In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.

Four new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)

CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security bugs were fixed: CVE-2018-1128: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network could use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. (bnc#1096748).

CVE-2018-1129: A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. (bnc#1096748).

CVE-2016-8636: Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c allowed local users to cause a denial of service (memory corruption), obtain sensitive information or possibly have unspecified other impact via a write or read request involving the 'RDMA protocol over infiniband' (aka Soft RoCE) technology (bnc#1024908).

CVE-2017-18174: In the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free (bnc#1080533).

CVE-2018-1091: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service (bnc#1087231).

CVE-2018-1120: By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which made a read() call to the /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (bnc#1093158). </pid></pid>

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c has multiple race conditions (bnc#1133188).

CVE-2019-3882: A flaw was found in the vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS) (bsc#1131427).

CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).

CVE-2017-17741: The KVM implementation allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).

CVE-2019-9503, CVE-2019-8564: Multiple brcmfmac frame validation bypasses have been fixed (bnc#1132828, bnc#1132673).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

* Kernel: error in exception handling leads to DoS (CVE-2018-8897)

* Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

* kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068)

* kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

* kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3431641

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

A flaw was found in the Linux kernel's skcipher component, which affects the skcipher_recvmsg function. Attackers using a specific input can lead to a privilege escalation.(CVE-2017-13215)

The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675)

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.(CVE-2018-10901)

A race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory.
(CVE-2018-7995)

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1318 advisory.

    - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
    - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}
    - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878     1569874] {CVE-2018-1000199}
    - [powerpc] tm: Flush TM only if CPU has TM feature (David Gibson) [1563773 1544676] {CVE-2018-1091}
    - [net] netfilter: ebtables: fix erroneous reject of last rule (Florian Westphal) [1552366 1552370]     {CVE-2018-1068}
    - [net] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal) [1552366     1552370] {CVE-2018-1068}
    - [net] netfilter: bridge: ebt_among: add more missing match size checks (Florian Westphal) [1552366     1552370] {CVE-2018-1068}
    - [net] netfilter: bridge: ebt_among: add missing match size checks (Florian Westphal) [1552366 1552370]     {CVE-2018-1068}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Kernel: KVM: error in exception handling leads to wrong     debug stack value (CVE-2018-1087)

  - Kernel: error in exception handling leads to DoS     (CVE-2018-8897)

  - Kernel: ipsec: xfrm: use-after-free leading to potential     privilege escalation (CVE-2017-16939)

  - kernel: Out-of-bounds write via userland offsets in     ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068)

  - kernel: ptrace() incorrect error handling leads to     corruption and DoS (CVE-2018-1000199)

  - kernel: guest kernel crash during core dump on POWER9     host (CVE-2018-1091)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1318 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

    * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick     Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these     bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3431641

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.126 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1091: In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c, a guest kernel crash can     be triggered from unprivileged userspace during a core     dump on a POWER host due to a missing processor feature     check and an erroneous use of transactional memory (TM)     instructions in the core dump path, leading to a denial     of service (bnc#1087231).

  - CVE-2018-7740: The resv_map_release function in     mm/hugetlb.c allowed local users to cause a denial of     service (BUG) via a crafted application that made mmap     system calls and has a large pgoff argument to the     remap_file_pages system call (bnc#1084353).

  - CVE-2018-8043: The unimac_mdio_probe function in     drivers/net/phy/mdio-bcm-unimac.c did not validate     certain resource availability, which allowed local users     to cause a denial of service (NULL pointer dereference)     (bnc#1084829).

  - CVE-2017-18257: The __get_data_block function in     fs/f2fs/data.c allowed local users to cause a denial of     service (integer overflow and loop) via crafted use of     the open and fallocate system calls with an     FS_IOC_FIEMAP ioctl. (bnc#1088241)

  - CVE-2018-8822: Incorrect buffer length handling in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c     could be exploited by malicious NCPFS servers to crash     the kernel or execute code (bnc#1086162).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125282	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1287-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	critical
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	high
110245	CentOS 7 : kernel (CESA-2018:1318)	Nessus	CentOS Local Security Checks	high
110197	Amazon Linux AMI : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	high
110196	Amazon Linux 2 : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	high
109665	Oracle Linux 7 : kernel (ELSA-2018-1318)	Nessus	Oracle Linux Local Security Checks	high
109644	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180508)	Nessus	Scientific Linux Local Security Checks	high
109633	RHEL 7 : kernel (RHSA-2018:1318)	Nessus	Red Hat Local Security Checks	high
109310	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1048-1)	Nessus	SuSE Local Security Checks	high
109103	openSUSE Security Update : the Linux Kernel (openSUSE-2018-377)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-1091

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high

medium