kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - kernel: out of bounds read in drivers/media/usb/dvb-usb/technisat-usb2.c (CVE-2019-15505)

  - kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

  - block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during     authorization of SCSI commands, which allows local users to bypass intended access restrictions via an     SG_IO ioctl call that leverages overlapping opcodes. (CVE-2012-4542)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3065 advisory.

  - kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation     of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed     before it was sufficiently generated. (CVE-2018-1108)

  - Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernel     (CVE-2021-39713)

  - A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an     improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of     service (DOS) due to a deadlock problem. (CVE-2021-4149)

  - A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

  - A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to     multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Several Linux PV     device frontends are using the grant table interfaces for removing access rights of the backends in ways     being subject to race conditions, resulting in potential data leaks, data corruption by malicious     backends, and denial of service triggered by malicious backends: blkfront, netfront, scsifront and the     gntalloc driver are testing whether a grant reference is still in use. If this is not the case, they     assume that a following removal of the granted access will always succeed, which is not true in case the     backend has mapped the granted page between those two operations. As a result the backend can keep access     to the memory page of the guest no matter how the page will be used after the frontend I/O has finished.
    The xenbus driver has a similar problem, as it doesn't check the success of removing the granted access of     a shared ring buffer. blkfront: CVE-2022-23036 netfront: CVE-2022-23037 scsifront: CVE-2022-23038     gntalloc: CVE-2022-23039 xenbus: CVE-2022-23040 blkfront, netfront, scsifront, usbfront, dmabuf, xenbus,     9p, kbdfront, and pvcalls are using a functionality to delay freeing a grant reference until it is no     longer in use, but the freeing of the related data page is not synchronized with dropping the granted     access. As a result the backend can keep access to the memory page even after it has been freed and then     re-used for a different purpose. CVE-2022-23041 netfront will fail a BUG_ON() assertion if it fails to     revoke access in the rx path. This will result in a Denial of Service (DoS) situation of the guest which     can be triggered by the backend. CVE-2022-23042 (CVE-2022-23036, CVE-2022-23037, CVE-2022-23038,     CVE-2022-23039, CVE-2022-23040, CVE-2022-23041, CVE-2022-23042)

  - Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation,     aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to     influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive     information. (CVE-2022-23960)

  - drivers/usb/gadget/legacy/inode.c in the Linux kernel through 5.16.8 mishandles dev->buf release.
    (CVE-2022-24958)

  - st21nfca_connectivity_event_received in drivers/nfc/st21nfca/se.c in the Linux kernel through 5.16.12 has     EVT_TRANSACTION buffer overflows because of untrusted length parameters. (CVE-2022-26490)

  - An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to     obtain sensitive information from heap memory via crafted frame lengths from a device. (CVE-2022-26966)

  - In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not     validated and might be manipulated by the host for out-of-array access. (CVE-2022-27223)

  - In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

  - net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create     user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to     a use-after-free. (CVE-2022-32250)

  - The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are     used. (CVE-2022-32296)

  - drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of     a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
    (CVE-2022-33981)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A double free vulnerability was found in netlink_dump,     which could cause a denial of service or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9806i1/4%0

  - Memory leak in drivers/media/video/videobuf-core.c in     the videobuf subsystem in the Linux kernel 2.6.x     through 4.x allows local users to cause a denial of     service (memory consumption) by leveraging /dev/video     access for a series of mmap calls that require new     allocations, a different vulnerability than     CVE-2007-6761. NOTE: as of 2016-06-18, this affects     only 11 drivers that have not been updated to use     videobuf2 instead of videobuf.(CVE-2010-5321i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1108i1/4%0

  - The KVM implementation in the Linux kernel through     4.20.5 has an Information Leak.(CVE-2019-7222i1/4%0

  - The adreno_perfcounter_query_group function in     drivers/gpu/msm/adreno_perfcounter.c in the Adreno GPU     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, uses an incorrect integer     data type, which allows attackers to cause a denial of     service (integer overflow, heap-based buffer overflow,     and incorrect memory allocation) or possibly have     unspecified other impact via a crafted     IOCTL_KGSL_PERFCOUNTER_QUERY ioctl     call.(CVE-2016-2062i1/4%0

  - drivers/hid/hid-ntrig.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_NTRIG is enabled, allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted     device.(CVE-2013-2896i1/4%0

  - The wacom_probe function in     drivers/input/tablet/wacom_sys.c in the Linux kernel     before 3.17 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-3139i1/4%0

  - An integer overflow vulnerability in     ip6_find_1stfragopt() function was found. A local     attacker that has privileges (of CAP_NET_RAW) to open     raw socket can cause an infinite loop inside the     ip6_find_1stfragopt() function.(CVE-2017-7542i1/4%0

  - Memory leak in the virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel through 4.11.8 allows attackers to cause a     denial of service (memory consumption) by triggering     object-initialization failures.(CVE-2017-10810i1/4%0

  - The ping_recvmsg function in net/ipv4/ping.c in the     Linux kernel before 3.12.4 does not properly interact     with read system calls on ping sockets, which allows     local users to cause a denial of service (NULL pointer     dereference and system crash) by leveraging unspecified     privileges to execute a crafted     application.(CVE-2013-6432i1/4%0

  - The madvise_willneed function in the Linux kernel     allows local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping.(CVE-2017-18208i1/4%0

  - An issue was discovered in the Linux kernel through     4.18.8. The vmacache_flush_all function in     mm/vmacache.c mishandles sequence number overflows. An     attacker can trigger a use-after-free (and possibly     gain privileges) via certain thread creation, map,     unmap, invalidation, and dereference     operations.(CVE-2018-17182i1/4%0

  - The ieee80211_radiotap_iterator_init function in     net/wireless/radiotap.c in the Linux kernel before     3.11.7 does not check whether a frame contains any data     outside of the header, which might allow attackers to     cause a denial of service (buffer over-read) via a     crafted header.(CVE-2013-7027i1/4%0

  - The Btrfs implementation in the Linux kernel before     3.19 does not ensure that the visible xattr state is     consistent with a requested replacement, which allows     local users to bypass intended ACL settings and gain     privileges via standard filesystem operations (1)     during an xattr-replacement time window, related to a     race condition, or (2) after an xattr-replacement     attempt that fails because the data does not     fit.(CVE-2014-9710i1/4%0

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled duplicate Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3687i1/4%0

  - A syntax vulnerability was discovered in the kernel's     ASN1.1 DER decoder, which could lead to memory     corruption or a complete local denial of service     through x509 certificate DER files. A local system user     could use a specially created key file to trigger     BUG_ON() in the public_key_verify_signature() function     (crypto/asymmetric_keys/public_key.c), to cause a     kernel panic and crash the system.(CVE-2016-2053i1/4%0

  - It was found that the Linux kernel's KVM subsystem did     not handle the VM exits gracefully for the invept     (Invalidate Translations Derived from EPT)     instructions. On hosts with an Intel processor and     invept VM exit support, an unprivileged guest user     could use these instructions to crash the     guest.(CVE-2014-3645i1/4%0

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270i1/4%0

  - The init_new_context function in     arch/x86/include/asm/mmu_context.h in the Linux kernel,     before 4.12.10, does not correctly handle errors from     LDT table allocation when forking a new process. This     could allow a local attacker to achieve a     use-after-free or possibly have unspecified other     impact by running a specially crafted     program.(CVE-2017-17053i1/4%0

  - It was found that the sanity_check_raw_super() function     in 'fs/f2fs/super.c' file in the Linux kernel before     version 4.12-rc1 does not validate the f2fs filesystem     segment count. This allows an unprivileged local user     to cause a system panic and DoS. Due to the nature of     the flaw, privilege escalation cannot be fully ruled     out, although we believe it is     unlikely.(CVE-2017-10662i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A weakness was found in the Linux kernel's     implementation of random seed data. Programs, early in     the boot sequence, could use the data allocated for the     seed before it was sufficiently     generated.(CVE-2018-1108)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A weakness was found in the Linux kernel's     implementation of random seed data. Programs, early in     the boot sequence, could use the data allocated for the     seed before it was sufficiently     generated.i1/4^CVE-2018-1108i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bounds write and a     denial of service or unspecified other impact is     possible by mounting and operating a crafted ext4     filesystem image.(CVE-2018-10878)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10881)

  - A flaw was found in the Linux kernel's ext4 filesystem     code. A stack-out-of-bounds write in     ext4_update_inline_data() is possible when mounting and     writing to a crafted ext4 image. An attacker could use     this to cause a system crash and a denial of     service.(CVE-2018-10880)

  - The crypto API in the Linux kernel through 3.9-rc8 does     not initialize certain length variables, which allows     local users to obtain sensitive information from kernel     stack memory via a crafted recvmsg or recvfrom system     call, related to the hash_recvmsg function in     crypto/algif_hash.c and the skcipher_recvmsg function     in crypto/algif_skcipher.c.(CVE-2013-3076)

  - weakness was found in the Linux kernel's implementation     of random seed data. Programs, early in the boot     sequence, could use the data allocated for the seed     before it was sufficiently generated.(CVE-2018-1108)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972)

  - A security flaw was found in the     chap_server_compute_md5() function in the ISCSI target     code in the Linux kernel in a way an authentication     request from an ISCSI initiator is processed. An     unauthenticated remote attacker can cause a stack     buffer overflow and smash up to 17 bytes of the stack.
    The attack requires the iSCSI target to be enabled on     the victim host. Depending on how the target's code was     built (i.e. depending on a compiler, compile flags and     hardware architecture) an attack may lead to a system     crash and thus to a denial of service or possibly to a     non-authorized access to data exported by an iSCSI     target. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is highly unlikely.(CVE-2018-14633)

  - An issue was discovered in the Linux kernel before     4.18.6. An information leak in cdrom_ioctl_drive_status     in drivers/cdrom/cdrom.c could be used by local     attackers to read kernel memory because a cast from     unsigned long to int interferes with bounds     checking.(CVE-2018-16658)

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to     long form.(CVE-2018-18690)

  - A security flaw was found in the Linux kernel in     drivers/tty/n_tty.c which allows local attackers (ones     who are able to access pseudo terminals) to lock them     up and block further usage of any pseudo terminal     devices due to an EXTPROC versus ICANON confusion in     TIOCINQ handler.(CVE-2018-18386)

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.(CVE-2018-14646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The v4.16.4 update contains fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-3 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-2 advisory.

    USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-1 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

A flaw was found in the Linux kernel's skcipher component, which affects the skcipher_recvmsg function. Attackers using a specific input can lead to a privilege escalation.(CVE-2017-13215)

The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675)

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.(CVE-2018-10901)

A race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory.
(CVE-2018-7995)

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

Update to v4.16.7 which contains fixes across the tree. This also temporarily reverts the fix for CVE-2018-1108 as it resulted in boots hanging in some scenarios.

---- Update to v4.16.6 which contains fixes across the tree

---- Update to v4.16.5 which contains fixes across the tree

----

Rebase to v4.16.4

----

The 4.15.18 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated for the x86 architecture (amd64 and   i386) by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated by identifying vulnerable code sections   (array bounds checking followed by array access) and replacing the   array access with the speculation-safe array_index_nospec()   function.

  More use sites will be added over time.

  - CVE-2017-17975     Tuba Yavuz reported a use-after-free flaw in the     USBTV007 audio-video grabber driver. A local user could     use this for denial of service by triggering failure of     audio registration.

  - CVE-2017-18193     Yunlei He reported that the f2fs implementation does not     properly handle extent trees, allowing a local user to     cause a denial of service via an application with     multiple threads.

  - CVE-2017-18216     Alex Chen reported that the OCFS2 filesystem failed to     hold a necessary lock during nodemanager sysfs file     operations, potentially leading to a NULL pointer     dereference. A local user could use this for denial of     service.

  - CVE-2017-18218     Jun He reported a use-after-free flaw in the Hisilicon     HNS ethernet driver. A local user could use this for     denial of service.

  - CVE-2017-18222     It was reported that the Hisilicon Network Subsystem     (HNS) driver implementation does not properly handle     ethtool private flags. A local user could use this for     denial of service or possibly have other impact.

  - CVE-2017-18224     Alex Chen reported that the OCFS2 filesystem omits the     use of a semaphore and consequently has a race condition     for access to the extent tree during read operations in     DIRECT mode. A local user could use this for denial of     service.

  - CVE-2017-18241     Yunlei He reported that the f2fs implementation does not     properly initialise its state if the 'noflush_merge'     mount option is used. A local user with access to a     filesystem mounted with this option could use this to     cause a denial of service.

  - CVE-2017-18257     It was reported that the f2fs implementation is prone to     an infinite loop caused by an integer overflow in the
    __get_data_block() function. A local user can use this     for denial of service via crafted use of the open and     fallocate system calls with an FS_IOC_FIEMAP ioctl.

  - CVE-2018-1065     The syzkaller tool found a NULL pointer dereference flaw     in the netfilter subsystem when handling certain     malformed iptables rulesets. A local user with the     CAP_NET_RAW or CAP_NET_ADMIN capability (in any user     namespace) could use this to cause a denial of service.
    Debian disables unprivileged user namespaces by default.

  - CVE-2018-1066     Dan Aloni reported to Red Hat that the CIFS client     implementation would dereference a NULL pointer if the     server sent an invalid response during NTLMSSP setup     negotiation. This could be used by a malicious server     for denial of service.

  - CVE-2018-1068     The syzkaller tool found that the 32-bit compatibility     layer of ebtables did not sufficiently validate offset     values. On a 64-bit kernel, a local user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this to overwrite kernel memory, possibly leading to     privilege escalation. Debian disables unprivileged user     namespaces by default.

  - CVE-2018-1092     Wen Xu reported that a crafted ext4 filesystem image     would trigger a null dereference when mounted. A local     user able to mount arbitrary filesystems could use this     for denial of service.

  - CVE-2018-1093     Wen Xu reported that a crafted ext4 filesystem image     could trigger an out-of-bounds read in the     ext4_valid_block_bitmap() function. A local user able to     mount arbitrary filesystems could use this for denial of     service.

  - CVE-2018-1108     Jann Horn reported that crng_ready() does not properly     handle the crng_init variable states and the RNG could     be treated as cryptographically safe too early after     system boot.

  - CVE-2018-5803     Alexey Kodanev reported that the SCTP protocol did not     range-check the length of chunks to be created. A local     or remote user could use this to cause a denial of     service.

  - CVE-2018-7480     Hou Tao discovered a double-free flaw in the     blkcg_init_queue() function in block/blk-cgroup.c. A     local user could use this to cause a denial of service     or have other impact.

  - CVE-2018-7566     Fan LongFei reported a race condition in the ALSA     (sound) sequencer core, between write and ioctl     operations. This could lead to an out-of-bounds access     or use-after-free. A local user with access to a     sequencer device could use this for denial of service or     possibly for privilege escalation.

  - CVE-2018-7740     Nic Losby reported that the hugetlbfs filesystem's mmap     operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs     filesystem could use this to cause a denial of service.

  - CVE-2018-7757     Jason Yan reported a memory leak in the SAS     (Serial-Attached SCSI) subsystem. A local user on a     system with SAS devices could use this to cause a denial     of service.

  - CVE-2018-7995     Seunghun Han reported a race condition in the x86 MCE     (Machine Check Exception) driver. This is unlikely to     have any security impact.

  - CVE-2018-8087     A memory leak flaw was found in the hwsim_new_radio_nl()     function in the simulated radio testing tool driver for     mac80211, allowing a local user to cause a denial of     service.

  - CVE-2018-8781     Eyal Itkin reported that the udl (DisplayLink) driver's     mmap operation did not properly range-check the file     offset. A local user with access to a udl framebuffer     device could exploit this to overwrite kernel memory,     leading to privilege escalation.

  - CVE-2018-8822     Dr Silvio Cesare of InfoSect reported that the ncpfs     client implementation did not validate reply lengths     from the server. An ncpfs server could use this to cause     a denial of service or remote code execution in the     client.

  - CVE-2018-10323     Wen Xu reported a NULL pointer dereference flaw in the     xfs_bmapi_write() function triggered when mounting and     operating a crafted xfs filesystem image. A local user     able to mount arbitrary filesystems could use this for     denial of service.

  - CVE-2018-1000199     Andy Lutomirski discovered that the ptrace subsystem did     not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,     or possibly for privilege escalation, on x86 (amd64 and     i386) and possibly other architectures.

ID	Name	Product	Family	Severity
199280	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195652	RHEL 7 : kernel (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
162697	Debian DLA-3065-1 : linux - LTS security update	Nessus	Debian Local Security Checks	high
124979	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1526)	Nessus	Huawei Local Security Checks	high
124831	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1509)	Nessus	Huawei Local Security Checks	medium
123904	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1218)	Nessus	Huawei Local Security Checks	medium
123226	openSUSE Security Update : the Linux Kernel (openSUSE-2019-536) (Spectre)	Nessus	SuSE Local Security Checks	high
122201	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1028)	Nessus	Huawei Local Security Checks	high
120446	Fedora 28 : kernel (2018-5926c0ffc8)	Nessus	Fedora Local Security Checks	medium
112189	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure, GCP, OEM) vulnerabilities (USN-3752-3)	Nessus	Ubuntu Local Security Checks	high
112110	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3752-2)	Nessus	Ubuntu Local Security Checks	high
112109	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3752-1)	Nessus	Ubuntu Local Security Checks	high
111414	openSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)	Nessus	SuSE Local Security Checks	high
110197	Amazon Linux AMI : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	high
110196	Amazon Linux 2 : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	high
109742	Fedora 26 : kernel (2018-884a105c04)	Nessus	Fedora Local Security Checks	medium
109518	Debian DSA-4188-1 : linux - security update (Spectre)	Nessus	Debian Local Security Checks	high
109422	Fedora 27 : kernel (2018-e71875c4aa)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-1108

medium

Tenable Plugins

critical

critical

high

high

medium

medium

high

high

medium

high

high

high

high

high

high

medium

high

medium