On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Buffer overflow due to unbounded strcpy in ISDN I4L driver (CVE-2017-12762)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group     ID of zero from reaching the swapper process, which allows local users to cause a denial of service     (system crash) by leveraging access to this process group. (CVE-2010-5328)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017)

  - The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service     (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid     Register Stack Engine (RSE) state. (CVE-2006-3635)

  - drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize     videobuf_mapping data structures, which allows local users to trigger an incorrect count value and     videobuf leak via unspecified vectors, a different vulnerability than CVE-2010-5321. (CVE-2007-6761)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for kernel-firmware fixes the following issues :

  - CVE-2015-1142857: Add 7.13.1.0 bnx2x firmware files to     fix a ethernet flow control vulnerability in SRIOV     devices (bsc#1077355)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2018-5332: In the Linux kernel the     rds_message_alloc_sgs() function did not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c)     (bnc#1075621).

  - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic     function in net/rds/rdma.c mishandled cases where page     pinning fails or an invalid address is supplied, leading     to an rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel allowed     remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

  - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux     kernel allowed attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact because the port->exists     value can change after it is validated (bnc#1077922).

  - CVE-2015-1142857: On multiple SR-IOV cars it is possible     for VF's assigned to guests to send ethernet flow     control pause frames via the PF. (bnc#1077355).

  - CVE-2017-17741: The KVM implementation in the Linux     kernel allowed attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio     stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h     (bnc#1073311).

  - CVE-2017-13215: A elevation of privilege vulnerability     in the Upstream kernel skcipher. (bnc#1075908).

  - CVE-2018-1000004: In the Linux kernel a race condition     vulnerability existed in the sound system, this can lead     to a deadlock and denial of service condition     (bnc#1076017).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-18079: drivers/input/serio/i8042.c allowed     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact because the port->exists value     can change after it is validated (bnc#1077922).

  - CVE-2015-1142857: Prevent guests from sending ethernet     flow control pause frames via the PF (bnc#1077355).

  - CVE-2017-17741: KVM allowed attackers to obtain     potentially sensitive information from kernel memory,     aka a write_mmio stack-based out-of-bounds read     (bnc#1073311).

  - CVE-2017-13215: Prevent elevation of privilege     (bnc#1075908).

  - CVE-2018-1000004: Prevent race condition in the sound     system, this could have lead a deadlock and denial of     service condition (bnc#1076017).

  - CVE-2017-17806: The HMAC implementation did not validate     that the underlying cryptographic hash algorithm is     unkeyed, allowing a local attacker able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874).

  - CVE-2017-17805: The Salsa20 encryption algorithm did not     correctly handle zero-length inputs, allowing a local     attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-18079: drivers/input/serio/i8042.c allowed     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact because the port->exists value     can change after it is validated (bnc#1077922)

  - CVE-2015-1142857: Prevent guests from sending ethernet     flow control pause frames via the PF (bnc#1077355)

  - CVE-2017-17741: KVM allowed attackers to obtain     potentially sensitive information from kernel memory,     aka a write_mmio stack-based out-of-bounds read     (bnc#1073311)

  - CVE-2017-13215: Prevent elevation of privilege     (bnc#1075908)

  - CVE-2018-1000004: Prevent race condition in the sound     system, this could have lead a deadlock and denial of     service condition (bnc#1076017)

  - CVE-2017-17806: The HMAC implementation did not validate     that the underlying cryptographic hash algorithm is     unkeyed, allowing a local attacker able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874)

  - CVE-2017-17805: The Salsa20 encryption algorithm did not     correctly handle zero-length inputs, allowing a local     attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199273	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199257	RHEL 5 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
108392	openSUSE Security Update : kernel-firmware (openSUSE-2018-262)	Nessus	SuSE Local Security Checks	high
107055	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0555-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	critical
106967	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0525-1) (Spectre)	Nessus	SuSE Local Security Checks	high
106815	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0437-1) (Spectre)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-1142857

high

Tenable Plugins

critical

critical

critical

high

critical

high

high