An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0044 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5866 advisory.

    - kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974) (Jann Horn)  [Orabug: 29434845]     {CVE-2019-6974}
    - KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) (Peter Shier)     [Orabug: 29434898]  {CVE-2019-7221}
    - KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222) (Paolo Bonzini)  [Orabug:
    29434924]  {CVE-2019-7222}
    - net: arc_emac: fix koops caused by sk_buff free (Alexander Kochetkov)  [Orabug: 30254239]     {CVE-2016-10906}
    - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson)  [Orabug: 30254251]     {CVE-2016-10905}
    - GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson)  [Orabug: 30254251]     {CVE-2016-10905}
    - net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup (Sabrina Dubroca)  [Orabug: 31872821]     {CVE-2020-1749}
    - nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell)  [Orabug: 31872910]     {CVE-2020-25212}
    - rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov)  [Orabug: 31884169]     {CVE-2020-25284}
    - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884239]     {CVE-2020-25285}
    - ext4: fix potential negative array index in do_split() (Eric Sandeen)  [Orabug: 31895331]     {CVE-2020-14314}
    - ARM: amba: Fix race condition with driver_override (Geert Uytterhoeven)  [Orabug: 29671212]     {CVE-2018-9415}
    - block: blk_init_allocated_queue() set q->fq as NULL in the fail case (xiao jin)  [Orabug: 30120513]     {CVE-2018-20856}
    - USB: serial: omninet: fix reference leaks at open (Johan Hovold)  [Orabug: 30484761]  {CVE-2017-8925}
    - nl80211: validate beacon head (Johannes Berg)  [Orabug: 30556264]  {CVE-2019-16746}
    - cfg80211: Use const more consistently in for_each_element macros (Jouni Malinen)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: add and use strongly typed element iteration macros (Johannes Berg)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: add helper to find an IE that matches a byte-array (Luca Coelho)  [Orabug: 30556264]     {CVE-2019-16746}
    - cfg80211: allow finding vendor with OUI without specifying the OUI type (Emmanuel Grumbach)  [Orabug:
    30556264]  {CVE-2019-16746}
    - dccp: Fix memleak in __feat_register_sp (YueHaibing)  [Orabug: 30732821]  {CVE-2019-20096}
    - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing)  [Orabug: 30732938]  {CVE-2019-20054}
    - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing)  [Orabug: 30732938]     {CVE-2019-20054}
    - scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan)  [Orabug: 30770913]     {CVE-2019-19965}
    - kernel/sysctl.c: fix out-of-bounds access when setting file-max (Will Deacon)  [Orabug: 31350720]     {CVE-2019-14898}
    - sysctl: handle overflow for file-max (Christian Brauner)  [Orabug: 31350720]  {CVE-2019-14898}
    - ath9k_htc: release allocated buffer if timed out (Navid Emamdoost)  [Orabug: 31351572]  {CVE-2019-19073}
    - can: gs_usb: gs_can_open(): prevent memory leak (Navid Emamdoost)  [Orabug: 31351682]  {CVE-2019-19052}
    - ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit() (Takashi Iwai)  [Orabug:
    31351837]  {CVE-2019-15927}
    - media: usb: siano: Fix general protection fault in smsusb (Alan Stern)  [Orabug: 31351875]     {CVE-2019-15218}
    - net-gro: fix use-after-free read in napi_gro_frags() (Eric Dumazet)  [Orabug: 31856195]     {CVE-2020-10720}
    - ALSA: seq: Cancel pending autoload work at unbinding device (Takashi Iwai)  [Orabug: 31352045]     {CVE-2017-16528}
    - USB: serial: io_ti: fix information leak in completion handler (Johan Hovold)  [Orabug: 31352084]     {CVE-2017-8924}
    - blktrace: Protect q->blk_trace with RCU (Jan Kara)  [Orabug: 31123576]  {CVE-2019-19768}
    - media: technisat-usb2: break out of loop at end of buffer (Sean Young)  [Orabug: 31224554]     {CVE-2019-15505}
    - btrfs: merge btrfs_find_device and find_device (Anand Jain)  [Orabug: 31351746]  {CVE-2019-18885}
    - RDMA/cxgb4: Do not dma memory off of the stack (Greg KH)  [Orabug: 31351783]  {CVE-2019-17075}
    - mwifiex: Abort at too short BSS descriptor element (Takashi Iwai)  [Orabug: 31351916]  {CVE-2019-3846}
    - mwifiex: Fix possible buffer overflows at parsing bss descriptor (Takashi Iwai)  [Orabug: 31351916]     {CVE-2019-3846} {CVE-2019-3846}
    - repair kABI breakage from 'fs: prevent page refcount overflow in pipe_buf_get' (Dan Duval)  [Orabug:
    31351941]  {CVE-2019-11487}
    - mm: prevent get_user_pages() from overflowing page refcount (Linus Torvalds)  [Orabug: 31351941]     {CVE-2019-11487}
    - mm: add 'try_get_page()' helper function (Linus Torvalds)  [Orabug: 31351941]  {CVE-2019-11487}
    - fs: prevent page refcount overflow in pipe_buf_get (Matthew Wilcox)  [Orabug: 31351941]     {CVE-2019-11487}
    - mm: make page ref count overflow check tighter and more explicit (Linus Torvalds)  [Orabug: 31351941]     {CVE-2019-11487}
    - sctp: implement memory accounting on tx path (Xin Long)  [Orabug: 31351960]  {CVE-2019-3874}
    - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin)  [Orabug: 31351995]  {CVE-2018-16884}
    - sunrpc: use-after-free in svc_process_common() (Vasily Averin)  [Orabug: 31351995]  {CVE-2018-16884}
    - af_packet: set defaule value for tmo (Mao Wenan)  [Orabug: 31439107]  {CVE-2019-20812}
    - selinux: properly handle multiple messages in selinux_netlink_send() (Paul Moore)  [Orabug: 31439369]     {CVE-2020-10751}
    - selinux: Print 'sclass' as string when unrecognized netlink message occurs (Marek Milkovic)  [Orabug:
    31439369]  {CVE-2020-10751}
    - mac80211: Do not send Layer 2 Update frame before authorization (Jouni Malinen)  [Orabug: 31473652]     {CVE-2019-5108}
    - cfg80211/mac80211: make ieee80211_send_layer2_update a public function (Dedy Lansky)  [Orabug: 31473652]     {CVE-2019-5108}
    - crypto: authenc - fix parsing key with misaligned rta_len (Eric Biggers)  [Orabug: 31535529]     {CVE-2020-10769}
    - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705121]     {CVE-2020-14331} {CVE-2020-14331}
    - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB devices (Tomas Bortoli)  [Orabug: 31351221]     {CVE-2019-19535}
    - media: hdpvr: Fix an error handling path in hdpvr_probe() (Arvind Yadav)  [Orabug: 31352053]     {CVE-2017-16644}
    - fix kABI breakage from 'netns: provide pure entropy for net_hash_mix()' (Dan Duval)  [Orabug: 31351904]     {CVE-2019-10638} {CVE-2019-10639}
    - netns: provide pure entropy for net_hash_mix() (Eric Dumazet)  [Orabug: 31351904]  {CVE-2019-10638}     {CVE-2019-10639}
    - fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (Alexander Potapenko)  [Orabug:
    31350639]  {CVE-2020-10732}
    - crypto: user - fix memory leak in crypto_report (Navid Emamdoost)  [Orabug: 31351640]  {CVE-2019-19062}
    - of: unittest: fix memory leak in unittest_data_add (Navid Emamdoost)  [Orabug: 31351702]     {CVE-2019-19049}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).
(bnc#1140671).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's kvm hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-15924: A a NULL pointer dereference has been fixed in the drivers/net/ethernet/intel/fm10k module (bnc#1149612).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15666: There was an out-of-bounds array access in the net/xfrm module that could cause denial of service (bnc#1148394).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146519 1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146519 1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146519 1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15211: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/v4l2-core driver (bnc#1146519).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15214: An a use-after-free issue in the sound subsystem was fixed (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

CVE-2019-16231: The fjes driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bnc#1150466)

CVE-2019-18805: Fix signed integer overflow in tcp_ack_update_rtt() that could have lead to a denial of service or possibly unspecified other impact (bsc#1156187)

CVE-2019-18680: A NULL pointer dereference in rds_tcp_kill_sock() could cause denial of service (bnc#1155898)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel KVM hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-11135:
Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233:
drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#11465).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver (bnc#1146163).

CVE-2019-10207: Add checks for missing tty operations to prevent unprivileged user to execute 0x0 address (bsc#1142857 bsc#1123959)

CVE-2019-15118: ALSA: usb-audio: Fix a stack-based buffer overflow bug in check_input_term leading to kernel stack exhaustion (bsc#1145922).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12-SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12207: Untrusted virtual machines on Intel CPUs could exploit a race condition in the Instruction Fetch Unit of the Intel CPU to cause a Machine Exception during Page Size Change, causing the CPU core to be non-functional.

The Linux Kernel kvm hypervisor was adjusted to avoid page size changes in executable pages by splitting / merging huge pages into small pages as needed. More information can be found on https://www.suse.com/support/kb/doc/?id=7023735 CVE-2019-16995: Fix a memory leak in hsr_dev_finalize() if hsr_add_port failed to add a port, which may have caused denial of service (bsc#1152685).

CVE-2019-11135: Aborting an asynchronous TSX operation on Intel CPUs with Transactional Memory support could be used to facilitate sidechannel information leaks out of microarchitectural buffers, similar to the previously described 'Microarchitectural Data Sampling' attack.

The Linux kernel was supplemented with the option to disable TSX operation altogether (requiring CPU Microcode updates on older systems) and better flushing of microarchitectural buffers (VERW).

The set of options available is described in our TID at https://www.suse.com/support/kb/doc/?id=7024251 CVE-2019-16233: drivers/scsi/qla2xxx/qla_os.c did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150457).

CVE-2019-10220: Added sanity checks on the pathnames passed to the user space. (bsc#1144903).

CVE-2019-17666: rtlwifi: Fix potential overflow in P2P code (bsc#1154372).

CVE-2019-17133: cfg80211 wireless extension did not reject a long SSID IE, leading to a Buffer Overflow (bsc#1153158).

CVE-2019-16232: Fix a potential NULL pointer dereference in the Marwell libertas driver (bsc#1150465).

CVE-2019-16234: iwlwifi pcie driver did not check the alloc_workqueue return value, leading to a NULL pointer dereference. (bsc#1150452).

CVE-2019-17055: The AF_ISDN network module in the Linux kernel did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bnc#1152782).

CVE-2019-17056: The AF_NFC network module did not enforce CAP_NET_RAW, which meant that unprivileged users could create a raw socket (bsc#1152788).

CVE-2019-16413: The 9p filesystem did not protect i_size_write() properly, which caused an i_size_read() infinite loop and denial of service on SMP systems (bnc#1151347).

CVE-2019-15902: A backporting issue was discovered that re-introduced the Spectre vulnerability it had aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped (bnc#1149376).

CVE-2019-15291: Fixed a NULL pointer dereference issue that could be caused by a malicious USB device (bnc#1146519).

CVE-2019-15807: Fixed a memory leak in the SCSI module that could be abused to cause denial of service (bnc#1148938).

CVE-2019-13272: Fixed a mishandled the recording of the credentials of a process that wants to create a ptrace relationship, which allowed local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker).
(bnc#1140671).

CVE-2019-14821: An out-of-bounds access issue was fixed in the kernel's KVM hypervisor. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).

CVE-2019-15505: An out-of-bounds issue had been fixed that could be caused by crafted USB device traffic (bnc#1147122).

CVE-2017-18595: A double free in allocate_trace_buffer was fixed (bnc#1149555).

CVE-2019-14835: A buffer overflow flaw was found in the kernel's vhost functionality that translates virtqueue buffers to IOVs. A privileged guest user able to pass descriptors with invalid length to the host could use this flaw to increase their privileges on the host (bnc#1150112).

CVE-2019-15216: A NULL pointer dereference was fixed that could be malicious USB device (bnc#1146361).

CVE-2019-15924: A a NULL pointer dereference has been fixed in the drivers/net/ethernet/intel/fm10k module (bnc#1149612).

CVE-2019-9456: An out-of-bounds write in the USB monitor driver has been fixed. This issue could lead to local escalation of privilege with System execution privileges needed. (bnc#1150025).

CVE-2019-15926: An out-of-bounds access was fixed in the drivers/net/wireless/ath/ath6kl module. (bnc#1149527).

CVE-2019-15927: An out-of-bounds access was fixed in the sound/usb/mixer module (bnc#1149522).

CVE-2019-15666: There was an out-of-bounds array access in the net/xfrm module that could cause denial of service (bnc#1148394).

CVE-2017-18379: An out-of-boundary access was fixed in the drivers/nvme/target module (bnc#1143187).

CVE-2019-15219: A NULL pointer dereference was fixed that could be abused by a malicious USB device (bnc#1146519 1146524).

CVE-2019-15220: A use-after-free issue was fixed that could be caused by a malicious USB device (bnc#1146519 1146526).

CVE-2019-15221: A NULL pointer dereference was fixed that could be caused by a malicious USB device (bnc#1146519 1146529).

CVE-2019-14814: A heap-based buffer overflow was fixed in the marvell wifi chip driver. That issue allowed local users to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146512).

CVE-2019-14815: A missing length check while parsing WMM IEs was fixed (bsc#1146512, bsc#1146514, bsc#1146516).

CVE-2019-14816: A heap-based buffer overflow in the marvell wifi chip driver was fixed. Local users would have abused this issue to cause a denial of service (system crash) or possibly execute arbitrary code (bnc#1146516).

CVE-2017-18509: An issue in net/ipv6 as fixed. By setting a specific socket option, an attacker could control a pointer in kernel land and cause an inet_csk_listen_stop general protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after namespace unsharing. (bnc#1145477)

CVE-2019-9506: The Bluetooth BR/EDR specification used to permit sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka 'KNOB') that could decrypt traffic and inject arbitrary ciphertext without the victim noticing (bnc#1137865).

CVE-2019-15098: A NULL pointer dereference in drivers/net/wireless/ath was fixed (bnc#1146378).

CVE-2019-15290: A NULL pointer dereference in ath6kl_usb_alloc_urb_from_pipe was fixed (bsc#1146378).

CVE-2019-15239: A incorrect patch to net/ipv4 was fixed. By adding to a write queue between disconnection and re-connection, a local attacker could trigger multiple use-after-free conditions. This could result in kernel crashes or potentially in privilege escalation.
(bnc#1146589)

CVE-2019-15212: A double-free issue was fixed in drivers/usb driver (bnc#1146391).

CVE-2016-10906: A use-after-free issue was fixed in drivers/net/ethernet/arc (bnc#1146584).

CVE-2019-15211: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/v4l2-core driver (bnc#1146519).

CVE-2019-15217: A a NULL pointer dereference issue caused by a malicious USB device was fixed in the drivers/media/usb/zr364xx driver (bnc#1146519).

CVE-2019-15214: An a use-after-free issue in the sound subsystem was fixed (bnc#1146519).

CVE-2019-15218: A NULL pointer dereference caused by a malicious USB device was fixed in the drivers/media/usb/siano driver (bnc#1146413).

CVE-2019-15215: A use-after-free issue caused by a malicious USB device was fixed in the drivers/media/usb/cpia2 driver (bnc#1146425).

CVE-2018-20976: A use-after-free issue was fixed in the fs/xfs driver (bnc#1146285).

CVE-2017-18551: An out-of-bounds write was fixed in the drivers/i2c driver (bnc#1146163).

CVE-2019-0154: An unprotected read access to i915 registers has been fixed that could have been abused to facilitate a local denial-of-service attack. (bsc#1135966)

CVE-2019-0155: A privilege escalation vulnerability has been fixed in the i915 module that allowed batch buffers from user mode to gain super user privileges. (bsc#1135967)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New kernel packages are available for Slackware 14.2 to fix security issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4163-1 advisory.

    It was discovered that a race condition existed in the ARC EMAC ethernet driver for the Linux kernel,     resulting in a use-after-free vulnerability. An attacker could use this to cause a denial of service     (system crash). (CVE-2016-10906)

    It was discovered that a race condition existed in the Serial Attached SCSI (SAS) implementation in the     Linux kernel when handling certain error conditions. A local attacker could use this to cause a denial of     service (kernel deadlock). (CVE-2017-18232)

    It was discovered that the RSI 91x Wi-Fi driver in the Linux kernel did not did not handle detach     operations correctly, leading to a use-after-free vulnerability. A physically proximate attacker could use     this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-21008)

    Wen Huang discovered that the Marvell Wi-Fi device driver in the Linux kernel did not properly perform     bounds checking, leading to a heap overflow. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-14814, CVE-2019-14816)

    Matt Delco discovered that the KVM hypervisor implementation in the Linux kernel did not properly perform     bounds checking when handling coalesced MMIO write operations. A local attacker with write access to     /dev/kvm could use this to cause a denial of service (system crash). (CVE-2019-14821)

    Hui Peng and Mathias Payer discovered that the USB audio driver for the Linux kernel did not properly     validate device meta data. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2019-15117)

    Hui Peng and Mathias Payer discovered that the USB audio driver for the Linux kernel improperly performed     recursion while handling device meta data. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2019-15118)

    It was discovered that the Technisat DVB-S/S2 USB device driver in the Linux kernel contained a buffer     overread. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly expose sensitive information. (CVE-2019-15505)

    Brad Spengler discovered that a Spectre mitigation was improperly implemented in the ptrace susbsystem of     the Linux kernel. A local attacker could possibly use this to expose sensitive information.
    (CVE-2019-15902)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
141374	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0044)	Nessus	OracleVM Local Security Checks	critical
141207	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5866)	Nessus	Oracle Linux Local Security Checks	critical
131120	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2984-1)	Nessus	SuSE Local Security Checks	critical
130950	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2950-1) (SACK Panic)	Nessus	SuSE Local Security Checks	critical
130949	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:2949-1)	Nessus	SuSE Local Security Checks	critical
130751	Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-311-01)	Nessus	Slackware Local Security Checks	critical
130152	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4163-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2016-10906

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical