The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.

The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's key management     system where it was possible for an attacker to escalate     privileges or crash the machine. If a user key gets     negatively instantiated, an error code is cached in the     payload area. A negatively instantiated key may be then     be positively instantiated by updating it with valid     data. However, the ->update key type method must be     aware that the error code may be there. (CVE-2015-8539)

  - A flaw was found in the way the Linux KVM module     processed the trap flag(TF) bit in EFLAGS during     emulation of the syscall instruction, which leads to a     debug exception(#DB) being raised in the guest stack. A     user/process inside a guest could use this flaw to     potentially escalate their privileges inside the guest.
    Linux guests are not affected by this. (CVE-2017-7518)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on a negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel. (CVE-2017-12192)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the system.
    (CVE-2017-12188)

  - A flaw was found in the Linux kernel's implementation of     associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null pointer     dereference in assoc_array_apply_edit() due to incorrect     node-splitting in assoc_array implementation. This     affects the keyring key type and thus key addition and     link creation operations may cause the kernel to panic.
    (CVE-2017-12193)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free bug. (CVE-2017-15649)

  - A vulnerability was found in the Linux kernel where the     keyctl_set_reqkey_keyring() function leaks the thread     keyring. This allows an unprivileged local user to     exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization(nVMX) feature     enabled(nested=1), is vulnerable to host memory leakage     issue. It could occur while emulating VMXON instruction     in 'handle_vmon'. An L1 guest user could use this flaw     to leak host memory potentially resulting in     DoS.(CVE-2017-2596i1/4%0

  - The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST     extension implementations in the sk_run_filter function     in net/core/filter.c in the Linux kernel through 3.14.3     do not check whether a certain length value is     sufficiently large, which allows local users to cause a     denial of service (integer underflow and system crash)     via crafted BPF instructions. NOTE: the affected code     was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the     vulnerability was announced.(CVE-2014-3144i1/4%0

  - A flaw was found in the Linux kernel when freeing pages     in hugetlbfs. This could trigger a local denial of     service by crashing the kernel.(CVE-2017-15127i1/4%0

  - An issue was discovered in the Linux kernel before 4.8.
    Incorrect access checking in overlayfs mounts could be     used by local attackers to modify or truncate files in     the underlying filesystem.(CVE-2018-16597i1/4%0

  - Memory leak in the cuse_channel_release function in     fs/fuse/cuse.c in the Linux kernel before 4.4 allows     local users to cause a denial of service (memory     consumption) or possibly have unspecified other impact     by opening /dev/cuse many times.(CVE-2015-1339i1/4%0

  - A flaw was found in the way the Linux kernel's nested     NMI handler and espfix64 functionalities interacted     during NMI processing. A local, unprivileged user could     use this flaw to crash the system or, potentially,     escalate their privileges on the     system.(CVE-2015-3290i1/4%0

  - Multiple array index errors in     drivers/hid/hid-multitouch.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_MULTITOUCH is enabled, allow     physically proximate attackers to cause a denial of     service (heap memory corruption, or NULL pointer     dereference and OOPS) via a crafted     device.(CVE-2013-2897i1/4%0

  - A flaw was found in the way the Linux kernel's futex     subsystem handled the requeuing of certain Priority     Inheritance (PI) futexes. A local, unprivileged user     could use this flaw to escalate their privileges on the     system.(CVE-2014-3153i1/4%0

  - The XFS subsystem in the Linux kernel 4.4 and later     allows local users to cause a denial of service     (fdatasync() failure and system hang) by using the vfs     syscall group in the 'trinity' program, as a result of     a page lock order bug in the XFS seek hole/data     implementation.(CVE-2016-8660i1/4%0

  - A flaw was found in the Linux kernel's key management     system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key     gets negatively instantiated, an error code is cached     in the payload area. A negatively instantiated key may     be then be positively instantiated by updating it with     valid data. However, the -i1/4zupdate key type method     must be aware that the error code may be     there.(CVE-2015-8539i1/4%0

  - It was found that the Linux kernel KVM subsystem's     sysenter instruction emulation was not sufficient. An     unprivileged guest user could use this flaw to escalate     their privileges by tricking the hypervisor to emulate     a SYSENTER instruction in 16-bit mode, if the guest OS     did not initialize the SYSENTER model-specific     registers (MSRs). Note: Certified guest operating     systems for Red Hat Enterprise Linux with KVM do     initialize the SYSENTER MSRs and are thus not     vulnerable to this issue when running on a KVM     hypervisor.(CVE-2015-0239i1/4%0

  - An information leak flaw was found in the way the Linux     kernel handled media device enumerate entities IOCTL     requests. A local user able to access the /dev/media0     device file could use this flaw to leak kernel memory     bytes.(CVE-2014-1739i1/4%0

  - The dgnc_mgmt_ioctl function in     drivers/staging/dgnc/dgnc_mgmt.c in the Linux kernel     through 4.3.3 does not initialize a certain structure     member, which allows local users to obtain sensitive     information from kernel memory via a crafted     application.(CVE-2015-7885i1/4%0

  - An information leak was discovered in the Linux kernel     in cdrom_ioctl_drive_status() function in     drivers/cdrom/cdrom.c that could be used by local     attackers to read kernel memory at certain     location.(CVE-2018-16658i1/4%0

  - A flaw was discovered in the Linux kernel's     implementation of VFIO. An attacker issuing an ioctl     can create a situation where memory is corrupted and     modify memory outside of the expected area. This may     overwrite kernel memory and subvert kernel     execution.(CVE-2016-9083i1/4%0

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invvpid     (Invalidate Translations Based on VPID) instructions.
    On hosts with an Intel processor and invppid VM exit     support, an unprivileged guest user could use these     instructions to crash the guest.(CVE-2014-3646i1/4%0

  - An attacker on a network could abuse a flaw in the IPv6     stack fragment reassembly code to induce kernel memory     corruption on the system, possibly leading to a system     crash.(CVE-2016-9755i1/4%0

  - It was found that a regular user could remove xattr     permissions on files by using the chown or write system     calls. A local attacker could use this flaw to deny     elevated permissions from valid users, services, or     applications, potentially resulting in a denial of     service.(CVE-2015-1350i1/4%0

  - arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux     kernel through 4.7 on PowerPC platforms, when     CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS     users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence     of a suspended transaction.(CVE-2016-5412i1/4%0

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An information-leak vulnerability was found in the     kernel when it truncated a file to a smaller size which     consisted of an inline extent that was compressed. The     data between the new file size and the old file size     was not discarded and the number of bytes used by the     inode were not correctly decremented, which gave the     wrong report for callers of the stat(2) syscall. This     wasted metadata space and allowed for the truncated     data to be leaked, and data corruption or loss to     occur. A caller of the clone ioctl could exploit this     flaw by using only standard file-system operations     without root access to read the truncated     data.(CVE-2015-8374)

  - A flaw was found in the Linux kernel's key management     system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key     gets negatively instantiated, an error code is cached     in the payload area. A negatively instantiated key may     be then be positively instantiated by updating it with     valid data. However, the -i1/4zupdate key type method     must be aware that the error code may be     there.(CVE-2015-8539)

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's network subsystem handled socket     creation with an invalid protocol identifier. A local     user could use this flaw to crash the     system.(CVE-2015-8543)

  - An out-of-bounds flaw was found in the kernel, where     the length of the sockaddr parameter was not checked in     the pptp_bind() and pptp_connect() functions. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local system user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8569)

  - An out-of-bounds flaw was found in the kernel, where     the sco_sock_bind() function (bluetooth/sco) did not     check the length of its sockaddr parameter. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8575)

  - The ovl_setattr function in fs/overlayfs/inode.c in the     Linux kernel through 4.3.3 attempts to merge distinct     setattr operations, which allows local users to bypass     intended access restrictions and modify the attributes     of arbitrary overlay files via a crafted     application.(CVE-2015-8660)

  - A NULL pointer dereference flaw was found in the Linux     kernel: the NFSv4.2 migration code improperly     initialized the kernel structure. A local,     authenticated user could use this flaw to cause a panic     of the NFS client (denial of service).(CVE-2015-8746)

  - A race condition flaw was found in the way the Linux     kernel's SCTP implementation handled sctp_accept()     during the processing of heartbeat timeout events. A     remote attacker could use this flaw to prevent further     connections to be accepted by the SCTP server running     on the system, resulting in a denial of     service.(CVE-2015-8767)

  - An infinite-loop flaw was found in the kernel. When a     local user calls the sys_writev syscall with a     specially crafted sequence of iov structs, the     fuse_fill_write_pages kernel function might never     terminate, instead continuing in a tight loop. This     process cannot be terminated and requires a     reboot.(CVE-2015-8785)

  - A NULL-pointer dereference vulnerability was found in     the Linux kernel's TCP stack, in     net/netfilter/nf_nat_redirect.c in the     nf_nat_redirect_ipv4() function. A remote,     unauthenticated user could exploit this flaw to create     a system crash (denial of service).(CVE-2015-8787)

  - A use-after-free flaw was found in the CXGB3 kernel     driver when the network was considered to be congested.
    The kernel incorrectly misinterpreted the congestion as     an error condition and incorrectly freed or cleaned up     the socket buffer (skb). When the device then sent the     skb's queued data, these structures were referenced. A     local attacker could use this flaw to panic the system     (denial of service) or, with a local account, escalate     their privileges.(CVE-2015-8812)

  - The hub_activate function in drivers/usb/core/hub.c in     the Linux kernel before 4.3.5 does not properly     maintain a hub-interface data structure, which allows     physically proximate attackers to cause a denial of     service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device.(CVE-2015-8816)

  - The ioresources_init function in kernel/resource.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 6 and 7 (2013) devices, uses weak     permissions for /proc/iomem, which allows local users     to obtain sensitive information by reading this file,     aka Android internal bug 28814213 and Qualcomm internal     bug CR786116. NOTE: the permissions may be intentional     in most non-Android contexts.(CVE-2015-8944)

  - 'A flaw was found in the Linux kernel's implementation     of overlayfs. An attacker can leak file resources in     the system by opening a large file with write     permissions on a overlay filesystem that is     insufficient to deal with the size of the write.

  - When unmounting the underlying device, the system is     unable to free an inode and this will consume     resources. Repeating this for all available inodes and     memory will create a denial of service     situation.(CVE-2015-8953)'

  - The rfcomm_sock_bind function in     net/bluetooth/rfcomm/sock.c in the Linux kernel before     4.2 allows local users to obtain sensitive information     or cause a denial of service (NULL pointer dereference)     via vectors involving a bind system call on a Bluetooth     RFCOMM socket.(CVE-2015-8956)

  - A flaw was found in the ext4 subsystem. This     vulnerability is a use after free vulnerability was     found in __ext4_journal_stop(). Attackers could abuse     this to allow any code which attempts to deal with the     journal failure to be mishandled or not fail at all.
    This could lead to data corruption or     crashes.(CVE-2015-8961)

  - A flaw was found in the Linux kernel SCSI subsystem,     which allowed a local user to gain privileges or cause     a denial of service (memory corruption and system     crash) by issuing an SG_IO ioctl call while a device     was being detached.(CVE-2015-8962)

  - Race condition in kernel/events/core.c in the Linux     kernel before 4.4 allows local users to gain privileges     or cause a denial of service via use-after-free     vulnerability by leveraging incorrect handling of an     swevent data structure during a CPU unplug     operation.(CVE-2015-8963)

  - The tty_set_termios_ldisc() function in     'drivers/tty/tty_ldisc.c' in the Linux kernel before     4.5 allows local users to obtain sensitive information     from kernel memory by reading a tty data     structure.(CVE-2015-8964)

  - The lrw_crypt() function in 'crypto/lrw.c' in the Linux     kernel before 4.5 allows local users to cause a system     crash and a denial of service by the NULL pointer     dereference via accept(2) system call for AF_ALG socket     without calling setkey() first to set a cipher     key.(CVE-2015-8970)

  - It was found that kernel/events/core.c in the Linux     kernel mishandles counter grouping, which allows local     users to gain privileges via a crafted application,     related to the perf_pmu_register and perf_event_open     functions.(CVE-2015-9004)

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3798-1 advisory.

    Dmitry Vyukov discovered that the key management subsystem in the Linux kernel did not properly restrict     adding a key that already exists but is negatively instantiated. A local attacker could use this to cause     a denial of service (system crash) or possibly execute arbitrary code. (CVE-2015-8539)

    It was discovered that a use-after-free vulnerability existed in the device driver for XCeive     xc2028/xc3028 tuners in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2016-7913)

    Pengfei Ding (), Chenfu Bao (), and Lenx Wei () discovered a race condition in the     generic SCSI driver (sg) of the Linux kernel. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-0794)

    Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict     adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)

    It was discovered that a NULL pointer dereference could be triggered in the OCFS2 file system     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-18216)

    Luo Quan and Wei Yang discovered that a race condition existed in the Advanced Linux Sound Architecture     (ALSA) subsystem of the Linux kernel when handling ioctl()s. A local attacker could use this to cause a     denial of service (system deadlock). (CVE-2018-1000004)

     discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA)     subsystem of the Linux kernel that could lead to a use- after-free or an out-of-bounds buffer access. A     local attacker with access to /dev/snd/seq could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7566)

    It was discovered that a buffer overflow existed in the NFC Logical Link Control Protocol (llcp)     implementation in the Linux kernel. An attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2018-9518)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0181 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the Linux kernel's key management system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is     cached in the payload area. A negatively instantiated key may be then be positively instantiated by     updating it with valid data. However, the ->update key type method must be aware that the error code may     be there. (CVE-2015-8539, Important)

    * It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6,     allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout     data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free bug. (CVE-2017-15649, Important)

    * A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the     thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472, Moderate)

    Red Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.

    Bug Fix(es):

    * The mlx5 driver has a number of configuration options, including the selective support for network     protocols, such as InfiniBand and Ethernet. Due to a regression in the configuration of the MRG-RT kernel,     the Ethernet mode of the driver was turned off. The regression has been resolved by enabling the mlx5     Ethernet mode, making the Ethernet protocol to work again. (BZ#1422778)

    * The migrate_disable/enable() kernel operations are used to pin a thread to a CPU temporarily. This     method is a kernel-rt specific. To keep RHEL-RT's kernel up-to-date with the latest real-time kernel, the     migrate_disable/enable routine was updated to the version present on kernel v4.9-rt. However, this version     showed to be problematic. The changes in the migrate_disable/enabled have been thus reverted to a stable     version, avoiding the kernel BUG. (BZ#1507831)

    * The kernel-rt packages have been upgraded to version 3.10.0-693.15.1.rt56.601, which provides a number     of security and bug fixes over the previous version. (BZ#1519504)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0151 advisory.

    - [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
    - [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}
    - [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}
    - [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
    - [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}
    - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}
    - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli)     [1519795 1519798] {CVE-2017-5715}
    - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
    - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798]     {CVE-2017-5715}
    - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795     1519798] {CVE-2017-5715}
    - [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798]     {CVE-2017-5715}
    - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli)     [1519795 1519798] {CVE-2017-5715}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact.

In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided.

* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)

* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)

* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
(CVE-2017-5754, Important)

Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754.

This update also fixes the following security issues and bugs :

Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article:
https://access.redhat.com/articles/ 3327131.

Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty.

* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)

* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)

* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
(CVE-2017-5754, Important)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0152 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the Linux kernel's key management system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is     cached in the payload area. A negatively instantiated key may be then be positively instantiated by     updating it with valid data. However, the ->update key type method must be aware that the error code may     be there. (CVE-2015-8539, Important)

    * It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6,     allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout     data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free bug. (CVE-2017-15649, Important)

    * A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the     thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472, Moderate)

    Red Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.

    Bug Fix(es):

    * The kernel-rt packages have been upgraded to 3.10.0-693.15.1 source tree, which provides a number of bug     fixes over the previous version. (BZ#1519506)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0151 advisory.

  - kernel: local privesc in key management (CVE-2015-8539)

  - hw: cpu: speculative execution bounds-check bypass (CVE-2017-5753)

  - kernel: keyctl_set_reqkey_keyring() leaks thread keyrings (CVE-2017-7472)

  - kernel: NULL pointer dereference due to KEYCTL_READ on negative key (CVE-2017-12192)

  - kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation     (CVE-2017-12193)

  - kernel: Use-after-free in the af_packet.c (CVE-2017-15649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - Fixed handling of stored error in a negatively     instantiated user key. Key management subsystems could     be abused to escalate privileges through memory     corruption. All kernels were affected.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP2 kernel was updated to receive various security and bug fixes. The following security bugs were fixed :

  - CVE-2016-4486: Fixed 4 byte information leak in     net/core/rtnetlink.c (bsc#978822).

  - CVE-2016-3134: The netfilter subsystem in the Linux     kernel did not validate certain offset fields, which     allowed local users to gain privileges or cause a denial     of service (heap memory corruption) via an     IPT_SO_SET_REPLACE setsockopt call (bnc#971126).

  - CVE-2016-2847: fs/pipe.c in the Linux kernel did not     limit the amount of unread data in pipes, which allowed     local users to cause a denial of service (memory     consumption) by creating many pipes with non-default     sizes (bnc#970948).

  - CVE-2016-2188: The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a crafted endpoints value in a USB device descriptor     (bnc#970956).

  - CVE-2016-3138: The acm_probe function in     drivers/usb/class/cdc-acm.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) via     a USB device without both a control and a data endpoint     descriptor (bnc#970911).

  - CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions (bnc#970970).

  - CVE-2016-3140: The digi_port_init function in     drivers/usb/serial/digi_acceleport.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970892).

  - CVE-2016-2186: The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970958).

  - CVE-2016-2185: The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#971124).

  - CVE-2016-3156: The IPv4 implementation in the Linux     kernel mishandles destruction of device objects, which     allowed guest OS users to cause a denial of service     (host OS networking outage) by arranging for a large     number of IP addresses (bnc#971360).

  - CVE-2016-2184: The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (NULL pointer dereference or     double free, and system crash) via a crafted endpoints     value in a USB device descriptor (bnc#971125).

  - CVE-2016-3139: The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor     (bnc#970909).

  - CVE-2016-2143: The fork implementation in the Linux     kernel on s390 platforms mishandled the case of four     page-table levels, which allowed local users to cause a     denial of service (system crash) or possibly have     unspecified other impact via a crafted application,     related to arch/s390/include/asm/mmu_context.h and     arch/s390/include/asm/pgalloc.h (bnc#970504).

  - CVE-2016-2782: The treo_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a (1) bulk-in or (2) interrupt-in     endpoint (bnc#968670).

  - CVE-2015-8816: The hub_activate function in     drivers/usb/core/hub.c in the Linux kernel did not     properly maintain a hub-interface data structure, which     allowed physically proximate attackers to cause a denial     of service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device (bnc#968010).

  - CVE-2015-7566: The clie_5_attach function in     drivers/usb/serial/visor.c in the Linux kernel allowed     physically proximate attackers to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact by inserting a     USB device that lacks a bulk-out endpoint (bnc#961512).

  - CVE-2016-2549: sound/core/hrtimer.c in the Linux kernel     did not prevent recursive callback access, which allowed     local users to cause a denial of service (deadlock) via     a crafted ioctl call (bnc#968013).

  - CVE-2016-2547: sound/core/timer.c in the Linux kernel     employed a locking approach that did not consider slave     timer instances, which allowed local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl call (bnc#968011).

  - CVE-2016-2548: sound/core/timer.c in the Linux kernel     retained certain linked lists after a close or stop     action, which allowed local users to cause a denial of     service (system crash) via a crafted ioctl call, related     to the (1) snd_timer_close and (2) _snd_timer_stop     functions (bnc#968012).

  - CVE-2016-2546: sound/core/timer.c in the Linux kernel     used an incorrect type of mutex, which allowed local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call (bnc#967975).

  - CVE-2016-2545: The snd_timer_interrupt function in     sound/core/timer.c in the Linux kernel did not properly     maintain a certain linked list, which allowed local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl call (bnc#967974).

  - CVE-2016-2544: Race condition in the queue_delete     function in sound/core/seq/seq_queue.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time (bnc#967973).

  - CVE-2016-2543: The snd_seq_ioctl_remove_events function     in sound/core/seq/seq_clientmgr.c in the Linux kernel     did not verify FIFO assignment before proceeding with     FIFO clearing, which allowed local users to cause a     denial of service (NULL pointer dereference and OOPS)     via a crafted ioctl call (bnc#967972).

  - CVE-2016-2384: Double free vulnerability in the     snd_usbmidi_create function in sound/usb/midi.c in the     Linux kernel allowed physically proximate attackers to     cause a denial of service (panic) or possibly have     unspecified other impact via vectors involving an     invalid USB descriptor (bnc#966693).

  - CVE-2015-8812: drivers/infiniband/hw/cxgb3/iwch_cm.c in     the Linux kernel did not properly identify error     conditions, which allowed remote attackers to execute     arbitrary code or cause a denial of service     (use-after-free) via crafted packets (bnc#966437).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2016-2069: Race condition in arch/x86/mm/tlb.c in     the Linux kernel .4.1 allowed local users to gain     privileges by triggering access to a paging structure by     a different CPU (bnc#963767).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-7515: The aiptek_probe function in     drivers/input/tablet/aiptek.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (NULL pointer dereference and system crash)     via a crafted USB device that lacks endpoints     (bnc#956708).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272 (bnc#955354).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956709).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8104: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #DB (aka     Debug) exceptions, related to svm.c (bnc#954404).

  - CVE-2015-5307: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (host OS panic or hang) by triggering many #AC (aka     Alignment Check) exceptions, related to svm.c and vmx.c     (bnc#953527).

  - CVE-2015-7990: Race condition in the rds_sendmsg     function in net/rds/sendmsg.c in the Linux kernel     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#952384).

  - CVE-2015-7872: The key_gc_unused_keys function in     security/keys/gc.c in the Linux kernel allowed local     users to cause a denial of service (OOPS) via crafted     keyctl commands (bnc#951440).

  - CVE-2015-6937: The __rds_conn_create function in     net/rds/connection.c in the Linux kernel allowed local     users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact by using a socket that was not     properly bound (bnc#945825).

  - CVE-2015-6252: The vhost_dev_ioctl function in     drivers/vhost/vhost.c in the Linux kernel allowed local     users to cause a denial of service (memory consumption)     via a VHOST_SET_LOG_FD ioctl call that triggers     permanent file-descriptor allocation (bnc#942367).

  - CVE-2015-3339: Race condition in the prepare_binprm     function in fs/exec.c in the Linux kernel allowed local     users to gain privileges by executing a setuid program     at a time instant when a chown to root is in progress,     and the ownership is changed but the setuid bit is not     yet stripped (bnc#928130).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7509: fs/ext4/namei.c in the Linux kernel     allowed physically proximate attackers to cause a denial     of service (system crash) via a crafted no-journal     filesystem, a related issue to CVE-2013-2015     (bnc#956707).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7566: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#961512).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that is (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is     limited to the NetworkManager product (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988). (bsc#957988 XSA-155).

  - CVE-2015-8551: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to hit BUG     conditions and cause a denial of service (NULL pointer     dereference and host OS crash) by leveraging a system     with access to a passed-through MSI or MSI-X capable     physical PCI device and a crafted sequence of     XEN_PCI_OP_* operations, aka 'Linux pciback missing     sanity checks (bnc#957990).

  - CVE-2015-8552: The PCI backend driver in Xen, when     running on an x86 system and using Linux as the driver     domain, allowed local guest administrators to generate a     continuous stream of WARN messages and cause a denial of     service (disk consumption) by leveraging a system with     access to a passed-through MSI or MSI-X capable physical     PCI device and XEN_PCI_OP_enable_msi operations, aka     'Linux pciback missing sanity checks (bnc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     do not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A flaw was found in the CXGB3 kernel     driver when the network was considered congested. The     kernel would incorrectly misinterpret the congestion as     an error condition and incorrectly free/clean up the     skb. When the device would then send the skb's queued,     these structures would be referenced and may panic the     system or allow an attacker to escalate privileges in a     use-after-free scenario.(bsc#966437).

  - CVE-2015-8816: A malicious USB device could cause kernel     crashes in the in hub_activate() function (bnc#968010).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

  - CVE-2016-2143: On zSeries a fork of a large process     could have caused memory corruption due to incorrect     page table handling. (bnc#970504, LTC#138810).

  - CVE-2016-2184: A malicious USB device could cause kernel     crashes in the alsa usb-audio device driver     (bsc#971125).

  - CVE-2016-2185: A malicious USB device could cause kernel     crashes in the usb_driver_claim_interface function     (bnc#971124).

  - CVE-2016-2186: A malicious USB device could cause kernel     crashes in the powermate device driver (bnc#970958).

  - CVE-2016-2384: A double free on the ALSA umidi object     was fixed. (bsc#966693).

  - CVE-2016-2543: A missing NULL check at remove_events     ioctl in the ALSA seq driver was fixed. (bsc#967972).

  - CVE-2016-2544: Fix race at timer setup and close in the     ALSA seq driver was fixed. (bsc#967973).

  - CVE-2016-2545: A double unlink of active_list in the     ALSA timer driver was fixed. (bsc#967974).

  - CVE-2016-2546: A race among ALSA timer ioctls was fixed     (bsc#967975).

  - CVE-2016-2547,CVE-2016-2548: The ALSA slave timer list     handling was hardened against hangs and races.
    (CVE-2016-2547,CVE-2016-2548,bsc#968011,bsc#968012).

  - CVE-2016-2549: A stall in ALSA hrtimer handling was     fixed (bsc#968013).

  - CVE-2016-2782: A malicious USB device could cause kernel     crashes in the visor device driver (bnc#968670).

  - CVE-2016-3137: A malicious USB device could cause kernel     crashes in the cypress_m8 device driver (bnc#970970).

  - CVE-2016-3139: A malicious USB device could cause kernel     crashes in the wacom device driver (bnc#970909).

  - CVE-2016-3140: A malicious USB device could cause kernel     crashes in the digi_acceleport device driver     (bnc#970892).

  - CVE-2016-3156: A quadratic algorithm could lead to long     kernel ipv4 hangs when removing a device with a large     number of addresses. (bsc#971360).

  - CVE-2016-3955: A remote buffer overflow in the usbip     driver could be used by authenticated attackers to crash     the kernel. (bsc#975945)

  - CVE-2016-2847: A local user could exhaust kernel memory     by pushing lots of data into pipes. (bsc#970948).

  - CVE-2016-2188: A malicious USB device could cause kernel     crashes in the iowarrior device driver (bnc#970956).

  - CVE-2016-3138: A malicious USB device could cause kernel     crashes in the cdc-acm device driver (bnc#970911).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following feature was added to kernel-xen :

  - A improved XEN blkfront module was added, which allows     more I/O bandwidth. (FATE#320200) It is called     xen-blkfront in PV, and xen-vbd-upstream in HVM mode.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-7515: An out of bounds memory access in the     aiptek USB driver could be used by physical local     attackers to crash the kernel (bnc#956708).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959190 bnc#959399).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2015-8812: A use-after-free flaw was found in the     CXGB3 kernel driver when the network was considered to     be congested. This could be used by local attackers to     cause machine crashes or potentially code execution     (bsc#966437).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: Race conditions in TLB syncing was fixed     which could leak to information leaks (bnc#963767).

  - CVE-2016-2384: Removed a double free in the ALSA     usb-audio driver in the umidi object which could lead to     crashes (bsc#966693).

  - CVE-2016-2543: Added a missing NULL check at     remove_events ioctl in ALSA that could lead to crashes.
    (bsc#967972).

  - CVE-2016-2544, CVE-2016-2545, CVE-2016-2546,     CVE-2016-2547, CVE-2016-2548, CVE-2016-2549: Various     race conditions in ALSAs timer handling were fixed.
    (bsc#967975, bsc#967974, bsc#967973, bsc#968011,     bsc#968012, bsc#968013).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.53 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2013-7446: Use-after-free vulnerability in     net/unix/af_unix.c in the Linux kernel allowed local     users to bypass intended AF_UNIX socket permissions or     cause a denial of service (panic) via crafted epoll_ctl     calls (bnc#955654).

  - CVE-2015-5707: Integer overflow in the sg_start_req     function in drivers/scsi/sg.c in the Linux kernel     allowed local users to cause a denial of service or     possibly have unspecified other impact via a large     iov_count value in a write request (bnc#940338).

  - CVE-2015-7550: The keyctl_read_key function in     security/keys/keyctl.c in the Linux kernel did not     properly use a semaphore, which allowed local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted application that leverages a race     condition between keyctl_revoke and keyctl_read calls     (bnc#958951).

  - CVE-2015-7799: The slhc_init function in     drivers/net/slip/slhc.c in the Linux kernel did not     ensure that certain slot numbers are valid, which     allowed local users to cause a denial of service (NULL     pointer dereference and system crash) via a crafted     PPPIOCSMAXCID ioctl call (bnc#949936).

  - CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in     the Linux kernel did not validate attempted changes to     the MTU value, which allowed context-dependent attackers     to cause a denial of service (packet loss) via a value     that was (1) smaller than the minimum compliant value or     (2) larger than the MTU of an interface, as demonstrated     by a Router Advertisement (RA) message that is not     validated by a daemon, a different vulnerability than     CVE-2015-0272 (bnc#955354).

  - CVE-2015-8539: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (BUG) via crafted keyctl commands that     negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c,     security/keys/trusted.c, and     security/keys/user_defined.c (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Optimizations introduced by the compiler     could have lead to double fetch vulnerabilities,     potentially possibly leading to arbitrary code execution     in backend (bsc#957988).

  - CVE-2015-8551: Xen PCI backend driver did not perform     proper sanity checks on the device's state, allowing for     DoS (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: The sco_sock_bind function in     net/bluetooth/sco.c in the Linux kernel did not verify     an address length, which allowed local users to obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism via a crafted application     (bnc#959399).

  - CVE-2015-8660: The ovl_setattr function in     fs/overlayfs/inode.c in the Linux kernel attempted to     merge distinct setattr operations, which allowed local     users to bypass intended access restrictions and modify     the attributes of arbitrary overlay files via a crafted     application (bnc#960281).

  - CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux     kernel did not properly manage the relationship between     a lock and a socket, which allowed local users to cause     a denial of service (deadlock) via a crafted sctp_accept     call (bnc#961509).

  - CVE-2015-8785: The fuse_fill_write_pages function in     fs/fuse/file.c in the Linux kernel allowed local users     to cause a denial of service (infinite loop) via a     writev system call that triggers a zero length for the     first segment of an iov (bnc#963765).

  - CVE-2016-0723: Race condition in the tty_ioctl function     in drivers/tty/tty_io.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory or cause a denial of service (use-after-free and     system crash) by making a TIOCGETD ioctl call during     processing of a TIOCSETD ioctl call (bnc#961500).

  - CVE-2016-2069: A race in invalidating paging structures     that were not in use locally could have lead to     disclosoure of information or arbitrary code exectution     (bnc#963767).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel for openSUSE Leap 42.1 was updated to the 4.1.15 stable release, and also includes security and bugfixes.

Following security bugs were fixed :

  - CVE-2016-0728: A reference leak in keyring handling with     join_session_keyring() could lead to local attackers     gain root privileges. (bsc#962075).

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8767: A case can occur when sctp_accept() is     called by the user during a heartbeat timeout event     after the 4-way handshake. Since sctp_assoc_migrate()     changes both assoc->base.sk and assoc->ep, the     bh_sock_lock in sctp_generate_heartbeat_event() will be     taken with the listening socket but released with the     new association socket. The result is a deadlock on any     future attempts to take the listening socket lock.
    (bsc#961509)

  - CVE-2015-8539: A negatively instantiated user key could     have been used by a local user to leverage privileges     (bnc#958463).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

The following non-security bugs were fixed :

  - ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd     (bsc#958439).

  - ALSA: hda - Apply click noise workaround for Thinkpads     generically (bsc#958439).

  - ALSA: hda - Fix noise problems on Thinkpad T440s     (boo#958504).

  - ALSA: hda - Flush the pending probe work at remove     (boo#960710).

  - ALSA: hda - Set codec to D3 at reboot/shutdown on     Thinkpads (bsc#958439).

  - Add Cavium Thunderx network enhancements

  - Add RHEL to kernel-obs-build

  - Backport amd xgbe fixes and features

  - Backport arm64 patches from SLE12-SP1-ARM.

  - Btrfs: fix the number of transaction units needed to     remove a block group (bsc#950178).

  - Btrfs: use global reserve when deleting unused block     group after ENOSPC (bsc#950178).

  - Documentation: nousb is a module parameter (bnc#954324).

  - Driver for IBM System i/p VNIC protocol.

  - Enable CONFIG_PINCTRL_CHERRYVIEW (boo#954532) Needed for     recent tablets/laptops. CONFIG_PINCTRL_BAYTRAIL is still     disabled as it can't be built as a module.

  - Fix PCI generic host controller

  - Fix kABI breakage for max_dev_sectors addition to     queue_limits (boo#961263).

  - HID: multitouch: Fetch feature reports on demand for     Win8 devices (boo#954532).

  - HID: multitouch: fix input mode switching on some Elan     panels (boo#954532).

  - Implement enable/disable for Display C6 state     (boo#960021).

  - Input: aiptek - fix crash on detecting device without     endpoints (bnc#956708).

  - Linux 4.1.15 (boo#954647 bsc#955422).

  - Move kabi patch to patches.kabi directory

  - Obsolete compat-wireless, rts5229 and rts_pstor KMPs     These are found in SLE11-SP3, now replaced with the     upstream drivers.

  - PCI: generic: Pass starting bus number to     pci_scan_root_bus().

  - Revert 'block: remove artifical max_hw_sectors cap'     (boo#961263).

  - Set system time through RTC device

  - Update arm64 config files. Enabled DRM_AST in the     vanilla kernel since it is now enabled in the default     kernel.

  - Update config files: CONFIG_IBMVNIC=m

  - block/sd: Fix device-imposed transfer length limits     (boo#961263).

  - block: bump BLK_DEF_MAX_SECTORS to 2560 (boo#961263).

  - drm/i915/skl: Add DC5 Trigger Sequence (boo#960021).

  - drm/i915/skl: Add DC6 Trigger sequence (boo#960021).

  - drm/i915/skl: Add support to load SKL CSR firmware     (boo#960021).

  - drm/i915/skl: Add the INIT power domain to the MISC I/O     power well (boo#960021).

  - drm/i915/skl: Deinit/init the display at suspend/resume     (boo#960021).

  - drm/i915/skl: Fix DMC API version in firmware file name     (boo#960021).

  - drm/i915/skl: Fix     WaDisableChickenBitTSGBarrierAckForFFSliceCS     (boo#960021).

  - drm/i915/skl: Fix stepping check for a couple of W/As     (boo#960021).

  - drm/i915/skl: Fix the CTRL typo in the DPLL_CRTL1     defines (boo#960021).

  - drm/i915/skl: Implement WaDisableVFUnitClockGating     (boo#960021).

  - drm/i915/skl: Implement enable/disable for Display C5     state (boo#960021).

  - drm/i915/skl: Make the Misc I/O power well part of the     PLLS domain (boo#960021).

  - drm/i915/skl: add F0 stepping ID (boo#960021).

  - drm/i915/skl: enable     WaForceContextSaveRestoreNonCoherent (boo#960021).

  - drm/i915: Clear crtc atomic flags at beginning of     transaction (boo#960021).

  - drm/i915: Fix CSR MMIO address check (boo#960021).

  - drm/i915: Switch to full atomic helpers for plane     updates/disable, take two (boo#960021).

  - drm/i915: set CDCLK if DPLL0 enabled during resuming     from S3 (boo#960021).

  - ethernet/atheros/alx: sanitize buffer sizing and padding     (boo#952621).

  - genksyms: Handle string literals with spaces in     reference files (bsc#958510).

  - group-source-files: mark module.lds as devel file ld:
    cannot open linker script file     /usr/src/linux-4.2.5-1/arch/arm/kernel/module.lds: No     such file or directory

  - hwrng: core - sleep interruptible in read (bnc#962597).

  - ipv6: distinguish frag queues by device for multicast     and link-local packets (bsc#955422).

  - kABI fixes for linux-4.1.15.

  - rpm/compute-PATCHVERSION.sh: Skip stale directories in     the package dir

  - rpm/constraints.in: Bump disk space requirements up a     bit Require 10GB on s390x, 20GB elsewhere.

  - rpm/constraints.in: Require 14GB worth of disk space on     POWER The builds started to fail randomly due to ENOSPC     errors.

  - rpm/kernel-binary.spec.in: Do not explicitly set     DEBUG_SECTION_MISMATCH CONFIG_DEBUG_SECTION_MISMATCH is     a selectable Kconfig option since 2.6.39 and is enabled     in our configs.

  - rpm/kernel-binary.spec.in: Do not obsolete ocfs2-kmp     (bnc#865259)865259

  - rpm/kernel-binary.spec.in: Fix build if no UEFI certs     are installed

  - rpm/kernel-binary.spec.in: Install libopenssl-devel for     newer sign-file

  - rpm/kernel-binary.spec.in: No scriptlets in     kernel-zfcpdump The kernel should not be added to the     bootloader nor are there any KMPs.

  - rpm/kernel-binary.spec.in: Obsolete the -base package     from SLE11 (bnc#865096)

  - rpm/kernel-binary.spec.in: Use parallel make in all     invocations Also, remove the lengthy comment, since we     are using a standard rpm macro now.

  - thinkpad_acpi: Do not yell on unsupported brightness     interfaces (boo#957152).

  - usb: make 'nousb' a clear module parameter (bnc#954324).

  - usbvision fix overflow of interfaces array (bnc#950998).

  - x86/microcode/amd: Do not overwrite final patch levels     (bsc#913996).

  - x86/microcode/amd: Extract current patch level read to a     function (bsc#913996).

  - xen/pciback: Do not allow MSI-X ops if     PCI_COMMAND_MEMORY is not set (bsc#957990 XSA-157).

  - xhci: refuse loading if nousb is used (bnc#954324).

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed :

  - CVE-2015-7550: A local user could have triggered a race     between read and revoke in keyctl (bnc#958951).

  - CVE-2015-8539: A negatively instantiated user key could     have been used by a local user to leverage privileges     (bnc#958463).

  - CVE-2015-8543: The networking implementation in the     Linux kernel did not validate protocol identifiers for     certain protocol families, which allowed local users to     cause a denial of service (NULL function pointer     dereference and system crash) or possibly gain     privileges by leveraging CLONE_NEWUSER support to     execute a crafted SOCK_RAW application (bnc#958886).

  - CVE-2015-8550: Compiler optimizations in the XEN PV     backend drivers could have lead to double fetch     vulnerabilities, causing denial of service or arbitrary     code execution (depending on the configuration)     (bsc#957988).

  - CVE-2015-8551, CVE-2015-8552: xen/pciback: For     XEN_PCI_OP_disable_msi[|x] only disable if device has     MSI(X) enabled (bsc#957990).

  - CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect     functions in drivers/net/ppp/pptp.c in the Linux kernel     did not verify an address length, which allowed local     users to obtain sensitive information from kernel memory     and bypass the KASLR protection mechanism via a crafted     application (bnc#959190).

  - CVE-2015-8575: Validate socket address length in     sco_sock_bind() to prevent information leak     (bsc#959399).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127165	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0014)	Nessus	NewStart CGSL Local Security Checks	high
124971	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1518)	Nessus	Huawei Local Security Checks	high
124813	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1489)	Nessus	Huawei Local Security Checks	critical
118329	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3798-1)	Nessus	Ubuntu Local Security Checks	high
106525	RHEL 6 : kernel-rt (RHSA-2018:0181)	Nessus	Red Hat Local Security Checks	high
106364	Oracle Linux 7 : kernel (ELSA-2018-0151)	Nessus	Oracle Linux Local Security Checks	high
106353	CentOS 7 : kernel (CESA-2018:0151) (Meltdown) (Spectre)	Nessus	CentOS Local Security Checks	high
106340	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180125) (Meltdown) (Spectre)	Nessus	Scientific Linux Local Security Checks	high
106331	RHEL 7 : kernel-rt (RHSA-2018:0152)	Nessus	Red Hat Local Security Checks	high
106330	RHEL 7 : kernel (RHSA-2018:0151)	Nessus	Red Hat Local Security Checks	high
97974	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2017-001)	Nessus	Virtuozzo Local Security Checks	high
93289	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:2074-1)	Nessus	SuSE Local Security Checks	critical
92007	openSUSE Security Update : the Linux Kernel (openSUSE-2016-862)	Nessus	SuSE Local Security Checks	high
90884	SUSE SLES11 Security Update : kernel (SUSE-SU-2016:1203-1)	Nessus	SuSE Local Security Checks	critical
90264	SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2016:0911-1)	Nessus	SuSE Local Security Checks	critical
89022	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0585-1)	Nessus	SuSE Local Security Checks	high
88542	openSUSE Security Update : the Linux Kernel (openSUSE-2016-116)	Nessus	SuSE Local Security Checks	high
88006	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:0168-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-8539

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

critical

high

critical

critical

high

high

high