fs/f2fs/extent_cache.c in the Linux kernel before 4.13 mishandles extent trees, which allows local users to cause a denial of service (BUG) via an application with multiple threads.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges.(CVE-2017-8824i1/4%0

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004i1/4%0

  - Integer signedness error in the MSM V4L2 video driver     for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to gain     privileges or cause a denial of service (array overflow     and memory corruption) via a crafted application that     triggers an msm_isp_axi_create_stream     call.(CVE-2016-2061i1/4%0

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system     crash.(CVE-2014-7283i1/4%0

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636i1/4%0

  - Incorrect buffer length handling was found in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in     the Linux kernel, which could be exploited by malicious     NCPFS servers to crash the kernel or possibly execute     an arbitrary code.(CVE-2018-8822i1/4%0

  - ** DISPUTED ** Kernel Samepage Merging (KSM) in the     Linux kernel 2.6.32 through 4.x does not prevent use of     a write-timing side channel, which allows guest OS     users to defeat the ASLR protection mechanism on other     guest OS instances via a Cross-VM ASL INtrospection     (CAIN) attack. NOTE: the vendor states 'Basically if     you care about this attack vector, disable     deduplication.' Share-until-written approaches for     memory conservation among mutually untrusting tenants     are inherently detectable for information disclosure,     and can be classified as potentially misunderstood     behaviors rather than vulnerabilities.(CVE-2015-2877i1/4%0

  - The tty_set_termios_ldisc() function in     'drivers/tty/tty_ldisc.c' in the Linux kernel before     4.5 allows local users to obtain sensitive information     from kernel memory by reading a tty data     structure.(CVE-2015-8964i1/4%0

  - An issue was discovered in the Linux kernel through     4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same     user data twice with copy_from_user. The header part of     the user data is double-fetched, and a malicious user     thread can tamper with the critical variables     (hdr.size_in and hdr.size_out) in the header between     the two fetches because of a race condition, leading to     severe kernel errors, such as buffer over-accesses.
    This bug can cause a local denial of service and     information leakage.(CVE-2018-12633i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1092i1/4%0

  - fs/f2fs/extent_cache.c in the Linux kernel, before     4.13, mishandles extent trees. This allows local users     to cause a denial of service via an application with     multiple threads.(CVE-2017-18193i1/4%0

  - A design flaw was found in the file extended attribute     handling of the Linux kernel's handling of cached     attributes. Too many entries in the cache cause a soft     lockup while attempting to iterate the cache and access     relevant locks.(CVE-2015-8952i1/4%0

  - Off-by-one error in the pipe_advance function in     lib/iov_iter.c in the Linux kernel before 4.9.5 allows     local users to obtain sensitive information from     uninitialized heap-memory locations in opportunistic     circumstances by reading from a pipe after an incorrect     buffer-release decision.(CVE-2017-5550i1/4%0

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806i1/4%0

  - The mp_get_count function in     drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel     before 3.12 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call.(CVE-2013-4516i1/4%0

  - The perf_cpu_time_max_percent_handler function in     kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service     (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an     incorrect sample-rate calculation.(CVE-2017-18255i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when     mounting a crafted btrfs image could lead to a system     crash and a denial of service.(CVE-2018-14609i1/4%0

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003i1/4%0

  - drivers/hid/hid-logitech-dj.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain     sensitive information from kernel memory via a crafted     device.(CVE-2013-2895i1/4%0

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3656-1 advisory.

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3654-2 advisory.

    USN-3654-1 fixed vulnerabilities and added mitigations in the Linux kernel for Ubuntu 16.04 LTS. This     update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04     LTS for Ubuntu 14.04 LTS.

    Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read     may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A     local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3654-1 advisory.

    Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read     may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A     local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated for the x86 architecture (amd64 and   i386) by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated by identifying vulnerable code sections   (array bounds checking followed by array access) and replacing the   array access with the speculation-safe array_index_nospec()   function.

  More use sites will be added over time.

  - CVE-2017-17975     Tuba Yavuz reported a use-after-free flaw in the     USBTV007 audio-video grabber driver. A local user could     use this for denial of service by triggering failure of     audio registration.

  - CVE-2017-18193     Yunlei He reported that the f2fs implementation does not     properly handle extent trees, allowing a local user to     cause a denial of service via an application with     multiple threads.

  - CVE-2017-18216     Alex Chen reported that the OCFS2 filesystem failed to     hold a necessary lock during nodemanager sysfs file     operations, potentially leading to a NULL pointer     dereference. A local user could use this for denial of     service.

  - CVE-2017-18218     Jun He reported a use-after-free flaw in the Hisilicon     HNS ethernet driver. A local user could use this for     denial of service.

  - CVE-2017-18222     It was reported that the Hisilicon Network Subsystem     (HNS) driver implementation does not properly handle     ethtool private flags. A local user could use this for     denial of service or possibly have other impact.

  - CVE-2017-18224     Alex Chen reported that the OCFS2 filesystem omits the     use of a semaphore and consequently has a race condition     for access to the extent tree during read operations in     DIRECT mode. A local user could use this for denial of     service.

  - CVE-2017-18241     Yunlei He reported that the f2fs implementation does not     properly initialise its state if the 'noflush_merge'     mount option is used. A local user with access to a     filesystem mounted with this option could use this to     cause a denial of service.

  - CVE-2017-18257     It was reported that the f2fs implementation is prone to     an infinite loop caused by an integer overflow in the
    __get_data_block() function. A local user can use this     for denial of service via crafted use of the open and     fallocate system calls with an FS_IOC_FIEMAP ioctl.

  - CVE-2018-1065     The syzkaller tool found a NULL pointer dereference flaw     in the netfilter subsystem when handling certain     malformed iptables rulesets. A local user with the     CAP_NET_RAW or CAP_NET_ADMIN capability (in any user     namespace) could use this to cause a denial of service.
    Debian disables unprivileged user namespaces by default.

  - CVE-2018-1066     Dan Aloni reported to Red Hat that the CIFS client     implementation would dereference a NULL pointer if the     server sent an invalid response during NTLMSSP setup     negotiation. This could be used by a malicious server     for denial of service.

  - CVE-2018-1068     The syzkaller tool found that the 32-bit compatibility     layer of ebtables did not sufficiently validate offset     values. On a 64-bit kernel, a local user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this to overwrite kernel memory, possibly leading to     privilege escalation. Debian disables unprivileged user     namespaces by default.

  - CVE-2018-1092     Wen Xu reported that a crafted ext4 filesystem image     would trigger a null dereference when mounted. A local     user able to mount arbitrary filesystems could use this     for denial of service.

  - CVE-2018-1093     Wen Xu reported that a crafted ext4 filesystem image     could trigger an out-of-bounds read in the     ext4_valid_block_bitmap() function. A local user able to     mount arbitrary filesystems could use this for denial of     service.

  - CVE-2018-1108     Jann Horn reported that crng_ready() does not properly     handle the crng_init variable states and the RNG could     be treated as cryptographically safe too early after     system boot.

  - CVE-2018-5803     Alexey Kodanev reported that the SCTP protocol did not     range-check the length of chunks to be created. A local     or remote user could use this to cause a denial of     service.

  - CVE-2018-7480     Hou Tao discovered a double-free flaw in the     blkcg_init_queue() function in block/blk-cgroup.c. A     local user could use this to cause a denial of service     or have other impact.

  - CVE-2018-7566     Fan LongFei reported a race condition in the ALSA     (sound) sequencer core, between write and ioctl     operations. This could lead to an out-of-bounds access     or use-after-free. A local user with access to a     sequencer device could use this for denial of service or     possibly for privilege escalation.

  - CVE-2018-7740     Nic Losby reported that the hugetlbfs filesystem's mmap     operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs     filesystem could use this to cause a denial of service.

  - CVE-2018-7757     Jason Yan reported a memory leak in the SAS     (Serial-Attached SCSI) subsystem. A local user on a     system with SAS devices could use this to cause a denial     of service.

  - CVE-2018-7995     Seunghun Han reported a race condition in the x86 MCE     (Machine Check Exception) driver. This is unlikely to     have any security impact.

  - CVE-2018-8087     A memory leak flaw was found in the hwsim_new_radio_nl()     function in the simulated radio testing tool driver for     mac80211, allowing a local user to cause a denial of     service.

  - CVE-2018-8781     Eyal Itkin reported that the udl (DisplayLink) driver's     mmap operation did not properly range-check the file     offset. A local user with access to a udl framebuffer     device could exploit this to overwrite kernel memory,     leading to privilege escalation.

  - CVE-2018-8822     Dr Silvio Cesare of InfoSect reported that the ncpfs     client implementation did not validate reply lengths     from the server. An ncpfs server could use this to cause     a denial of service or remote code execution in the     client.

  - CVE-2018-10323     Wen Xu reported a NULL pointer dereference flaw in the     xfs_bmapi_write() function triggered when mounting and     operating a crafted xfs filesystem image. A local user     able to mount arbitrary filesystems could use this for     denial of service.

  - CVE-2018-1000199     Andy Lutomirski discovered that the ptrace subsystem did     not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,     or possibly for privilege escalation, on x86 (amd64 and     i386) and possibly other architectures.

ID	Name	Product	Family	Severity
124800	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1476)	Nessus	Huawei Local Security Checks	high
110051	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2, Snapdragon) vulnerabilities (USN-3656-1)	Nessus	Ubuntu Local Security Checks	high
110049	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3654-2)	Nessus	Ubuntu Local Security Checks	high
110048	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3654-1)	Nessus	Ubuntu Local Security Checks	high
109518	Debian DSA-4188-1 : linux - security update (Spectre)	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-18193

medium

Tenable Plugins

high

high

high

high

high