffer boundaries. This allows an attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the VIRTIOGPUCMDGETCAPSET command in the QEMU hardware emulation software is related to writing beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

GSD-2021-1002537 i2c: virtio: disable timeout handling

i2c: virtio: disable timeout handling This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.6 by commit cc432b0727ce404cc13e8f6b5ce29f412c3f9f1f...

QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting i...

Oracle Linux 8 : kvm_utils (ELSA-2021-9568)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2021-9568 advisory. - In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference. CVE-2020-15469 - A flaw was foun...

virt:ol and virt-devel:ol security, bug fix, and enhancement update

libguestfs-winsupport 8.2 - Resolves: bz1810193 Upgrade components in virt:rhel module:stream for RHEL-8.3 release libguestfs 1.40.2-28.0.1 - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 Orabug: 29319324 - Set DISTROORACLELINUX correspeonding to o...

SUSE SLES12: qemu / qemu-arm / qemu-block-curl / qemu-block-iscsi / etc (SUSE-SU-2021:3653-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3653-1 advisory. Security issues fixed: - Fix out-of-bounds write in UAS USB Attached SCSI device emulation bsc1189702, CVE-2021-3713 - Fix heap...

virtio-win bug fix and enhancement update

An update is available for virtio-win. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

PT-2025-25999

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference bug has been identified in the Linux kernel, specifically in the tap driver. The issue occurs when the skb-dev field is null, which is required by the dev pars...

openSUSE 15 Security Update : qemu (openSUSE-SU-2021:1461-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1461-1 advisory. - An out-of-bounds write flaw was found in the UAS USB Attached SCSI device emulation of QEMU in versions prior to 6.2.0-rc0. The device us...