Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 3.2 allows local users to gain privileges via a crafted ACPI table.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: Buffer overflow due to unbounded strcpy in ISDN I4L driver (CVE-2017-12762)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group     ID of zero from reaching the swapper process, which allows local users to cause a denial of service     (system crash) by leveraging access to this process group. (CVE-2010-5328)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017)

  - The ia64 subsystem in the Linux kernel before 2.6.26 allows local users to cause a denial of service     (stack consumption and system crash) via a crafted application that leverages the mishandling of invalid     Register Stack Engine (RSE) state. (CVE-2006-3635)

  - drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize     videobuf_mapping data structures, which allows local users to trigger an incorrect count value and     videobuf leak via unspecified vectors, a different vulnerability than CVE-2010-5321. (CVE-2007-6761)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The snd_msndmidi_input_read function in     sound/isa/msnd/msnd_midi.c in the Linux kernel through     4.11.7 allows local users to cause a denial of service     (over-boundary access) or possibly have unspecified     other impact by changing the value of a message queue     head pointer between two kernel reads of that value,     aka a 'double fetch' vulnerability.(CVE-2017-9985i1/4%0

  - An assertion failure issue was found in the Linux     kernel's KVM hypervisor module built to support     visualization on ARM64 architecture platforms. The     failure could occur while accessing Performance     Monitors Cycle Count Register (PMCCNTR) from a guest. A     privileged guest user could use this flaw to crash the     host kernel resulting in denial of     service.(CVE-2017-12168i1/4%0

  - The iscsi_if_rx() function in     'drivers/scsi/scsi_transport_iscsi.c' in the Linux     kernel from v2.6.24-rc1 through 4.13.2 allows local     users to cause a denial of service (a system panic) by     making a number of certain syscalls by leveraging     incorrect length validation in the kernel     code.(CVE-2017-14489i1/4%0

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644i1/4%0

  - The dvb frontend management subsystem in the Linux     kernel contains a use-after-free which can allow a     malicious user to write to memory that may be assigned     to another kernel structure. This could create memory     corruption, panic, or possibly other side     affects.(CVE-2017-16648i1/4%0

  - It was found that the Linux kernel's IPv6     implementation mishandled socket options. A local     attacker could abuse concurrent access to the socket     options to escalate their privileges, or cause a denial     of service (use-after-free and system crash) via a     crafted sendmsg system call.(CVE-2016-3841i1/4%0

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879i1/4%0

  - A race condition was found in the Linux kernel, present     since v3.14-rc1 through v4.12. The race happens between     threads of inotify_handle_event() and vfs_rename()     while running the rename operation against the same     file. As a result of the race the next slab data or the     slab's free list pointer can be corrupted with     attacker-controlled data, which may lead to the     privilege escalation.(CVE-2017-7533i1/4%0

  - A privilege-escalation vulnerability was discovered in     the Linux kernel built with User Namespace     (CONFIG_USER_NS) support. The flaw occurred when the     ptrace() system call was used on a root-owned process     to enter a user namespace. A privileged namespace user     could exploit this flaw to potentially escalate their     privileges on the system, outside the original     namespace.(CVE-2015-8709i1/4%0

  - Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     before 4.5.2 allows local users to cause a denial of     service (memory corruption and system crash, or     spinlock) or possibly have unspecified other impact by     removing a network namespace, related to the     ppp_register_net_channel and ppp_unregister_channel     functions.(CVE-2016-4805i1/4%0

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601i1/4%0

  - A flaw was found in the Linux kernel's implementation     of associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null     pointer dereference in assoc_array_apply_edit() due to     incorrect node-splitting in assoc_array implementation.
    This affects the keyring key type and thus key addition     and link creation operations may cause the kernel to     panic.(CVE-2017-12193i1/4%0

  - Multiple race conditions in drivers/char/adsprpc.c and     drivers/char/adsprpc_compat.c in the ADSPRPC driver for     the Linux kernel 3.x, as used in Qualcomm Innovation     Center (QuIC) Android contributions for MSM devices and     other products, allow attackers to cause a denial of     service (zero-value write) or possibly have unspecified     other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl     call.(CVE-2015-0572i1/4%0

  - The sanity_check_ckpt function in fs/f2fs/super.c in     the Linux kernel before version 4.12.4 does not     validate the blkoff and segno arrays. This allows an     unprivileged, local user to cause a system panic and     DoS. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-10663i1/4%0

  - A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a     specially crafted UDF image to crash the     system.(CVE-2014-6410i1/4%0

  - Race condition in the ion_ioctl function in     drivers/staging/android/ion/ion.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) by calling     ION_IOC_FREE on two CPUs at the same     time.(CVE-2016-9120i1/4%0

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_PICOLCD is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) via a     crafted device.(CVE-2013-2899i1/4%0

  - A flaw was found in the Linux kernel's implementation     of overlayfs. An attacker can leak file resources in     the system by opening a large file with write     permissions on a overlay filesystem that is     insufficient to deal with the size of the write.When     unmounting the underlying device, the system is unable     to free an inode and this will consume resources.
    Repeating this for all available inodes and memory will     create a denial of service situation.(CVE-2015-8953i1/4%0

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473i1/4%0

  - Use-after-free vulnerability in the     kvm_ioctl_create_device function in virt/kvm/kvm_main.c     in the Linux kernel before 4.8.13 allows host OS users     to cause a denial of service (host OS crash) or     possibly gain privileges via crafted ioctl calls on the     /dev/kvm device.(CVE-2016-10150i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow vulnerability was found in the     ring_buffer_resize() calculations in which a privileged     user can adjust the size of the ringbuffer message     size. These calculations can create an issue where the     kernel memory allocator will not allocate the correct     count of pages yet expect them to be usable. This can     lead to the ftrace() output to appear to corrupt kernel     memory and possibly be used for privileged escalation     or more likely kernel panic.(CVE-2016-9754)

  - A flaw was found in the Linux kernel's implementation     of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non-namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption.(CVE-2016-9793)

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794)

  - A double free vulnerability was found in netlink_dump,     which could cause a denial of service or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9806)

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets are     implemented in the Linux kernel networking subsystem     handling synchronization. A local user able to open a     raw packet socket (requires the CAP_NET_RAW capability)     can use this issue to crash the     system.(CVE-2017-1000111)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

  - A stack buffer overflow flaw was found in the way the     Bluetooth subsystem of the Linux kernel processed     pending L2CAP configuration responses from a client. On     systems with the stack protection feature enabled in     the kernel (CONFIG_CC_STACKPROTECTOR=y, which is     enabled on all architectures other than s390x and     ppc64le), an unauthenticated attacker able to initiate     a connection to a system via Bluetooth could use this     flaw to crash the system. Due to the nature of the     stack protection feature, code execution cannot be     fully ruled out, although we believe it is unlikely. On     systems without the stack protection feature (ppc64le     the Bluetooth modules are not built on s390x), an     unauthenticated attacker able to initiate a connection     to a system via Bluetooth could use this flaw to     remotely execute arbitrary code on the system with ring     0 (kernel) privileges.(CVE-2017-1000251)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (i1/4z1024) index value.(CVE-2017-1000252)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364)

  - The Linux Kernel imposes a size restriction on the     arguments and environmental strings passed through     RLIMIT_STACK/RLIMIT_INFINITY, but does not take the     argument and environment pointers into account, which     allows attackers to bypass this     limitation.(CVE-2017-1000365)

  - The offset2lib patch as used in the Linux Kernel     contains a vulnerability that allows a PIE binary to be     execve()'ed with 1GB of arguments or environmental     strings then the stack occupies the address 0x80000000     and the PIE binary is mapped above 0x40000000     nullifying the protection of the offset2lib patch. This     affects Linux Kernel version 4.11.5 and earlier. This     is a different issue than CVE-2017-1000371. This issue     appears to be limited to i386 based     systems.(CVE-2017-1000370)

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - A race condition was found in the Linux kernel before     version 4.11-rc1 in 'fs/timerfd.c' file which allows a     local user to cause a kernel list corruption or     use-after-free via simultaneous operations with a file     descriptor which leverage improper 'might_cancel'     queuing. An unprivileged local user could use this flaw     to cause a denial of service of the system. Due to the     nature of the flaw, privilege escalation cannot be     fully ruled out, although we believe it is     unlikely.(CVE-2017-10661)

  - Memory leak in the virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel through 4.11.8 allows attackers to cause a     denial of service (memory consumption) by triggering     object-initialization failures.(CVE-2017-10810)

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911)

  - A use-after-free flaw was found in the Netlink     functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify     function, a local attacker could potentially use this     flaw to escalate their privileges on the     system.(CVE-2017-11176)

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473)

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact by sending a XFRM_MSG_MIGRATE netlink     message. This flaw is present in the Linux kernel since     an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up     to 4.13-rc3.(CVE-2017-11600)

  - A security flaw was discovered in     nl80211_set_rekey_data() function in the Linux kernel     since v3.1-rc1 through v4.13. This function does not     check whether the required attributes are present in a     netlink request. This request can be issued by a user     with CAP_NET_ADMIN privilege and may result in NULL     dereference and a system crash.(CVE-2017-12153)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization (nVMX) feature     enabled (nested=1), is vulnerable to a crash due to     disabled external interrupts. As L2 guest could access     (r/w) hardware CR8 register of the host(L0). In a     nested visualization setup, L2 guest user could use     this flaw to potentially crash the host(L0) resulting     in DoS.(CVE-2017-12154)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the     system.(CVE-2017-12188)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

    Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta     block groups. An attacker with physical access could use this to specially craft an ext4 image that causes     a denial of service (system crash). (CVE-2016-10208)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a buffer overflow existed in the ACPI table parsing implementation in the Linux     kernel. A local attacker could use this to construct a malicious ACPI table that, when loaded, caused a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-11473)

    It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data     returned to user space in some situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14991)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    It was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device     attachment and warm-start. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16538)

    Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16643)

    Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux     kernel did not properly handle some error conditions. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18255)

    It was discovered that the keyring subsystem in the Linux kernel did not properly prevent a user from     creating keyrings for other users. A local attacker could use this cause a denial of service or expose     sensitive information. (CVE-2017-18270)

    Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not     properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine     could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in     the guest OS. (CVE-2017-2583)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel improperly emulated certain     instructions. A local attacker could use this to obtain sensitive information (kernel memory).
    (CVE-2017-2584)

    It was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in the Linux kernel did not     properly initialize memory related to logging. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2017-5549)

    Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE)     tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive     information. (CVE-2017-5897)

    Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor     in certain situations. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-6345)

    Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local     attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Pengfei Wang discovered that a race condition existed in the NXP SAA7164 TV Decoder driver for the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8831)

    Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained     race conditions when fetching from the ring-buffer. A local attacker could use this to cause a denial of     service (infinite loop). (CVE-2017-9984, CVE-2017-9985)

    It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments     in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10087)

    It was discovered that the kill() system call implementation in the Linux kernel did not properly validate     its arguments in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10124)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Zhong Jiang discovered that a use-after-free vulnerability existed in the NUMA memory policy     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-10675)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1092)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    It was discovered that the cdrom driver in the Linux kernel contained an incorrect bounds check. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-10940)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

    It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2018-10021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0654 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    The following packages have been upgraded to a later upstream version: kernel-alt (4.14.0). (BZ#1492717)

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of instructions (a commonly used performance optimization). There are three primary     variants of the issue which differ in the way the speculative execution can be exploited.

    Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted     cache side-channel attacks. (CVE-2017-5715, Important, ARM)

    Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on     the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that     memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel     attacks. (CVE-2017-5753, Important, ARM)

    Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution     of instruction permission faults, exception generation triggered by a faulting access is suppressed until     the retirement of the whole instruction block. In a combination with the fact that memory accesses may     populate the cache even when the block is being dropped and never committed (executed), an unprivileged     local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache     side-channel attacks. (CVE-2017-5754, Important, ARM)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Incorrect updates of uninstantiated keys crash the kernel (CVE-2017-15299, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Arbitrary stack overwrite causing oops via crafted signal frame (CVE-2017-1000255, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

    * kernel: Buffer overflow in mp_override_legacy_irq() (CVE-2017-11473, Low)

    * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact     (CVE-2018-6927, Low)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and     CVE-2017-5754; Vitaly Mayatskih for reporting CVE-2017-12190; Kirill Tkhai for reporting CVE-2017-15129;
    Michael Ellerman, Gustavo Romero, Breno Leitao, Paul Mackerras, and Cyril Bur for reporting     CVE-2017-1000255; and Armis Labs for reporting CVE-2017-1000410.

    Additional Changes:

    See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0015 for details.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0174 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - tty: Fix race in pty_write leading to NULL deref (Todd     Vierling) 

  - ocfs2/dlm: ignore cleaning the migration mle that is     inuse (xuejiufei) [Orabug: 26479780]

  - KEYS: fix dereferencing NULL payload with nonzero length     (Eric Biggers) [Orabug: 26592025]

  - oracleasm: Copy the integrity descriptor (Martin K.
    Petersen) 

  - mm: Tighten x86 /dev/mem with zeroing reads (Kees Cook)     [Orabug: 26675925] (CVE-2017-7889)

  - xscore: add dma address check (Zhu Yanjun) [Orabug:
    27058468]

  - more bio_map_user_iov leak fixes (Al Viro) [Orabug:
    27069042] (CVE-2017-12190)

  - fix unbalanced page refcounting in bio_map_user_iov     (Vitaly Mayatskikh) [Orabug: 27069042] (CVE-2017-12190)

  - nvme: Drop nvmeq->q_lock before dma_pool_alloc, so as to     prevent hard lockups (Aruna Ramakrishna) [Orabug:
    25409587]

  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)     [Orabug: 26277600]

  - char: lp: fix possible integer overflow in lp_setup     (Willy Tarreau) [Orabug: 26403940] (CVE-2017-1000363)

  - ALSA: timer: Fix missing queue indices reset at     SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai) [Orabug:
    26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race between read and ioctl (Takashi     Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: fix NULL pointer dereference in read/ioctl     race (Vegard Nossum) [Orabug: 26403956]     (CVE-2017-1000380)

  - ALSA: timer: Fix negative queue usage by racy accesses     (Takashi Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG     Cong) [Orabug: 26404005] (CVE-2017-9077)

  - ocfs2: fix deadlock issue when taking inode lock at vfs     entry points (Eric Ren) [Orabug: 26427126]

  - ocfs2/dlmglue: prepare tracking logic to avoid recursive     cluster lock (Eric Ren) [Orabug: 26427126]

  - ping: implement proper locking (Eric Dumazet) [Orabug:
    26540286] (CVE-2017-2671)

  - aio: mark AIO pseudo-fs noexec (Jann Horn) [Orabug:
    26643598] (CVE-2016-10044)

  - vfs: Commit to never having exectuables on proc and     sysfs. (Eric W. Biederman) [Orabug: 26643598]     (CVE-2016-10044)

  - vfs, writeback: replace FS_CGROUP_WRITEBACK with     SB_I_CGROUPWB (Tejun Heo) [Orabug: 26643598]     (CVE-2016-10044)

  - x86/acpi: Prevent out of bound access caused by broken     ACPI tables (Seunghun Han) [Orabug: 26643645]     (CVE-2017-11473)

  - sctp: do not inherit ipv6_[mc|ac|fl]_list from parent     (Eric Dumazet) [Orabug: 26650883] (CVE-2017-9075)

  - [media] saa7164: fix double fetch PCIe access condition     (Steven Toth) [Orabug: 26675142] (CVE-2017-8831)

  - [media] saa7164: fix sparse warnings (Hans Verkuil)     [Orabug: 26675142] (CVE-2017-8831)

  - fs: __generic_file_splice_read retry lookup on     AOP_TRUNCATED_PAGE (Abhi Das) [Orabug: 26797306]

  - timerfd: Protect the might cancel mechanism proper     (Thomas Gleixner) [Orabug: 26899787] (CVE-2017-10661)

  - scsi: scsi_transport_iscsi: fix the issue that     iscsi_if_rx doesn't parse nlmsg properly (Xin Long)     [Orabug: 26988627] (CVE-2017-14489)

  - mqueue: fix a use-after-free in sys_mq_notify (Cong     Wang) [Orabug: 26643556] (CVE-2017-11176)

  - ipv6: avoid overflow of offset in ip6_find_1stfragopt     (Sabrina Dubroca) [Orabug: 27011273] (CVE-2017-7542)

  - packet: fix tp_reserve race in packet_set_ring (Willem     de Bruijn) [Orabug: 27002450] (CVE-2017-1000111)

  - mlx4_core: calculate log_num_mtt based on total system     memory (Wei Lin Guay) [Orabug: 26883934]

  - xen/x86: Add interface for querying amount of host     memory (Boris Ostrovsky) [Orabug: 26883934]

  - Bluetooth: Properly check L2CAP config option output     buffer length (Ben Seri) [Orabug: 26796364]     (CVE-2017-1000251)

  - xen: fix bio vec merging (Roger Pau Monne) [Orabug:
    26645550] (CVE-2017-12134)

  - fs/exec.c: account for argv/envp pointers (Kees Cook)     [Orabug: 26638921] (CVE-2017-1000365) (CVE-2017-1000365)

  - l2tp: fix racy SOCK_ZAPPED flag check in     l2tp_ip[,6]_bind (Guillaume Nault) [Orabug: 26586047]     (CVE-2016-10200)

  - xfs: fix two memory leaks in xfs_attr_list.c error paths     (Mateusz Guzik) [Orabug: 26586022] (CVE-2016-9685)

  - KEYS: Disallow keyrings beginning with '.' to be joined     as session keyrings (David Howells) [Orabug: 26585994]     (CVE-2016-9604)

  - ipv6: fix out of bound writes in __ip6_append_data (Eric     Dumazet) [Orabug: 26578198] (CVE-2017-9242)

  - posix_acl: Clear SGID bit when setting file permissions     (Jan Kara) [Orabug: 25507344] (CVE-2016-7097)     (CVE-2016-7097)

  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce     Fields) [Orabug: 26366022] (CVE-2017-7645)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - nvme: Drop nvmeq->q_lock before dma_pool_alloc, so as to     prevent hard lockups (Aruna Ramakrishna) [Orabug:
    25409587]

  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)     [Orabug: 26277600] 

  - char: lp: fix possible integer overflow in lp_setup     (Willy Tarreau) [Orabug: 26403940] (CVE-2017-1000363)

  - ALSA: timer: Fix missing queue indices reset at     SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai) [Orabug:
    26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race between read and ioctl (Takashi     Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: fix NULL pointer dereference in read/ioctl     race (Vegard Nossum) [Orabug: 26403956]     (CVE-2017-1000380)

  - ALSA: timer: Fix negative queue usage by racy accesses     (Takashi Iwai) [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)     [Orabug: 26403956] (CVE-2017-1000380)

  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG     Cong) [Orabug: 26404005] (CVE-2017-9077)

  - ocfs2: fix deadlock issue when taking inode lock at vfs     entry points (Eric Ren) [Orabug: 26427126] -     ocfs2/dlmglue: prepare tracking logic to avoid recursive     cluster lock (Eric Ren) [Orabug: 26427126] - ping:
    implement proper locking (Eric Dumazet) [Orabug:
    26540286] (CVE-2017-2671)

  - aio: mark AIO pseudo-fs noexec (Jann Horn) [Orabug:
    26643598] (CVE-2016-10044)

  - vfs: Commit to never having exectuables on proc and     sysfs. (Eric W. Biederman) [Orabug: 26643598]     (CVE-2016-10044)

  - vfs, writeback: replace FS_CGROUP_WRITEBACK with     SB_I_CGROUPWB (Tejun Heo) [Orabug: 26643598]     (CVE-2016-10044)

  - x86/acpi: Prevent out of bound access caused by broken     ACPI tables (Seunghun Han) [Orabug: 26643645]     (CVE-2017-11473)

  - sctp: do not inherit ipv6_[mc|ac|fl]_list from parent     (Eric Dumazet) [Orabug: 26650883] (CVE-2017-9075)

  - [media] saa7164: fix double fetch PCIe access condition     (Steven Toth) [Orabug: 26675142] (CVE-2017-8831)

  - [media] saa7164: fix sparse warnings (Hans Verkuil)     [Orabug: 26675142] (CVE-2017-8831)

  - fs: __generic_file_splice_read retry lookup on     AOP_TRUNCATED_PAGE (Abhi Das) [Orabug: 26797306] -     timerfd: Protect the might cancel mechanism proper     (Thomas Gleixner) [Orabug: 26899787] (CVE-2017-10661)

  - scsi: scsi_transport_iscsi: fix the issue that     iscsi_if_rx doesn't parse nlmsg properly (Xin Long)     [Orabug: 26988627] (CVE-2017-14489)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3637 advisory.

    - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143563]  {CVE-2017-7308}
    - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143563]     {CVE-2017-7308}
    - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403941]     {CVE-2017-1000363}
    - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug:
    26403958]  {CVE-2017-1000380}
    - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380}
    - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403958]     {CVE-2017-1000380}
    - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403958]     {CVE-2017-1000380}
    - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380}
    - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380}
    - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403974]     {CVE-2017-9074}
    - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403974]     {CVE-2017-9074}
    - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403974]  {CVE-2017-9074}
    - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404007]  {CVE-2017-9077}
    - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643601]  {CVE-2016-10044}
    - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643601]     {CVE-2016-10044}
    - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643601]     {CVE-2016-10044}
    - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643652]     {CVE-2017-11473}
    - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650889]     {CVE-2017-9075}
    - saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675148]  {CVE-2017-8831}
    - saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675148]  {CVE-2017-8831}
    - saa7164: get rid of warning: no previous prototype (Mauro Carvalho Chehab)  [Orabug: 26675148]     {CVE-2017-8831}
    - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899791]     {CVE-2017-10661}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3636 advisory.

    - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403940]     {CVE-2017-1000363}
    - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug:
    26403956]  {CVE-2017-1000380}
    - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380}
    - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403956]     {CVE-2017-1000380}
    - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403956]     {CVE-2017-1000380}
    - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380}
    - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380}
    - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404005]  {CVE-2017-9077}
    - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540286]  {CVE-2017-2671}
    - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643598]  {CVE-2016-10044}
    - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643598]     {CVE-2016-10044}
    - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643598]     {CVE-2016-10044}
    - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643645]     {CVE-2017-11473}
    - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650883]     {CVE-2017-9075}
    - [media] saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675142]     {CVE-2017-8831}
    - [media] saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675142]  {CVE-2017-8831}
    - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899787]     {CVE-2017-10661}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-1000252: The KVM subsystem in the Linux kernel     allowed guest OS users to cause a denial of service     (assertion failure, and hypervisor hang or crash) via an     out-of bounds guest_irq value, related to     arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038).

  - CVE-2017-10810: Memory leak in the     virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel allowed attackers to cause a denial of service     (memory consumption) by triggering object-initialization     failures (bnc#1047277).

  - CVE-2017-11472: The acpi_ns_terminate() function in     drivers/acpi/acpica/nsutils.c in the Linux kernel did     not flush the operand cache and causes a kernel stack     dump, which allowed local users to obtain sensitive     information from kernel memory and bypass the KASLR     protection mechanism (in the kernel through 4.9) via a     crafted ACPI table (bnc#1049580).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-12134: The xen_biovec_phys_mergeable function     in drivers/xen/biomerge.c in Xen might allow local OS     guest users to corrupt block device data streams and     consequently obtain sensitive memory information, cause     a denial of service, or gain host OS privileges by     leveraging incorrect block IO merge-ability calculation     (bnc#1051790 bnc#1053919).

  - CVE-2017-12153: A security flaw was discovered in the     nl80211_set_rekey_data() function in     net/wireless/nl80211.c in the Linux kernel This function     did not check whether the required attributes are     present in a Netlink request. This request can be issued     by a user with the CAP_NET_ADMIN capability and may     result in a NULL pointer dereference and system crash     (bnc#1058410).

  - CVE-2017-12154: The prepare_vmcs02 function in     arch/x86/kvm/vmx.c in the Linux kernel did not ensure     that the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allowed KVM L2 guest     OS users to obtain read and write access to the hardware     CR8 register (bnc#1058507).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-14106: The tcp_disconnect function in     net/ipv4/tcp.c in the Linux kernel allowed local users     to cause a denial of service (__tcp_select_window     divide-by-zero error and system crash) by triggering a     disconnect within a certain tcp_recvmsg code path     (bnc#1056982).

  - CVE-2017-14489: The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     allowed local users to cause a denial of service (panic)     by leveraging incorrect length validation (bnc#1059051).

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bnc#1064388).

  - CVE-2017-7518: The Linux kernel was vulnerable to an     incorrect debug exception(#DB) error. It could occur     while emulating a syscall instruction and potentially     lead to guest privilege escalation. (bsc#1045922).

  - CVE-2017-7541: The brcmf_cfg80211_mgmt_tx function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (buffer overflow and system crash) or     possibly gain privileges via a crafted NL80211_CMD_FRAME     Netlink packet (bnc#1049645).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bnc#1049882).

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability (bnc#1037994).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-5243: The tipc_nl_compat_link_dump function in     net/tipc/netlink_compat.c in the Linux kernel did not     properly copy a certain string, which allowed local     users to obtain sensitive information from kernel stack     memory by reading a Netlink message (bnc#983212)

  - CVE-2016-10200: Race condition in the L2TPv3 IP     Encapsulation feature in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) by making multiple bind system calls     without properly ascertaining whether a socket has the     SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and     net/l2tp/l2tp_ip6.c (bnc#1028415)

  - CVE-2017-2647: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash)     via vectors involving a NULL value for a certain match     field, related to the keyring_search_iterator function     in keyring.c (bsc#1030593).

  - CVE-2017-2671: The ping_unhash function in     net/ipv4/ping.c in the Linux kernel was too late in     obtaining a certain lock and consequently could not     ensure that disconnect function calls are safe, which     allowed local users to cause a denial of service (panic)     by leveraging access to the protocol value of     IPPROTO_ICMP in a socket system call (bnc#1031003)

  - CVE-2017-5669: The do_shmat function in ipc/shm.c in the     Linux kernel did not restrict the address calculated by     a certain rounding operation, which allowed local users     to map page zero, and consequently bypass a protection     mechanism that exists for the mmap system call, by     making crafted shmget and shmat system calls in a     privileged context (bnc#1026914)

  - CVE-2017-5970: The ipv4_pktinfo_prepare function in     net/ipv4/ip_sockglue.c in the Linux kernel allowed     attackers to cause a denial of service (system crash)     via (1) an application that made crafted system calls or     possibly (2) IPv4 traffic with invalid IP options     (bsc#1024938)

  - CVE-2017-5986: Race condition in the     sctp_wait_for_sndbuf function in net/sctp/socket.c in     the Linux kernel allowed local users to cause a denial     of service (assertion failure and panic) via a     multithreaded application that peels off an association     in a certain buffer-full state (bsc#1025235)

  - CVE-2017-6074: The dccp_rcv_state_process function in     net/dccp/input.c in the Linux kernel mishandled     DCCP_PKT_REQUEST packet data structures in the LISTEN     state, which allowed local users to obtain root     privileges or cause a denial of service (double free)     via an application that made an IPV6_RECVPKTINFO     setsockopt system call (bnc#1026024)

  - CVE-2017-6214: The tcp_splice_read function in     net/ipv4/tcp.c in the Linux kernel allowed remote     attackers to cause a denial of service (infinite loop     and soft lockup) via vectors involving a TCP packet with     the URG flag (bnc#1026722)

  - CVE-2017-6348: The hashbin_delete function in     net/irda/irqueue.c in the Linux kernel improperly     managed lock dropping, which allowed local users to     cause a denial of service (deadlock) via crafted     operations on IrDA devices (bnc#1027178)

  - CVE-2017-6353: net/sctp/socket.c in the Linux kernel did     not properly restrict association peel-off operations     during certain wait states, which allowed local users to     cause a denial of service (invalid unlock and double     free) via a multithreaded application. NOTE: this     vulnerability exists because of an incorrect fix for     CVE-2017-5986 (bnc#1027066)

  - CVE-2017-6951: The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a request_key system call for     the 'dead' type (bsc#1029850).

  - CVE-2017-7184: The xfrm_replay_verify_len function in     net/xfrm/xfrm_user.c in the Linux kernel did not     validate certain size data after an XFRM_MSG_NEWAE     update, which allowed local users to obtain root     privileges or cause a denial of service (heap-based     out-of-bounds access) by leveraging the CAP_NET_ADMIN     capability (bsc#1030573)

  - CVE-2017-7187: The sg_ioctl function in     drivers/scsi/sg.c in the Linux kernel allowed local     users to cause a denial of service (stack-based buffer     overflow) or possibly have unspecified other impact via     a large command size in an SG_NEXT_CMD_LEN ioctl call,     leading to out-of-bounds write access in the sg_write     function (bnc#1030213)

  - CVE-2017-7261: The vmw_surface_define_ioctl function in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel did not check for a zero value of certain levels     data, which allowed local users to cause a denial of     service (ZERO_SIZE_PTR dereference, and GPF and possibly     panic) via a crafted ioctl call for a /dev/dri/renderD*     device (bnc#1031052)

  - CVE-2017-7294: The vmw_surface_define_ioctl function in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel did not validate addition of certain levels data,     which allowed local users to trigger an integer overflow     and out-of-bounds write, and cause a denial of service     (system hang or crash) or possibly gain privileges, via     a crafted ioctl call for a /dev/dri/renderD* device     (bnc#1031440)

  - CVE-2017-7308: The packet_set_ring function in     net/packet/af_packet.c in the Linux kernel did not     properly validate certain block-size data, which allowed     local users to cause a denial of service (overflow) or     possibly have unspecified other impact via crafted     system calls (bnc#1031579)

  - CVE-2017-7482: Several missing length checks ticket     decode allowing for information leak or potentially code     execution (bsc#1046107).

  - CVE-2017-7487: The ipxitf_ioctl function in     net/ipx/af_ipx.c in the Linux kernel mishandled     reference counts, which allowed local users to cause a     denial of service (use-after-free) or possibly have     unspecified other impact via a failed SIOCGIFADDR ioctl     call for an IPX interface (bsc#1038879).

  - CVE-2017-7533: Race condition in the fsnotify     implementation in the Linux kernel allowed local users     to gain privileges or cause a denial of service (memory     corruption) via a crafted application that leverages     simultaneous execution of the inotify_handle_event and     vfs_rename functions (bnc#1049483 1050677 ).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bnc#1049882).

  - CVE-2017-7616: Incorrect error handling in the     set_mempolicy and mbind compat syscalls in     mm/mempolicy.c in the Linux kernel allowed local users     to obtain sensitive information from uninitialized stack     data by triggering failure of a certain bitmap operation     (bsc#1033336)

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability. This requires a malicious PCI Card.
    (bnc#1037994).

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bsc#1038544).

  - CVE-2017-8924: The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allowed     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti     USB serial device) to trigger an integer underflow     (bnc#1037182).

  - CVE-2017-8925: The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel allowed     local users to cause a denial of service (tty     exhaustion) by leveraging reference count mishandling     (bnc#1038981).

  - CVE-2017-9074: The IPv6 fragmentation implementation in     the Linux kernel did not consider that the nexthdr field     may be associated with an invalid option, which allowed     local users to cause a denial of service (out-of-bounds     read and BUG) or possibly have unspecified other impact     via crafted socket and send system calls (bnc#1039882).

  - CVE-2017-9075: The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bsc#1039883).

  - CVE-2017-9076: The dccp_v6_request_recv_sock function in     net/dccp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039885).

  - CVE-2017-9077: The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bsc#1040069).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel was too late     in checking whether an overwrite of an skb data     structure may occur, which allowed local users to cause     a denial of service (system crash) via crafted system     calls (bnc#1041431).

  - CVE-2017-10661: Race condition in fs/timerfd.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel queueing     (bnc#1053152).

  - CVE-2017-11176: The mq_notify function in the Linux     kernel did not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allowed attackers to cause a denial     of service (use-after-free) or possibly have unspecified     other impact (bnc#1048275).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A     user-controlled buffer is copied into a local buffer of     constant size using strcpy without a length check which     can cause a buffer overflow. (bnc#1053148).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-1000112: Fixed a race condition in net-packet     code that could have been exploited by unprivileged     users to gain root access. (bsc#1052311).

  - CVE-2017-1000363: Linux drivers/char/lp.c Out-of-Bounds     Write. Due to a missing bounds check, and the fact that     parport_ptr integer is static, a 'secure boot' kernel     command line adversary could have overflowed the     parport_nr array in the following code (bnc#1039456).

  - CVE-2017-1000365: The Linux Kernel imposes a size     restriction on the arguments and environmental strings     passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the     size), but did not take the argument and environment     pointers into account, which allowed attackers to bypass     this limitation (bnc#1039354).

  - CVE-2017-1000380: sound/core/timer.c in the Linux kernel     was vulnerable to a data race in the ALSA /dev/snd/timer     driver resulting in local users being able to read     information belonging to other users, i.e.,     uninitialized memory contents may be disclosed when a     read and an ioctl happen at the same time (bnc#1044125).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-7482: Several missing length checks ticket     decode allowing for information leak or potentially code     execution (bsc#1046107).

  - CVE-2016-10277: Potential privilege escalation due to a     missing bounds check in the lp driver. A kernel     command-line adversary can overflow the parport_nr array     to execute code (bsc#1039456).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bsc#1049882).

  - CVE-2017-7533: Bug in inotify code allowing privilege     escalation (bsc#1049483).

  - CVE-2017-11176: The mq_notify function in the Linux     kernel did not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allowed attackers to cause a denial     of service (use-after-free) or possibly have unspecified     other impact (bsc#1048275).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-1000365: The Linux Kernel imposed a size     restriction on the arguments and environmental strings     passed through RLIMIT_STACK/RLIM_INFINITY (1/4 of the     size), but did not take the argument and environment     pointers into account, which allowed attackers to bypass     this limitation. (bnc#1039354)

  - CVE-2014-9922: The eCryptfs subsystem in the Linux     kernel allowed local users to gain privileges via a     large filesystem stack that includes an overlayfs layer,     related to fs/ecryptfs/main.c and fs/overlayfs/super.c     (bnc#1032340)

  - CVE-2017-8924: The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allowed     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti     USB serial device) to trigger an integer underflow     (bnc#1038982).

  - CVE-2017-8925: The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel allowed     local users to cause a denial of service (tty     exhaustion) by leveraging reference count mishandling     (bnc#1038981).

  - CVE-2017-1000380: sound/core/timer.c was vulnerable to a     data race in the ALSA /dev/snd/timer driver resulting in     local users being able to read information belonging to     other users, i.e., uninitialized memory contents could     have bene disclosed when a read and an ioctl happen at     the same time (bnc#1044125)

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c was too late in checking whether     an overwrite of an skb data structure may occur, which     allowed local users to cause a denial of service (system     crash) via crafted system calls (bnc#1041431)

  - CVE-2017-1000363: A buffer overflow in kernel     commandline handling of the 'lp' parameter could be used     by local console attackers to bypass certain secure boot     settings. (bnc#1039456)

  - CVE-2017-9076: The dccp_v6_request_recv_sock function in     net/dccp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039885)

  - CVE-2017-9077: The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1040069)

  - CVE-2017-9075: The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandled     inheritance, which allowed local users to cause a denial     of service or possibly have unspecified other impact via     crafted system calls, a related issue to CVE-2017-8890     (bnc#1039883)

  - CVE-2017-9074: The IPv6 fragmentation implementation in     the Linux kernel did not consider that the nexthdr field     may be associated with an invalid option, which allowed     local users to cause a denial of service (out-of-bounds     read and BUG) or possibly have unspecified other impact     via crafted socket and send system calls (bnc#1039882)

  - CVE-2017-7487: The ipxitf_ioctl function in     net/ipx/af_ipx.c in the Linux kernel mishandled     reference counts, which allowed local users to cause a     denial of service (use-after-free) or possibly have     unspecified other impact via a failed SIOCGIFADDR ioctl     call for an IPX interface (bnc#1038879)

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bnc#1038544)

  - CVE-2017-2647: The KEYS subsystem in the Linux kernel     allowed local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash)     via vectors involving a NULL value for a certain match     field, related to the keyring_search_iterator function     in keyring.c (bnc#1030593)

  - CVE-2017-6951: The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a request_key system call for     the 'dead' type (bnc#1029850)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The mq_notify function in the Linux kernel through     4.11.9 does not set the sock pointer to NULL upon entry     into the retry logic. During a user-space close of a     Netlink socket, it allows attackers to cause a denial     of service (use-after-free) or possibly have     unspecified other impact.(CVE-2017-11176)

  - The brcmf_cfg80211_mgmt_tx function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/     cfg80211.c in the Linux kernel before 4.12.3 allows     local users to cause a denial of service (buffer     overflow and system crash) or possibly gain privileges     via a crafted NL80211_CMD_FRAME Netlink     packet.(CVE-2017-7541)

  - The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel through     4.12.3 allows local users to cause a denial of service     (integer overflow and infinite loop) by leveraging the     ability to open a raw socket.(CVE-2017-7542)

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473)

  - net/xfrm/xfrm_policy.c in the Linux kernel through     4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not     ensure that the dir value of xfrm_userpolicy_id is     XFRM_POLICY_MAX or less, which allows local users to     cause a denial of service (out-of-bounds access) or     possibly have unspecified other impact via an     XFRM_MSG_MIGRATE xfrm Netlink message.(CVE-2017-11600)

  - It was discovered that root can gain direct access to     an internal keyring, such as '.dns_resolver' in RHEL-7     or '.builtin_trusted_keys' upstream, by joining it as     its session keyring. This allows root to bypass module     signature verification by adding a new public key of     its own devising to the keyring.(CVE-2016-9604)

  - A user-controlled buffer is copied into a local buffer     of constant size using strcpy without a length check     which can cause a buffer overflow. This affects the     Linux kernel 4.9-stable tree, 4.12-stable tree,     3.18-stable tree, and 4.4-stable tree.(CVE-2017-12762)

  - The Linux Kernel imposes a size restriction on the     arguments and environmental strings passed through     RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does     not take the argument and environment pointers into     account, which allows attackers to bypass this     limitation. This affects Linux Kernel versions 4.11.5     and earlier. It appears that this feature was     introduced in the Linux Kernel version     2.6.23.(CVE-2017-1000365)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.82 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-1000111: Fixed a race condition in net-packet     code that could be exploited to cause out-of-bounds     memory access (bsc#1052365).

  - CVE-2017-1000112: Fixed a race condition in net-packet     code that could have been exploited by unprivileged     users to gain root access. (bsc#1052311).

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability (bnc#1037994).

  - CVE-2017-7542: The ip6_find_1stfragopt function in     net/ipv6/output_core.c in the Linux kernel allowed local     users to cause a denial of service (integer overflow and     infinite loop) by leveraging the ability to open a raw     socket (bnc#1049882).

  - CVE-2017-11473: Buffer overflow in the     mp_override_legacy_irq() function in     arch/x86/kernel/acpi/boot.c in the Linux kernel allowed     local users to gain privileges via a crafted ACPI table     (bnc#1049603).

  - CVE-2017-7533: Race condition in the fsnotify     implementation in the Linux kernel allowed local users     to gain privileges or cause a denial of service (memory     corruption) via a crafted application that leverages     simultaneous execution of the inotify_handle_event and     vfs_rename functions (bnc#1049483 bnc#1050677).

  - CVE-2017-7541: The brcmf_cfg80211_mgmt_tx function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg8021     1.c in the Linux kernel allowed local users to cause a     denial of service (buffer overflow and system crash) or     possibly gain privileges via a crafted NL80211_CMD_FRAME     Netlink packet (bnc#1049645).

  - CVE-2017-10810: Memory leak in the     virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel allowed attackers to cause a denial of service     (memory consumption) by triggering object-initialization     failures (bnc#1047277).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Buffer overflow in mp_override_legacy_irq() :

Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel through 4.12.2 allows local users to gain privileges via a crafted ACPI table.
(CVE-2017-11473)

A race between inotify_handle_event() and sys_rename() :

A race condition was found in the Linux kernel, present since v3.14-rc1 through v4.12. The race happens between threads of inotify_handle_event() and vfs_rename() while running the rename operation against the same file. As a result of the race the next slab data or the slab's free list pointer can be corrupted with attacker-controlled data, which may lead to the privilege escalation.
(CVE-2017-7533)

Integer overflow in ip6_find_1stfragopt() causes infinite loop :

An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.(CVE-2017-7542)

Double fetch vulnerability in saa7164_bus_get function The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.10.14 allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a 'double fetch' vulnerability. Please note, the saa7164 driver is not enabled in the Amazon Linux AMI kernel (CVE-2017-8831)

The 4.11.12 update contains a number of important fixes across the tree.

----

The 4.11.11 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.11.12 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199273	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199257	RHEL 5 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
124976	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1523)	Nessus	Huawei Local Security Checks	critical
124821	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1498)	Nessus	Huawei Local Security Checks	high
121722	Photon OS 1.0: Linux PHSA-2017-0028	Nessus	PhotonOS Local Security Checks	high
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	critical
108942	RHEL 7 : kernel-alt (RHSA-2018:0654)	Nessus	Red Hat Local Security Checks	high
106469	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0015) (BlueBorne) (Meltdown) (Spectre) (Stack Clash)	Nessus	OracleVM Local Security Checks	critical
105248	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0174) (BlueBorne) (Dirty COW) (Stack Clash)	Nessus	OracleVM Local Security Checks	high
105147	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0173) (BlueBorne) (Stack Clash)	Nessus	OracleVM Local Security Checks	high
104454	OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0168)	Nessus	OracleVM Local Security Checks	high
104371	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2017-3637)	Nessus	Oracle Linux Local Security Checks	high
104370	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3636)	Nessus	Oracle Linux Local Security Checks	high
104253	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:2869-1) (KRACK)	Nessus	SuSE Local Security Checks	high
103354	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2525-1) (Stack Clash)	Nessus	SuSE Local Security Checks	critical
103110	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:2389-1) (Stack Clash)	Nessus	SuSE Local Security Checks	high
102997	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1159)	Nessus	Huawei Local Security Checks	critical
102838	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:2286-1)	Nessus	SuSE Local Security Checks	high
102544	Amazon Linux AMI : kernel (ALAS-2017-870)	Nessus	Amazon Linux Local Security Checks	high
102333	openSUSE Security Update : the Linux Kernel (openSUSE-2017-891)	Nessus	SuSE Local Security Checks	high
102332	openSUSE Security Update : the Linux Kernel (openSUSE-2017-890)	Nessus	SuSE Local Security Checks	high
101994	Fedora 24 : kernel (2017-544eef948f)	Nessus	Fedora Local Security Checks	high
101992	Fedora 25 : kernel (2017-39b5facda0)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-11473

high

Tenable Plugins

critical

critical

critical

critical

high

high

critical

high

critical

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high