The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 DCCP implementation in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9076i1/4%0

  - It was found that the driver_override implementation in     base/platform.c in the Linux kernel is susceptible to     race condition when different threads are reading vs     storing a different driver override.(CVE-2017-12146i1/4%0

  - The Linux Kernel imposes a size restriction on the     arguments and environmental strings passed through     RLIMIT_STACK/RLIMIT_INFINITY, but does not take the     argument and environment pointers into account, which     allows attackers to bypass this     limitation.(CVE-2017-1000365i1/4%0

  - A buffer overflow flaw was found in the way the Linux     kernel's eCryptfs implementation decoded encrypted file     names. A local, unprivileged user could use this flaw     to crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-9683i1/4%0

  - The Linux kernel was found vulnerable to an integer     overflow in the     drivers/video/fbdev/uvesafb.c:uvesafb_setcmap()     function. The vulnerability could result in local     attackers being able to crash the kernel or potentially     elevate privileges.(CVE-2018-13406i1/4%0

  - net/ceph/auth_x.c in Ceph, as used in the Linux kernel     before 3.16.3, does not properly validate auth replies,     which allows remote attackers to cause a denial of     service (system crash) or possibly have unspecified     other impact via crafted data from the IP address of a     Ceph Monitor.(CVE-2014-6418i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's Common Internet File System (CIFS)     implementation handled mounting of file system shares.
    A remote attacker could use this flaw to crash a client     system that would mount a file system share from a     malicious server.(CVE-2014-7145i1/4%0

  - The udp6_ufo_fragment function in     net/ipv6/udp_offload.c in the Linux kernel through     3.12, when UDP Fragmentation Offload (UFO) is enabled,     does not properly perform a certain size comparison     before inserting a fragment header, which allows remote     attackers to cause a denial of service (panic) via a     large IPv6 UDP packet, as demonstrated by use of the     Token Bucket Filter (TBF) queueing     discipline.(CVE-2013-4563i1/4%0

  - The do_umount function in fs/namespace.c in the Linux     kernel through 3.17 does not require the CAP_SYS_ADMIN     capability for do_remount_sb calls that change the root     filesystem to read-only, which allows local users to     cause a denial of service (loss of writability) by     making certain unshare system calls, clearing the /     MNT_LOCKED flag, and making an MNT_FORCE umount system     call.(CVE-2014-7975i1/4%0

  - drivers/tty/n_tty.c in the Linux kernel before 4.14.11     allows local attackers (who are able to access pseudo     terminals) to hang/block further usage of any pseudo     terminal devices due to an EXTPROC versus ICANON     confusion in TIOCINQ.(CVE-2018-18386i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348)

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350)

  - net/ipv6/ip6_output.c in the Linux kernel through     3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets     after the UFO queueing of a large packet, which allows     remote attackers to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via network traffic that     triggers a large response packet.(CVE-2013-4387)

  - The Linux kernel before 3.12, when UDP Fragmentation     Offload (UFO) is enabled, does not properly initialize     certain data structures, which allows local users to     cause a denial of service (memory corruption and system     crash) or possibly gain privileges via a crafted     application that uses the UDP_CORK option in a     setsockopt system call and sends both short and long     packets, related to the ip_ufo_append_data function in     net/ipv4/ip_output.c and the ip6_ufo_append_data     function in net/ipv6/ip6_output.c.(CVE-2013-4470)

  - Multiple integer overflows in Alchemy LCD frame-buffer     drivers in the Linux kernel before 3.12 allow local     users to create a read-write memory mapping for the     entirety of kernel memory, and consequently gain     privileges, via crafted mmap operations, related to the     (1) au1100fb_fb_mmap function in     drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap     function in drivers/video/au1200fb.c.(CVE-2013-4511)

  - The udp6_ufo_fragment function in     net/ipv6/udp_offload.c in the Linux kernel through     3.12, when UDP Fragmentation Offload (UFO) is enabled,     does not properly perform a certain size comparison     before inserting a fragment header, which allows remote     attackers to cause a denial of service (panic) via a     large IPv6 UDP packet, as demonstrated by use of the     Token Bucket Filter (TBF) queueing     discipline.(CVE-2013-4563)

  - The ath9k_htc_set_bssid_mask function in     drivers/net/wireless/ath/ath9k/htc_drv_main.c in the     Linux kernel through 3.12 uses a BSSID masking approach     to determine the set of MAC addresses on which a Wi-Fi     device is listening, which allows remote attackers to     discover the original MAC address after spoofing by     sending a series of packets to MAC addresses with     certain bit manipulations.(CVE-2013-4579)

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587)

  - The apic_get_tmcct function in arch/x86/kvm/lapic.c in     the KVM subsystem in the Linux kernel through 3.12.5     allows guest OS users to cause a denial of service     (divide-by-zero error and host OS crash) via crafted     modifications of the TMICT value.(CVE-2013-6367)

  - The KVM subsystem in the Linux kernel through 3.12.5     allows local users to gain privileges or cause a denial     of service (system crash) via a VAPIC synchronization     operation involving a page-end address.(CVE-2013-6368)

  - The recalculate_apic_map function in     arch/x86/kvm/lapic.c in the KVM subsystem in the Linux     kernel through 3.12.5 allows guest OS users to cause a     denial of service (host OS crash) via a crafted ICR     write operation in x2apic mode.(CVE-2013-6376)

  - The lbs_debugfs_write function in     drivers/net/wireless/libertas/debugfs.c in the Linux     kernel through 3.12.1 allows local users to cause a     denial of service (OOPS) by leveraging root privileges     for a zero-length write operation.(CVE-2013-6378)

  - The aac_send_raw_srb function in     drivers/scsi/aacraid/commctrl.c in the Linux kernel     through 3.12.1 does not properly validate a certain     size value, which allows local users to cause a denial     of service (invalid pointer dereference) or possibly     have unspecified other impact via an     FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted     SRB command.(CVE-2013-6380)

  - Multiple buffer underflows in the XFS implementation in     the Linux kernel through 3.12.1 allow local users to     cause a denial of service (memory corruption) or     possibly have unspecified other impact by leveraging     the CAP_SYS_ADMIN capability for a (1)     XFS_IOC_ATTRLIST_BY_HANDLE or (2)     XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted     length value, related to the xfs_attrlist_by_handle     function in fs/xfs/xfs_ioctl.c and the     xfs_compat_attrlist_by_handle function in     fs/xfs/xfs_ioctl32.c.(CVE-2013-6382)

  - The aac_compat_ioctl function in     drivers/scsi/aacraid/linit.c in the Linux kernel before     3.11.8 does not require the CAP_SYS_RAWIO capability,     which allows local users to bypass intended access     restrictions via a crafted ioctl call.(CVE-2013-6383)

  - The fib6_add function in net/ipv6/ip6_fib.c in the     Linux kernel before 3.11.5 does not properly implement     error-code encoding, which allows local users to cause     a denial of service (NULL pointer dereference and     system crash) by leveraging the CAP_NET_ADMIN     capability for an IPv6 SIOCADDRT ioctl     call.(CVE-2013-6431)

  - The uio_mmap_physical function in drivers/uio/uio.c in     the Linux kernel before 3.12 does not validate the size     of a memory block, which allows local users to cause a     denial of service (memory corruption) or possibly gain     privileges via crafted mmap operations, a different     vulnerability than CVE-2013-4511.(CVE-2013-6763)

  - Multiple race conditions in ipc/shm.c in the Linux     kernel before 3.12.2 allow local users to cause a     denial of service (use-after-free and system crash) or     possibly have unspecified other impact via a crafted     application that uses shmctl IPC_RMID operations in     conjunction with other shm system calls.(CVE-2013-7026)

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header.(CVE-2013-7027)

  - The Linux kernel before 3.12.4 updates certain length     values before ensuring that associated data structures     have been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call, related to net/ipv4/ping.c, net/ipv4/raw.c,     net/ipv4/udp.c, net/ipv6/raw.c, and     net/ipv6/udp.c.(CVE-2013-7263)

  - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in     the Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7264)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux Kernel was updated to version 3.11.10, fixing security issues and bugs :

  - floppy: bail out in open() if drive is not responding to     block0 read (bnc#773058).

  - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038).

  - HID: usbhid: fix sis quirk (bnc#859804).

  - hwmon: (coretemp) Fix truncated name of alarm attributes

  - HID: usbhid: quirk for Synaptics Quad HD touchscreen     (bnc#859804).

  - HID: usbhid: quirk for Synaptics HD touchscreen     (bnc#859804).

  - HID: usbhid: merge the sis quirk (bnc#859804).

  - HID: hid-multitouch: add support for SiS panels     (bnc#859804).

  - HID: usbhid: quirk for SiS Touchscreen (bnc#859804).

  - HID: usbhid: quirk for Synaptics Large Touchccreen     (bnc#859804).

  - drivers: net: cpsw: fix dt probe for one port ethernet.

  - drivers: net: cpsw: fix for cpsw crash when build as     modules.

  - dma: edma: Remove limits on number of slots.

  - dma: edma: Leave linked to Null slot instead of DUMMY     slot.

  - dma: edma: Find missed events and issue them.

  - dma: edma: Write out and handle MAX_NR_SG at a given     time.

  - dma: edma: Setup parameters to DMA MAX_NR_SG at a time.

  - ARM: edma: Add function to manually trigger an EDMA     channel.

  - ARM: edma: Fix clearing of unused list for DT DMA     resources.

  - ACPI: Add Toshiba NB100 to Vista _OSI blacklist.

  - ACPI: add missing win8 OSI comment to blacklist     (bnc#856294).

  - ACPI: update win8 OSI blacklist.

  - ACPI: blacklist win8 OSI for buggy laptops.

  - ACPI: blacklist win8 OSI for ASUS Zenbook Prime UX31A     (bnc#856294).

  - ACPI: Blacklist Win8 OSI for some HP laptop 2013 models     (bnc#856294).

  - floppy: bail out in open() if drive is not responding to     block0 read (bnc#773058).

  - ping: prevent NULL pointer dereference on write to     msg_name (bnc#854175 CVE-2013-6432).

  - x86/dumpstack: Fix printk_address for direct addresses     (bnc#845621).

  - Refresh patches.suse/stack-unwind.

  - Refresh patches.xen/xen-x86_64-dump-user-pgt.

  - KVM: x86: Convert vapic synchronization to _cached     functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368).

  - KVM: x86: fix guest-initiated crash with x2apic     (CVE-2013-6376) (bnc#853053 CVE-2013-6376).

  - Build the KOTD against openSUSE:13.1:Update

  - xencons: generalize use of add_preferred_console()     (bnc#733022, bnc#852652).

  - Update Xen patches to 3.11.10.

  - Rename patches.xen/xen-pcpu-hotplug to     patches.xen/xen-pcpu.

  - KVM: x86: Fix potential divide by 0 in lapic     (CVE-2013-6367) (bnc#853051 CVE-2013-6367).

  - KVM: Improve create VCPU parameter (CVE-2013-4587)     (bnc#853050 CVE-2013-4587).

  - ipv6: fix headroom calculation in udp6_ufo_fragment     (bnc#848042 CVE-2013-4563).

  - net: rework recvmsg handler msg_name and msg_namelen     logic (bnc#854722).

  - patches.drivers/gpio-ucb1400-add-module_alias.patch:
    Update upstream reference

  -     patches.drivers/gpio-ucb1400-can-be-built-as-a-module.pa     tch: Update upstream reference

  - Delete patches.suse/ida-remove-warning-dump-stack.patch.
    Already included in kernel 3.11 (WARN calls dump_stack.)

  - xhci: Limit the spurious wakeup fix only to HP machines     (bnc#852931).

  - iscsi_target: race condition on shutdown (bnc#850072).

  - Linux 3.11.10.

  - Refresh patches.xen/xen3-patch-2.6.29.

  - Delete     patches.suse/btrfs-relocate-csums-properly-with-prealloc
    -extents.patch.

  -     patches.drivers/xhci-Fix-spurious-wakeups-after-S5-on-Ha     swell.patch: (bnc#852931).

  - Build mei and mei_me as modules (bnc#852656)

  - Linux 3.11.9.

  - Linux 3.11.8 (CVE-2013-4511 bnc#846529 bnc#849021).

  - Delete     patches.drivers/ALSA-hda-Add-a-fixup-for-ASUS-N76VZ.

  - Delete     patches.fixes/Fix-a-few-incorrectly-checked-io_-remap_pf     n_range-ca.patch.

  - Add USB PHY support (needed to get USB and Ethernet     working on beagle and panda boards) Add     CONFIG_PINCTRL_SINGLE=y to be able to use Device tree     (at least for beagle and panda boards) Add ARM SoC sound     support Add SPI bus support Add user-space access to I2C     and SPI

  -     patches.arch/iommu-vt-d-remove-stack-trace-from-broken-i     rq-remapping-warning.patch: Fix forward porting, sorry.

  - iommu: Remove stack trace from broken irq remapping     warning (bnc#844513).

  - gpio: ucb1400: Add MODULE_ALIAS.

  - Allow NFSv4 username mapping to work properly     (bnc#838024).

  - nfs: check if gssd is running before attempting to use     krb5i auth in SETCLIENTID call.

  - sunrpc: replace sunrpc_net->gssd_running flag with a     more reliable check.

  - sunrpc: create a new dummy pipe for gssd to hold open.

  - Set CONFIG_GPIO_TWL4030 as built-in (instead of module)     as a requirement to boot on SD card on beagleboard xM

  - armv6hl, armv7hl: Update config files. Set     CONFIG_BATMAN_ADV_BLA=y as all other kernel     configuration files have.

  - Update config files :

  - CONFIG_BATMAN_ADV_NC=y, because other BATMAN_ADV options     are all enabled so why not this one.

  - CONFIG_GPIO_SCH=m, CONFIG_GPIO_PCH=m, because we support     all other features of these pieces of hardware.

  - CONFIG_INTEL_POWERCLAMP=m, because this small driver     might be useful in specific cases, and there's no     obvious reason not to include it.

  - Fix a few incorrectly checked [io_]remap_pfn_range()     calls (bnc#849021, CVE-2013-4511).

  - Linux 3.11.7.

Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (panic). (CVE-2013-4563)

Mathy Vanhoef discovered an error in the the way the ath9k driver was handling the BSSID masking. A remote attacker could exploit this error to discover the original MAC address after a spoofing atack.
(CVE-2013-4579)

Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu function of the Kernel Virtual Machine (KVM) subsystem. A local user could exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)

Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could exploit this flaw to cause a denial of service or host OS system crash. (CVE-2013-6367)

Andrew Honig reported an error in the Linux Kernel's Kernel Virtual Machine (KVM) VAPIC synchronization operation. A local user could exploit this flaw to gain privileges or cause a denial of service (system crash). (CVE-2013-6368)

Lars Bull discovered a flaw in the recalculate_apic_map function of the Kernel Virtual Machine (KVM) subsystem in the Linux kernel. A guest OS user could exploit this flaw to cause a denial of service (host OS crash). (CVE-2013-6376)

Nico Golde and Fabian Yamaguchi reported buffer underflow errors in the implementation of the XFS filesystem in the Linux kernel. A local user with CAP_SYS_ADMIN could exploit these flaw to cause a denial of service (memory corruption) or possibly other unspecified issues.
(CVE-2013-6382)

A flaw was discovered in the ipv4 ping_recvmsg function of the Linux kernel. A local user could exploit this flaw to cause a denial of service (NULL pointer dereference and system crash). (CVE-2013-6432)

mpd reported an information leak in the recvfrom, recvmmsg, and recvmsg system calls in the Linux kernel. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7263)

mpb reported an information leak in the Layer Two Tunneling Protocol (l2tp) of the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7264)

mpb reported an information leak in the Phone Network protocol (phonet) in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7265)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with ISDN sockets in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7266)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with apple talk sockets in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7267)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with ipx protocol sockets in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7268)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with the netrom address family in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7269)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with packet address family sockets in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7270)

An information leak was discovered in the recvfrom, recvmmsg, and recvmsg systemcalls when used with x25 protocol sockets in the Linux kernel. A local user could exploit this leak to obtain potentially sensitive information from kernel memory. (CVE-2013-7271)

mpb reported an information leak in the Low-Rate Wireless Personal Area Networks support (IEEE 802.15.4) in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel stack memory. (CVE-2013-7281)

halfdog reported an error in the AMD K7 and K8 platform support in the Linux kernel. An unprivileged local user could exploit this flaw on AMD based systems to cause a denial of service (task kill) or possibly gain privileges via a crafted application. (CVE-2014-1438)

An information leak was discovered in the Linux kernel's hamradio YAM driver for AX.25 packet radio. A local user with the CAP_NET_ADMIN capability could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-1446).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The stable 3.11.9 update contains a number of important fixes across the tree. The 3.11.8 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The stable 3.11.9 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	high
124823	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1500)	Nessus	Huawei Local Security Checks	high
124799	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1475)	Nessus	Huawei Local Security Checks	high
75252	openSUSE Security Update : kernel (openSUSE-SU-2014:0205-1)	Nessus	SuSE Local Security Checks	high
72578	Ubuntu 13.10 : linux vulnerabilities (USN-2117-1)	Nessus	Ubuntu Local Security Checks	high
72576	Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2113-1)	Nessus	Ubuntu Local Security Checks	high
71142	Fedora 18 : kernel-3.11.9-100.fc18 (2013-21822)	Nessus	Fedora Local Security Checks	high
71068	Fedora 20 : kernel-3.11.9-300.fc20 (2013-21967)	Nessus	Fedora Local Security Checks	high
71067	Fedora 19 : kernel-3.11.9-200.fc19 (2013-21807)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-4563

high

Tenable Plugins

high

high

high

high

high

high

high

high

high