The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct, allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the Linux kernel, Hisilicon Network Subsystem (HNS)     does not consider the ETH_SS_PRIV_FLAGS case when     retrieving sset_count data. This allows local users to     cause a denial of service (buffer overflow and memory     corruption) or possibly have unspecified other     impacts.(CVE-2017-18222i1/4%0

  - A flaw was found in the way the Linux kernel's     networking implementation handled UDP packets with     incorrect checksum values. A remote attacker could     potentially use this flaw to trigger an infinite loop     in the kernel, resulting in a denial of service on the     system, or cause a denial of service in applications     using the edge triggered epoll     functionality.(CVE-2015-5366i1/4%0

  - A use-after-free vulnerability was found in the     kernel's socket recvmmsg subsystem. This may allow     remote attackers to corrupt memory and may allow     execution of arbitrary code. This corruption takes     place during the error handling routines within
    __sys_recvmmsg() function.(CVE-2016-7117i1/4%0

  - arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3     mishandles the APICv on/off state, which allows guest     OS users to obtain direct APIC MSR access on the host     OS, and consequently cause a denial of service (host OS     crash) or possibly execute arbitrary code on the host     OS, via x2APIC mode.(CVE-2016-4440i1/4%0

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to     long form.(CVE-2018-18690i1/4%0

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bounds write and a     denial of service or unspecified other impact is     possible by mounting and operating a crafted ext4     filesystem image.(CVE-2018-10878i1/4%0

  - Xen 3.3.x through 4.5.x and the Linux kernel through     3.19.1 do not properly restrict access to PCI command     registers, which might allow local guest OS users to     cause a denial of service (non-maskable interrupt and     host crash) by disabling the (1) memory or (2) I/O     decoding for a PCI Express device and then accessing     the device, which triggers an Unsupported Request (UR)     response.(CVE-2015-2150i1/4%0

  - The assoc_array_insert_into_terminal_node() function in     'lib/assoc_array.c' in the Linux kernel before 4.5.3     does not check whether a slot is a leaf, which allows     local users to obtain sensitive information from kernel     memory or cause a denial of service (invalid pointer     dereference and out-of-bounds read) via an application     that uses associative-array data     structures.(CVE-2016-7914i1/4%0

  - It was found that the x86 ISA (Instruction Set     Architecture) is prone to a denial of service attack     inside a virtualized environment in the form of an     infinite loop in the microcode due to the way     (sequential) delivering of benign exceptions such as     #AC (alignment check exception) is handled. A     privileged user inside a guest could use this flaw to     create denial of service conditions on the host     kernel.(CVE-2015-5307i1/4%0

  - An issue was discovered in fs/f2fs/super.c in the Linux     kernel, which does not properly validate secs_per_zone     in a corrupted f2fs image. This may lead to a     divide-by-zero error and a system     crash.(CVE-2018-13100i1/4%0

  - The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call.(CVE-2013-7266i1/4%0

  - A NULL pointer dereference flaw was found in the     rds_iw_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-2678i1/4%0

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could     allow a remote attacker to force the kernel to enter a     condition in which it could loop     indefinitely.(CVE-2017-6214i1/4%0

  - The kernel_wait4 function in kernel/exit.c in the Linux     kernel before 4.13, when an unspecified architecture     and compiler is used, might allow local users to cause     a denial of service by triggering an attempted use of     the -INT_MIN value.(CVE-2018-10087i1/4%0

  - Heap-based buffer overflow in the private wireless     extensions IOCTL implementation in wlan_hdd_wext.c in     the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x     and 4.x, as used in Qualcomm Innovation Center (QuIC)     Android contributions for MSM devices and other     products, allows attackers to gain privileges via a     crafted application that establishes a packet     filter.(CVE-2015-0569i1/4%0

  - A race condition flaw was found in the Linux kernel's     ext4 file system implementation that allowed a local,     unprivileged user to crash the system by simultaneously     writing to a file and toggling the O_DIRECT flag using     fcntl(F_SETFL) on that file.(CVE-2014-8086i1/4%0

  - The mm_init function in kernel/fork.c in the Linux     kernel before 4.12.10 does not clear the -i1/4zexe_file     member of a new process's mm_struct, allowing a local     attacker to achieve a use-after-free condition and to     induce a kernel memory corruption on the system,     leading to a crash or possibly have unspecified other     impact by running a specially crafted program. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although we feel it is     unlikely.(CVE-2017-17052i1/4%0

  - A buffer overflow flaw was found in the way the Linux     kernel's Intel AES-NI instructions optimized version of     the RFC4106 GCM mode decryption functionality handled     fragmented packets. A remote attacker could use this     flaw to crash, or potentially escalate their privileges     on, a system over a connection with an active AES-GCM     mode IPSec security association.(CVE-2015-3331i1/4%0

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410i1/4%0

  - It was found that a remote attacker could use a race     condition flaw in the ath_tx_aggr_sleep() function to     crash the system by creating large network traffic on     the system's Atheros 9k wireless network     adapter.(CVE-2014-2672i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - mlx4: change the ICM table allocations to lowest needed     size (Daniel Jurgens) [Orabug: 27718305]

  - autofs: use dentry flags to block walks during expire     (Ian Kent) 

  - autofs races (Al Viro) [Orabug: 27766149] [Orabug:
    27766149]

  - crypto: FIPS - allow tests to be disabled in FIPS mode     (Stephan Mueller) [Orabug: 26182706]

  - crypto: rng - Zero seed in crypto_rng_reset (Herbert Xu)     [Orabug: 26182706]

  - crypto: xts - consolidate sanity check for keys (Stephan     Mueller) 

  - fork: fix incorrect fput of ->exe_file causing     use-after-free (Eric Biggers) [Orabug: 27290198]     (CVE-2017-17052)

  - negotiate_mq should happen in all cases of a new VBD     being discovered by xen-blkfront, whether called through
    _probe or a hot-attached new VBD from dom-0 via     xenstore. Otherwise, hot-attached new VBDs are left     configured without multi-queue. (Patrick Colp) [Orabug:
    27383895]

  - rds: Fix NULL pointer dereference in __rds_rdma_map     (H&aring kon Bugge) 

  - nvme: fix uninitialized prp2 value on small transfers     (Jan H. Sch&ouml nherr) [Orabug: 27581008]

  - xen-netfront: Improve error handling during     initialization (Ross Lagerwall) [Orabug: 27655820]

  - RDS: IB: Fix null pointer issue (Guanglei Li) [Orabug:
    27636704]

  - mstflint: update Makefile and Kconfig (Qing Huang)     [Orabug: 27656465]

  - target: add inquiry_product module param to override LIO     default (Kyle Fortin) [Orabug: 27679482]

  - target: add inquiry_vendor module param to override     LIO-ORG (Kyle Fortin) [Orabug: 27679482]

  - net/rds: Avoid copy overhead if send buff is full (Gerd     Rausch) 

  - IB/core: Avoid calling ib_query_device (Or Gerlitz)     [Orabug: 27687710]

  - IB/core: Save the device attributes on the device     structure (Ira Weiny) [Orabug: 27687710]

  - KVM: x86: fix singlestepping over syscall (Paolo     Bonzini) [Orabug: 27669907] (CVE-2017-7518)     (CVE-2017-7518)

  - xen/acpi: upload _PSD info for non-dom0 CPUs too (Joao     Martins) 

  - Revert 'RDS: don't commit to queue till transport     connection is up' (Santosh Shilimkar)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4062 advisory.

    - fork: fix incorrect fput of ->exe_file causing use-after-free (Eric Biggers)  [Orabug: 27290198]     {CVE-2017-17052}
    - KVM: x86: fix singlestepping over syscall (Paolo Bonzini)  [Orabug: 27669907]  {CVE-2017-7518}     {CVE-2017-7518}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124808	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1484)	Nessus	Huawei Local Security Checks	critical
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	high
109114	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0033)	Nessus	OracleVM Local Security Checks	high
109008	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4062)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2017-17052

high

Tenable Plugins

critical

high

high

high