A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A flaw was found in the Linux kernel's handling of fork     failure when dealing with event messages in the     userfaultfd code. Failure to fork correctly can create a     fork event that will be removed from an already freed     list of events. (CVE-2017-15126)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is unlikely.
    (CVE-2017-7294)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a use-     after-free issue. A user/process could use this flaw to     crash the guest VM resulting in a denial of service     issue or, potentially, gain privileged access to a     system. (CVE-2019-6974)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when a     L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A flaw was found in the Linux kernel's handling of fork     failure when dealing with event messages in the     userfaultfd code. Failure to fork correctly can create a     fork event that will be removed from an already freed     list of events. (CVE-2017-15126)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is unlikely.
    (CVE-2017-7294)

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimization) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3646)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a use-     after-free issue. A user/process could use this flaw to     crash the guest VM resulting in a denial of service     issue or, potentially, gain privileged access to a     system. (CVE-2019-6974)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when a     L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - hw: cpu: speculative execution permission faults     handling (CVE-2017-5754, Important, KVM for Power)

  - kernel: Buffer overflow in firewire driver via crafted     incoming packets (CVE-2016-8633, Important)

  - kernel: Use-after-free vulnerability in DCCP socket     (CVE-2017-8824, Important)

  - Kernel: kvm: nVMX: L2 guest could access hardware(L0)     CR8 register (CVE-2017-12154, Important)

  - kernel: v4l2: disabled memory access protection     mechanism allowing privilege escalation (CVE-2017-13166,     Important)

  - kernel: media: use-after-free in [tuner-xc2028] media     driver (CVE-2016-7913, Moderate)

  - kernel: drm/vmwgfx: fix integer overflow in     vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

  - kernel: Incorrect type conversion for size during dma     allocation (CVE-2017-9725, Moderate)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190, Moderate)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121, Moderate)

  - kernel: Use-after-free in     userfaultfd_event_wait_completion function in     userfaultfd.c (CVE-2017-15126, Moderate)

  - kernel: net: double-free and memory corruption in     get_net_ns_by_id() (CVE-2017-15129, Moderate)

  - kernel: Use-after-free in snd_seq_ioctl_create_port()     (CVE-2017-15265, Moderate)

  - kernel: Missing capabilities check in     net/netfilter/nfnetlink_cthelper.c allows for     unprivileged access to systemwide nfnl_cthelper_list     structure (CVE-2017-17448, Moderate)

  - kernel: Missing namespace check in     net/netlink/af_netlink.c allows for network monitors to     observe systemwide activity (CVE-2017-17449, Moderate)

  - kernel: Unallocated memory access by malicious USB     device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

  - kernel: netfilter: use-after-free in     tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203, Moderate)

  - kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ     (CVE-2017-1000252, Moderate)

  - Kernel: KVM: DoS via write flood to I/O port 0x80     (CVE-2017-1000407, Moderate)

  - kernel: Stack information leak in the EFS element     (CVE-2017-1000410, Moderate)

  - kernel: Kernel address information leak in     drivers/acpi/sbshc.c:acpi_smbus_hc_add() function     potentially allowing KASLR bypass (CVE-2018-5750,     Moderate)

  - kernel: Race condition in sound system can lead to     denial of service (CVE-2018-1000004, Moderate)

  - kernel: multiple Low security impact security issues     (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116,     CVE-2017-15127, CVE-2018-6927, Low)

Additional Changes :

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power)

* kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)

* kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

* Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)

* kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important)

* kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)

* kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

* kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

* kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

* kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)

* kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate)

* kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

* kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

* kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

* kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate)

* kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate)

* kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

* kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate)

* kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

* Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)

* kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

* kernel: Kernel address information leak in drivers/acpi/ sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate)

* kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

* kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low)

Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633;
Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1062 advisory.

    - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430]     {CVE-2017-13166}
    - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
    - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381]     {CVE-2017-15265}
    - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543088]     {CVE-2017-18017}
    - [sound] alsa: seq: Make ioctls race-free (CVE-2018-1000004) (Jaroslav Kysela) [1537203]     {CVE-2018-1000004}
    - [x86] mm: Fix use-after-free of ldt_struct (Oleg Nesterov) [1543352] {CVE-2017-17053}
    - [net] netlink: Add netns check on taps (William Townsend) [1538738] {CVE-2017-17449}
    - [net] netfilter: xt_osf: Add missing permission checks (Florian Westphal) [1539230] {CVE-2017-17448}
    - [net] netfilter: nfnetlink_cthelper: Add missing permission checks (Florian Westphal) [1539230]     {CVE-2017-17448}
    - [powerpc] kvm: book3s: Provide information about hardware/firmware CVE workarounds (Serhii Popovych)     [1532077] {CVE-2017-5754}
    - [net] Fix double free and memory corruption in get_net_ns_by_id() (Aristeu Rozanski) [1531551]     {CVE-2017-15129}
    - [media] xc2028: avoid use after free (Torez Smith) [1402893] {CVE-2016-7913}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0676 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)

    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

    * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)

    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166,     Important)

    * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)

    * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

    * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)

    * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126,     Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

    * kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-     after-free (CVE-2017-17053, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017, Moderate)

    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of     service (CVE-2017-18203, Moderate)

    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially     allowing KASLR bypass (CVE-2018-5750, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

    * kernel: unlimiting the stack disables ASLR (CVE-2016-3672, Low)

    * kernel: Missing permission check in move_pages system call (CVE-2017-14140, Low)

    * kernel: Null pointer dereference in rngapi_reset function (CVE-2017-15116, Low)

    * kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c (CVE-2017-15127, Low)

    * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact     (CVE-2018-6927, Low)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Mohamed Ghannam for reporting     CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting     CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting     CVE-2017-15129; Jan H. Schnherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting     CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the     CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).

    Additional Changes:

    See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
127285	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0077)	Nessus	NewStart CGSL Local Security Checks	high
127283	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0076)	Nessus	NewStart CGSL Local Security Checks	high
109449	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)	Nessus	Scientific Linux Local Security Checks	critical
109380	CentOS 7 : kernel (CESA-2018:1062)	Nessus	CentOS Local Security Checks	critical
109113	Oracle Linux 7 : kernel (ELSA-2018-1062)	Nessus	Oracle Linux Local Security Checks	critical
108997	RHEL 7 : kernel (RHSA-2018:1062)	Nessus	Red Hat Local Security Checks	critical
108984	RHEL 7 : kernel-rt (RHSA-2018:0676)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2017-15126

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical