On Linux running on PowerPC hardware (Power8 or later) a user process can craft a signal frame and then do a sigreturn so that the kernel will take an exception (interrupt), and use the r1 value *from the signal frame* as the kernel stack pointer. As part of the exception entry the content of the signal frame is written to the kernel stack, allowing an attacker to overwrite arbitrary locations with arbitrary values. The exception handling does produce an oops, and a panic if panic_on_oops=1, but only after kernel memory has been over written. This flaw was introduced in commit: "5d176f751ee3 (powerpc: tm: Enable transactional memory (TM) lazily for userspace)" which was merged upstream into v4.9-rc1. Please note that kernels built with CONFIG_PPC_TRANSACTIONAL_MEM=n are not vulnerable.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0654 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    The following packages have been upgraded to a later upstream version: kernel-alt (4.14.0). (BZ#1492717)

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of instructions (a commonly used performance optimization). There are three primary     variants of the issue which differ in the way the speculative execution can be exploited.

    Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted     cache side-channel attacks. (CVE-2017-5715, Important, ARM)

    Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on     the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that     memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel     attacks. (CVE-2017-5753, Important, ARM)

    Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution     of instruction permission faults, exception generation triggered by a faulting access is suppressed until     the retirement of the whole instruction block. In a combination with the fact that memory accesses may     populate the cache even when the block is being dropped and never committed (executed), an unprivileged     local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache     side-channel attacks. (CVE-2017-5754, Important, ARM)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Incorrect updates of uninstantiated keys crash the kernel (CVE-2017-15299, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Arbitrary stack overwrite causing oops via crafted signal frame (CVE-2017-1000255, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

    * kernel: Buffer overflow in mp_override_legacy_irq() (CVE-2017-11473, Low)

    * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact     (CVE-2018-6927, Low)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and     CVE-2017-5754; Vitaly Mayatskih for reporting CVE-2017-12190; Kirill Tkhai for reporting CVE-2017-15129;
    Michael Ellerman, Gustavo Romero, Breno Leitao, Paul Mackerras, and Cyril Bur for reporting     CVE-2017-1000255; and Armis Labs for reporting CVE-2017-1000410.

    Additional Changes:

    See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 4.13.8 update contains a number of important fixes across the tree.

----

The 4.13.6 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the KVM subsystem in the Linux kernel did not properly keep track of nested levels in guest page tables. A local attacker in a guest VM could use this to cause a denial of service (host OS crash) or possibly execute arbitrary code in the host OS.
(CVE-2017-12188)

It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack when handling sigreturn(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-1000255)

Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this to cause a denial of service (system crash). (CVE-2017-12153)

It was discovered that the nested KVM implementation in the Linux kernel in some situations did not properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker in a guest could use this to cause a denial of service (system crash).
(CVE-2017-12154)

Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference counts when merging buffers. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2017-12190)

It was discovered that the key management subsystem in the Linux kernel did not properly restrict key reads on negatively instantiated keys. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-12192)

It was discovered that the ATI Radeon framebuffer driver in the Linux kernel did not properly initialize a data structure returned to user space. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-14156)

ChunYu Wang discovered that the iSCSI transport implementation in the Linux kernel did not properly validate data structures. A local attacker could use this to cause a denial of service (system crash).
(CVE-2017-14489)

Alexander Potapenko discovered an information leak in the waitid implementation of the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-14954)

It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15265)

Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in the Linux kernel did not properly handle attempts to set reserved bits in a task's extended state (xstate) area. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-15537)

It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15649)

Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16525)

Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for an error condition. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-16526)

Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16527)

Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16529)

Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-bounds error when handling alternative settings. A physically proximate attacker could use to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB interface association descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16531)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16533)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate CDC metadata. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16534).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Incorrect updates of uninstantiated keys crash the kernel

A vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic, leading to denial of service (DoS). (CVE-2017-15299)

Memory leak when merging buffers in SCSI IO vectors

It was found that in the Linux kernel through v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bio_add_pc_page() merges them into one, but the page reference is never dropped, causing a memory leak and possible system lockup due to out-of-memory condition. (CVE-2017-12190)

NULL pointer dereference due to incorrect node-splitting in assoc_array implementation

A flaw was found in the Linux kernel's implementation of associative arrays introduced in 3.13. This functionality was backported to the 3.10 kernels in Red Hat Enterprise Linux 7. The flaw involved a NULL pointer dereference in assoc_array_apply_edit() due to incorrect node-splitting in assoc_array implementation. This affects the keyring key type and thus key addition and link creation operations may cause the kernel to panic. (CVE-2017-12193)

Arbitrary stack overwrite causing oops via crafted signal frame

A flaw was found in the Linux kernel's handling of signal frame on PowerPC systems. A malicious local user process could craft a signal frame allowing an attacker to corrupt memory. (CVE-2017-1000255)

Race condition in the KEYS subsystem

The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the 'negative' state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls. (CVE-2017-15951)

The 4.13.8 update contains a number of important fixes across the tree.

----

The 4.13.6 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3443-2 advisory.

    USN-3443-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04     LTS.

    It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack     when handling sigreturn(). A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-1000255)

    Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-14106)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that on the PowerPC architecture, the kernel did not properly sanitize the signal stack when handling sigreturn(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-1000255)

Andrey Konovalov discovered that a divide-by-zero error existed in the TCP stack implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-14106).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
108942	RHEL 7 : kernel-alt (RHSA-2018:0654)	Nessus	Red Hat Local Security Checks	high
105948	Fedora 27 : kernel (2017-aa9927961f)	Nessus	Fedora Local Security Checks	high
104737	Ubuntu 17.10 : linux, linux-raspi2 vulnerabilities (USN-3487-1)	Nessus	Ubuntu Local Security Checks	high
104707	Amazon Linux AMI : kernel (ALAS-2017-925)	Nessus	Amazon Linux Local Security Checks	high
104160	Fedora 25 : kernel (2017-cafcdbdde5)	Nessus	Fedora Local Security Checks	high
104158	Fedora 26 : kernel (2017-c110ac0eb1)	Nessus	Fedora Local Security Checks	high
103776	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3443-2)	Nessus	Ubuntu Local Security Checks	medium
103775	Ubuntu 17.04 : linux, linux-raspi2 vulnerabilities (USN-3443-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2017-1000255

medium

Tenable Plugins

high

high

high

high

high

high

medium

medium