The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to cause a denial of service (panic) via a fragmented IPv6 packet.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):Use-after-free     vulnerability in driverset/tun.c in the Linux kernel     through 3.11.1 allows local users to gain privileges by     leveraging the CAP_NET_ADMIN capability and providing     an invalid tuntap interface name in a TUNSETIFF ioctl     call.(CVE-2013-4343)It was found that when the gcc     stack protector was enabled, reading the /proc/keys     file could cause a panic in the Linux kernel due to     stack corruption. This happened because an incorrect     buffer size was used to hold a 64-bit timeout value     rendered as weeks.(CVE-2016-7042)A flaw was found in     the Linux kernel that fs/ocfs2/aops.c omits use of a     semaphore and consequently has a race condition for     access to the extent tree during read operations in     DIRECT mode. This allows local users to cause a denial     of service by modifying a certain e_cpos     field.(CVE-2017-18224)The sctp_v6_create_accept_sk     function in net/sctp/ipv6.c in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9075)In     the function sbusfb_ioctl_helper() in     drivers/video/fbdev/sbuslib.c in the Linux kernel, up     to and including 4.15, an integer signedness error     allows arbitrary information leakage for the     FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC     commands.(CVE-2018-6412)A race condition flaw was found     in the way the Linux kernel's mmap(2), madvise(2), and     fallocate(2) system calls interacted with each other     while operating on virtual memory file system files. A     local user could use this flaw to cause a denial of     service.(CVE-2014-4171)** RESERVED ** This candidate     has been reserved by an organization or individual that     will use it when announcing a new security problem.
    When the candidate has been publicized, the details for     this candidate will be provided.(CVE-2018-1095)A NULL     pointer dereference flaw was found in the way the Linux     kernel's Stream Control Transmission Protocol (SCTP)     implementation handled simultaneous connections between     the same hosts. A remote attacker could use this flaw     to crash the system.(CVE-2014-5077)A vulnerability was     found in the fs/inode.c:inode_init_owner() function     logic of the LInux kernel that allows local users to     create files with an unintended group ownership and     with group execution and SGID permission bits set, in a     scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a     member of this group. This can lead to excessive     permissions granted in case when they should     not.(CVE-2018-13405)In the Linux kernel before 4.20.8,     kvm_ioctl_create_device in virt/kvm/kvm_main.c     mishandles reference counting because of a race     condition, leading to a use-after-free.(CVE-2019-6974)A     flaw was found in the way Linux kernel allocates heap     memory to build the scattergather list from a fragment     list(skb_shinfo(skb)-i1/4zfrag_list) in the socket     buffer(skb_buff). The heap overflow occurred if     'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST'     feature are both used together. A remote user or     process could use this flaw to potentially escalate     their privilege on a system.(CVE-2017-7477)Multiple     integer overflows in Alchemy LCD frame-buffer drivers     in the Linux kernel before 3.12 allow local users to     create a read-write memory mapping for the entirety of     kernel memory, and consequently gain privileges, via     crafted mmap operations, related to the (1)     au1100fb_fb_mmap function in drivers/video/au1100fb.c     and the (2) au1200fb_fb_mmap function in     drivers/video/au1200fb.c.(CVE-2013-4511)It was found     that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in     'block/bio.c' do unbalanced pages refcounting if IO     vector has small consecutive buffers belonging to the     same page. bio_add_pc_page() merges them into one, but     the page reference is never dropped, causing a memory     leak and possible system lockup due to out-of-memory     condition.(CVE-2017-12190)An issue was discovered in     the Linux kernel before 4.19.3. crypto_report_one() and     related functions in crypto/crypto_user.c (the crypto     user configuration API) do not fully initialize     structures that are copied to userspace, potentially     leaking sensitive memory to user programs. NOTE: this     is a CVE-2013-2547 regression but with easier     exploitability because the attacker does not need a     capability (however, the system must have the     CONFIG_CRYPTO_USER kconfig option).(CVE-2018-19854)The     userfaultfd implementation in the Linux kernel before     4.19.7 mishandles access control for certain UFFDIO_     ioctl calls, as demonstrated by allowing local users to     write data into holes in a tmpfs file (if the user has     read-only access to that file, and that file contains     holes), related to fs/userfaultfd.c and     mm/userfaultfd.c.(CVE-2018-18397)The TCP stack in the     Linux kernel through 4.10.6 mishandles the     SCM_TIMESTAMPING_OPT_STATS feature, which allows local     users to obtain sensitive information from the kernel's     internal socket data structures or cause a denial of     service (out-of-bounds read) via crafted system calls,     related to net/core/skbuff.c and     net/socket.c.(CVE-2017-7277)A flaw was found in the way     the Linux kernel's vhost driver treated userspace     provided log file descriptor when processing the     VHOST_SET_LOG_FD ioctl command. The file descriptor was     never released and continued to consume kernel memory.
    A privileged local user with access to the     /dev/vhost-net files could use this flaw to create a     denial-of-service attack.(CVE-2015-6252)A buffer     overflow flaw was found in the way the Linux kernel's     virtio-net subsystem handled certain fraglists when the     GRO (Generic Receive Offload) functionality was enabled     in a bridged network configuration. An attacker on the     local network could potentially use this flaw to crash     the system, or, although unlikely, elevate their     privileges on the system.(CVE-2015-5156)The MSM QDSP6     audio driver (aka sound driver) for the Linux kernel     3.x, as used in Qualcomm Innovation Center (QuIC)     Android contributions for MSM devices and other     products, allows attackers to gain privileges or cause     a denial of service (integer overflow, and buffer     overflow or buffer over-read) via a crafted application     that performs a (1) AUDIO_EFFECTS_WRITE or (2)     AUDIO_EFFECTS_READ operation, aka Qualcomm internal bug     CR1006609.(CVE-2016-2068)The icmp6_send function in     net/ipv6/icmp.c in the Linux kernel through 4.8.12     omits a certain check of the dst data structure which     allows remote attackers to cause a denial of service     (panic) via a fragmented IPv6 packet.(CVE-2016-9919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.38 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2015-1350: The VFS subsystem in the Linux kernel 3.x     provides an incomplete set of requirements for setattr     operations that underspecifies removing extended     privilege attributes, which allowed local users to cause     a denial of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program (bnc#914939).

  - CVE-2015-8964: The tty_set_termios_ldisc function in     drivers/tty/tty_ldisc.c in the Linux kernel allowed     local users to obtain sensitive information from kernel     memory by reading a tty data structure (bnc#1010507).

  - CVE-2016-7039: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for large     crafted packets, as demonstrated by packets that contain     only VLAN headers, a related issue to CVE-2016-8666     (bnc#1001486).

  - CVE-2016-7042: The proc_keys_show function in     security/keys/proc.c in the Linux kernel through 4.8.2,     when the GNU Compiler Collection (gcc) stack protector     is enabled, uses an incorrect buffer size for certain     timeout data, which allowed local users to cause a     denial of service (stack memory corruption and panic) by     reading the /proc/keys file (bnc#1004517).

  - CVE-2016-7425: The arcmsr_iop_message_xfer function in     drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel did     not restrict a certain length field, which allowed local     users to gain privileges or cause a denial of service     (heap-based buffer overflow) via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code (bnc#999932).

  - CVE-2016-7913: The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (use-after-free) via vectors involving     omission of the firmware name from a certain data     structure (bnc#1010478).

  - CVE-2016-7917: The nfnetlink_rcv_batch function in     net/netfilter/nfnetlink.c in the Linux kernel did not     check whether a batch message's length field is large     enough, which allowed local users to obtain sensitive     information from kernel memory or cause a denial of     service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability (bnc#1010444).

  - CVE-2016-8645: The TCP stack in the Linux kernel     mishandled skb truncation, which allowed local users to     cause a denial of service (system crash) via a crafted     application that made sendto system calls, related to     net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c     (bnc#1009969).

  - CVE-2016-8666: The IP stack in the Linux kernel allowed     remote attackers to cause a denial of service (stack     consumption and panic) or possibly have unspecified     other impact by triggering use of the GRO path for     packets with tunnel stacking, as demonstrated by     interleaved IPv4 headers and GRE headers, a related     issue to CVE-2016-7039 (bnc#1003964).

  - CVE-2016-9083: drivers/vfio/pci/vfio_pci.c in the Linux     kernel allowed local users to bypass integer overflow     checks, and cause a denial of service (memory     corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a     VFIO_DEVICE_SET_IRQS ioctl call, aka a 'state machine     confusion bug (bnc#1007197).

  - CVE-2016-9084: drivers/vfio/pci/vfio_pci_intrs.c in the     Linux kernel misuses the kzalloc function, which allowed     local users to cause a denial of service (integer     overflow) or have unspecified other impact by leveraging     access to a vfio PCI device file (bnc#1007197).

  - CVE-2016-9793: A bug in SO_{SND|RCV}BUFFORCE     setsockopt() implementation was fixed, which allowed     CAP_NET_ADMIN users to cause memory corruption.
    (bsc#1013531).

  - CVE-2016-9919: The icmp6_send function in     net/ipv6/icmp.c in the Linux kernel omits a certain     check of the dst data structure, which allowed remote     attackers to cause a denial of service (panic) via a     fragmented IPv6 packet (bnc#1014701).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Andrey Konovalov discovered that the ipv6 icmp implementation in the Linux kernel did not properly check data structures on send. A remote attacker could use this to cause a denial of service (system crash).
(CVE-2016-9919)

Andrey Konovalov discovered that signed integer overflows existed in the setsockopt() system call when handling the SO_SNDBUFFORCE and SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash or memory corruption). (CVE-2016-9793).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124984	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1531)	Nessus	Huawei Local Security Checks	high
97274	openSUSE Security Update : the Linux Kernel (openSUSE-2017-245)	Nessus	SuSE Local Security Checks	critical
96603	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:0181-1)	Nessus	SuSE Local Security Checks	high
96444	Ubuntu 16.10 : linux-raspi2 vulnerabilities (USN-3170-2)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-9919

high

Tenable Plugins

high

critical

high

high