In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file. This vulnerability can be triggered by an unprivileged user with the ability to create files and execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the ea_get function in fs/jfs/xattr.c in the Linux     kernel through 4.17.1, a memory corruption bug in JFS     can be triggered by calling setxattr twice with two     different extended attribute names on the same file.
    This vulnerability can be triggered by an unprivileged     user with the ability to create files and execute     programs. A kmalloc call is incorrect, leading to     slab-out-of-bounds in jfs_xattr.(CVE-2018-12233i1/4%0

  - The spectre_v2_select_mitigation function in     arch/x86/kernel/cpu/bugs.c in the Linux kernel before     4.18.1 does not always fill RSB upon a context switch,     which makes it easier for attackers to conduct     userspace-userspace spectreRSB     attacks.(CVE-2018-15572i1/4%0

  - Race condition in the queue_delete function in     sound/core/seq/seq_queue.c in the Linux kernel before     4.4.1 allows local users to cause a denial of service     (use-after-free and system crash) by making an ioctl     call at a certain time.(CVE-2016-2544i1/4%0

  - A flaw was found in the Linux kernel's implementation     of BPF in which systems can application can overflow a     32 bit refcount in both program and map refcount. This     refcount can wrap and end up a user after     free.(CVE-2016-4558i1/4%0

  - Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block     device.(CVE-2013-4299i1/4%0

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537i1/4%0

  - A vulnerability in the handling of Transactional Memory     on powerpc systems was found. An unprivileged local     user can crash the kernel by starting a transaction,     suspending it, and then calling any of the exec() class     system calls.(CVE-2016-5828i1/4%0

  - A cross-boundary flaw was discovered in the Linux     kernel software raid driver. The driver accessed a     disabled bitmap where only the first byte of the buffer     was initialized to zero. This meant that the rest of     the request (up to 4095 bytes) was left and copied into     user space. An attacker could use this flaw to read     private information from user space that would not     otherwise have been accessible.(CVE-2015-5697i1/4%0

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643i1/4%0

  - Race condition in the sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch' vulnerability.(CVE-2016-6130i1/4%0

  - drivers/net/usb/asix_devices.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16647i1/4%0

  - A flaw was found in the Linux kernel which could cause     a kernel panic when restoring machine specific     registers on the PowerPC platform. Incorrect     transactional memory state registers could     inadvertently change the call path on return from     userspace and cause the kernel to enter an unknown     state and crash.(CVE-2015-8845i1/4%0

  - fs/namespace.c in the Linux kernel through 3.16.1 does     not properly restrict clearing MNT_NODEV, MNT_NOSUID,     and MNT_NOEXEC and changing MNT_ATIME_MASK during a     remount of a bind mount, which allows local users to     gain privileges, interfere with backups and auditing on     systems that had atime enabled, or cause a denial of     service (excessive filesystem updating) on systems that     had atime disabled via a 'mount -o remount' command     within a user namespace.(CVE-2014-5207i1/4%0

  - The NFS2/3 RPC client could send long arguments to the     NFS server. These encoded arguments are stored in an     array of memory pages, and accessed using pointer     variables. Arbitrarily long arguments could make these     pointers point outside the array and cause an     out-of-bounds memory access. A remote user or program     could use this flaw to crash the kernel, resulting in     denial of service.(CVE-2017-7645i1/4%0

  - The time subsystem in the Linux kernel, when     CONFIG_TIMER_STATS is enabled, allows local users to     discover real PID values (as distinguished from PID     values inside a PID namespace) by reading the     /proc/timer_list file, related to the print_timer     function in kernel/time/timer_list.c and the
    __timer_stats_timer_set_start_info function in     kernel/time/timer.c.(CVE-2017-5967i1/4%0

  - A vulnerability was found in the Linux kernel where the     keyctl_set_reqkey_keyring() function leaks the thread     keyring. This allows an unprivileged local user to     exhaust kernel memory and thus cause a     DoS.(CVE-2017-7472i1/4%0

  - A flaw was found that can be triggered in     keyring_search_iterator in keyring.c if type-i1/4zmatch     is NULL. A local user could use this flaw to crash the     system or, potentially, escalate their     privileges.(CVE-2017-2647i1/4%0

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911i1/4%0

  - Stack-based buffer overflow in the SET_WPS_IE IOCTL     implementation in wlan_hdd_hostapd.c in the WLAN (aka     Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to gain privileges via a crafted     application that uses a long WPS IE     element.(CVE-2015-0570i1/4%0

  - The net_ctl_permissions function in net/sysctl_net.c in     the Linux kernel before 3.11.5 does not properly     determine uid and gid values, which allows local users     to bypass intended /proc/sys/net restrictions via a     crafted application.(CVE-2013-4270i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added :

  - NVDIMM memory error notification (ACPI 6.2) The     following security bugs were fixed :

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function could have result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1100418)

  - CVE-2018-13053: The alarm_timer_nsleep function had an     integer overflow via a large relative timeout because     ktime_add_safe was not used (bnc#1099924)

  - CVE-2018-9385: Prevent overread of the 'driver_override'     buffer (bsc#1100491)

  - CVE-2018-13405: The inode_init_owner function allowed     local users to create files with an unintended group     ownership allowing attackers to escalate privileges by     making a plain file executable and SGID (bnc#1100416)

  - CVE-2017-5753: Systems with microprocessors utilizing     speculative execution and branch prediction may have     allowed unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bsc#1068032)

  - CVE-2018-1118: Linux kernel vhost did not properly     initialize memory in messages passed between virtual     guests and the host operating system. This could have     allowed local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net     device file (bsc#1092472)

  - CVE-2018-12233: A memory corruption bug in JFS could     have been triggered by calling setxattr twice with two     different extended attribute names on the same file.
    This vulnerability could be triggered by an unprivileged     user with the ability to create files and execute     programs (bsc#1097234)

  - CVE-2018-5848: In the function wmi_set_ie(), the length     validation code did not handle unsigned integer overflow     properly. As a result, a large value of the 'ie_len'     argument could have caused a buffer overflow     (bnc#1097356)

  - CVE-2018-1000204: Prevent infoleak caused by incorrect     handling of the SG_IO ioctl (bsc#1096728)

  - CVE-2018-3639: Systems with microprocessors utilizing     speculative execution and speculative execution of     memory reads the addresses of all prior memory writes     are known may have allowed unauthorized disclosure of     information to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4 (bsc#1087082)

  - CVE-2018-1120: By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or     environment strings), an attacker could have caused     utilities from psutils or procps (such as ps, w) to     block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for     other attacks) (bsc#1093158)

  - CVE-2018-1094: The ext4_fill_super function did not     always initialize the crc32c checksum driver, which     allowed attackers to cause a denial of service     (ext4_xattr_inode_hash NULL pointer dereference and     system crash) via a crafted ext4 image (bsc#1087007)

  - CVE-2018-1092: The ext4_iget function mishandled the     case of a root directory with a zero i_links_count,     which allowed attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and     OOPS) via a crafted ext4 image (bsc#1087012)

  - 1093: The ext4_valid_block_bitmap function allowed     attackers to cause a denial of service (out-of-bounds     read and system crash) via a crafted ext4 image because     balloc.c and ialloc.c do not validate bitmap block     numbers (bsc#1087095)

  - CVE-2018-1000200: Prevent NULL pointer dereference which     could have resulted in an out of memory (OOM) killing of     large mlocked processes (bsc#1090150)

  - CVE-2018-1130: NULL pointer dereference in     dccp_write_xmit() function that allowed a local user to     cause a denial of service by a number of certain crafted     system calls (bsc#1092904)

  - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()'     function when handling SCTP packets length that could     have been exploited to cause a kernel crash     (bnc#1083900)

  - CVE-2018-7492: Prevent NULL pointer dereference in the     net/rds/rdma.c __rds_rdma_map() function that allowed     local attackers to cause a system panic and a     denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST (bsc#1082962)

  - CVE-2018-8781: The udl_fb_mmap function had an     integer-overflow vulnerability allowing local users with     access to the udldrmfb driver to obtain full read and     write permissions on kernel physical pages, resulting in     a code execution in kernel space (bsc#1090643)

  - CVE-2018-10124: The kill_something_info function in     kernel/signal.c might have allowed local users to cause     a denial of service via an INT_MIN argument     (bnc#1089752)

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might have allowed local users to cause a     denial of service by triggering an attempted use of the

-INT_MIN value (bnc#1089608)

  - CVE-2017-5715: Prevent unauthorized disclosure of     information to an attacker with local user access caused     by speculative execution and indirect branch prediction     (bsc#1068032)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-3 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

    Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta     block groups. An attacker with physical access could use this to specially craft an ext4 image that causes     a denial of service (system crash). (CVE-2016-10208)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a buffer overflow existed in the ACPI table parsing implementation in the Linux     kernel. A local attacker could use this to construct a malicious ACPI table that, when loaded, caused a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-11473)

    It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data     returned to user space in some situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14991)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    It was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device     attachment and warm-start. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16538)

    Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16643)

    Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux     kernel did not properly handle some error conditions. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18255)

    It was discovered that the keyring subsystem in the Linux kernel did not properly prevent a user from     creating keyrings for other users. A local attacker could use this cause a denial of service or expose     sensitive information. (CVE-2017-18270)

    Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not     properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine     could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in     the guest OS. (CVE-2017-2583)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel improperly emulated certain     instructions. A local attacker could use this to obtain sensitive information (kernel memory).
    (CVE-2017-2584)

    It was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in the Linux kernel did not     properly initialize memory related to logging. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2017-5549)

    Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE)     tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive     information. (CVE-2017-5897)

    Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor     in certain situations. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-6345)

    Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local     attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Pengfei Wang discovered that a race condition existed in the NXP SAA7164 TV Decoder driver for the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8831)

    Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained     race conditions when fetching from the ring-buffer. A local attacker could use this to cause a denial of     service (infinite loop). (CVE-2017-9984, CVE-2017-9985)

    It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments     in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10087)

    It was discovered that the kill() system call implementation in the Linux kernel did not properly validate     its arguments in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10124)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Zhong Jiang discovered that a use-after-free vulnerability existed in the NUMA memory policy     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-10675)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1092)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    It was discovered that the cdrom driver in the Linux kernel contained an incorrect bounds check. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-10940)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

    It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2018-10021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3753-2 advisory.

    USN-3753-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    It was discovered that the generic SCSI driver in the Linux kernel did not properly enforce permissions on     kernel memory access. A local attacker could use this to expose sensitive information or possibly elevate     privileges. (CVE-2017-13168)

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the     Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10876,     CVE-2018-10879)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that an out-of-bounds write vulnerability existed in the ext4 filesystem implementation     in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted,     could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10878,     CVE-2018-10882)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3753-1 advisory.

    It was discovered that the generic SCSI driver in the Linux kernel did not properly enforce permissions on     kernel memory access. A local attacker could use this to expose sensitive information or possibly elevate     privileges. (CVE-2017-13168)

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the     Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10876,     CVE-2018-10879)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that an out-of-bounds write vulnerability existed in the ext4 filesystem implementation     in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted,     could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10878,     CVE-2018-10882)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-2 advisory.

    USN-3752-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-1 advisory.

    It was discovered that, when attempting to handle an out-of-memory situation, a null pointer dereference     could be triggered in the Linux kernel in some circumstances. A local attacker could use this to cause a     denial of service (system crash). (CVE-2018-1000200)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     xattr information. An attacker could use this to construct a malicious xfs image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10840)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    Jann Horn discovered that the Linux kernel's implementation of random seed data reported that it was in a     ready state before it had gathered sufficient entropy. An attacker could use this to expose sensitive     information. (CVE-2018-1108)

    It was discovered that the procfs filesystem did not properly handle processes mapping some memory     elements onto files. A local attacker could use this to block utilities that examine the procfs filesystem     to report operating system state, such as ps(1). (CVE-2018-1120)

    Jann Horn discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep     xattr information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2018-11412)

    Piotr Gabriel Kosinski and Daniel Shapira discovered a stack-based buffer overflow in the CDROM driver     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-11506)

    Shankara Pailoor discovered that a race condition existed in the socket handling code in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-12232)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Felix Wilhelm discovered that the KVM implementation in the Linux kernel did not properly perform     permission checks in some situations when nested virtualization is used. An attacker in a guest VM could     possibly use this to escape into an outer VM or the host OS. (CVE-2018-12904)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Jakub Jirasek discovered that multiple use-after-free errors existed in the USB/IP implementation in the     Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-5814)

    It was discovered that a race condition existed in the ARM Advanced Microcontroller Bus Architecture     (AMBA) driver in the Linux kernel that could result in a double free. A local attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-9415)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2016-8405: An information disclosure vulnerability     in kernel components including the ION subsystem,     Binder, USB driver and networking subsystem could enable     a local malicious application to access data outside of     its permission levels. (bnc#1099942).

  - CVE-2017-13305: A information disclosure vulnerability     existed in the encrypted-keys handling. (bnc#1094353).

  - CVE-2018-1000204: A malformed SG_IO ioctl issued for a     SCSI device could lead to a local kernel information     leak manifesting in up to approximately 1000 memory     pages copied to the userspace. The problem has limited     scope as non-privileged users usually have no     permissions to access SCSI device files. (bnc#1096728).

  - CVE-2018-1068: A flaw was found in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2018-1130: A NULL pointer dereference in     dccp_write_xmit() function in net/dccp/output.c allowed     a local user to cause a denial of service by a number of     certain crafted system calls (bnc#1092904).

  - CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c     a memory corruption bug in JFS can be triggered by     calling setxattr twice with two different extended     attribute names on the same file. This vulnerability can     be triggered by an unprivileged user with the ability to     create files and execute programs. A kmalloc call is     incorrect, leading to slab-out-of-bounds in jfs_xattr     (bnc#1097234).

  - CVE-2018-13053: The alarm_timer_nsleep function in     kernel/time/alarmtimer.c had an integer overflow via a     large relative timeout because ktime_add_safe is not     used (bnc#1099924).

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function in     drivers/video/fbdev/uvesafb.c kernel could result in     local attackers being able to crash the kernel or     potentially elevate privileges because kmalloc_array is     not used (bnc#1098016 1100418).

  - CVE-2018-3620: Local attackers on baremetal systems     could use speculative code patterns on hyperthreaded     processors to read data present in the L1 Datacache used     by other hyperthreads on the same CPU core, potentially     leaking sensitive data. (bnc#1087081).

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system.
    (bnc#1089343).

  - CVE-2018-5803: An error in the '_sctp_make_chunk()'     function (net/sctp/sm_make_chunk.c) when handling SCTP     packets length could be exploited to cause a kernel     crash (bnc#1083900).

  - CVE-2018-5814: Multiple race condition errors when     handling probe, disconnect, and rebind operations could     be exploited to trigger a use-after-free condition or a     NULL pointer dereference by sending multiple USB over IP     packets (bnc#1096480).

  - CVE-2018-7492: A NULL pointer dereference was found in     the net/rds/rdma.c __rds_rdma_map() function allowing     local attackers to cause a system panic and a     denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST (bnc#1082962).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-3620: Local attackers on baremetal systems     could use speculative code patterns on hyperthreaded     processors to read data present in the L1 Datacache used     by other hyperthreads on the same CPU core, potentially     leaking sensitive data. (bnc#1087081).

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system.
    (bnc#1089343).

  - CVE-2018-1000204: A malformed SG_IO ioctl issued for a     SCSI device could lead to a local kernel information     leak manifesting in up to approximately 1000 memory     pages copied to the userspace. The problem has limited     scope as non-privileged users usually have no     permissions to access SCSI device files. (bnc#1096728).

  - CVE-2018-13053: The alarm_timer_nsleep function in     kernel/time/alarmtimer.c had an integer overflow via a     large relative timeout because ktime_add_safe is not     used (bnc#1099924).

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function in     drivers/video/fbdev/uvesafb.c could result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1098016 bnc#1100418).

  - CVE-2016-8405: An information disclosure vulnerability     in kernel components including the ION subsystem,     Binder, USB driver and networking subsystem could enable     a local malicious application to access data outside of     its permission levels. (bnc#1099942).

  - CVE-2018-5814: Multiple race condition errors when     handling probe, disconnect, and rebind operations could     be exploited to trigger a use-after-free condition or a     NULL pointer dereference by sending multiple USB over IP     packets (bnc#1096480).

  - CVE-2018-12233: In the ea_get function in fs/jfs/xattr.c     a memory corruption bug in JFS can be triggered by     calling setxattr twice with two different extended     attribute names on the same file. This vulnerability can     be triggered by an unprivileged user with the ability to     create files and execute programs. (bnc#1097234).

  - CVE-2017-13305: A information disclosure vulnerability     in the Upstream kernel encrypted-keys. (bnc#1094353).

  - CVE-2018-1130: A NULL pointer dereference in     dccp_write_xmit() function in net/dccp/output.c allowed     a local user to cause a denial of service by a number of     certain crafted system calls (bnc#1092904).

  - CVE-2018-1068: A flaw was found in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2018-5803: An error in the '_sctp_make_chunk()'     function (net/sctp/sm_make_chunk.c) when handling SCTP     packets length could be exploited to cause a kernel     crash (bnc#1083900).

  - CVE-2018-7492: A NULL pointer dereference was found in     the net/rds/rdma.c __rds_rdma_map() function allowed     local attackers to cause a system panic and a     denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST (bnc#1082962).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux 4.9 has been packaged for Debian 8 as linux-4.9. This provides a supported upgrade path for systems that currently use kernel packages from the 'jessie-backports' suite.

There is no need to upgrade systems using Linux 3.16, as that kernel version will also continue to be supported in the LTS period.

This backport does not include the following binary packages :

hyperv-daemons libcpupower1 libcpupower-dev libusbip-dev linux-compiler-gcc-4.9-x86 linux-cpupower linux-libc-dev usbip

Older versions of most of those are built from other source packages in Debian 8.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-5753

Further instances of code that was vulnerable to Spectre variant 1 (bounds-check bypass) have been mitigated.

CVE-2017-18255

It was discovered that the performance events subsystem did not properly validate the value of the kernel.perf_cpu_time_max_percent sysctl. Setting a large value could have an unspecified security impact. However, only a privileged user can set this sysctl.

CVE-2018-1118

The syzbot software found that the vhost driver did not initialise message buffers which would later be read by user processes. A user with access to the /dev/vhost-net device could use this to read sensitive information from the kernel or other users' processes.

CVE-2018-1120

Qualys reported that a user able to mount FUSE filesystems can create a process such that when another process attempting to read its command line will be blocked for an arbitrarily long time. This could be used for denial of service, or to aid in exploiting a race condition in the other program.

CVE-2018-1130

The syzbot software found that the DCCP implementation of sendmsg() does not check the socket state, potentially leading to a NULL pointer dereference. A local user could use this to cause a denial of service (crash). 

CVE-2018-3639

Multiple researchers have discovered that Speculative Store Bypass (SSB), a feature implemented in many processors, could be used to read sensitive information from another context. In particular, code in a software sandbox may be able to read sensitive information from outside the sandbox. This issue is also known as Spectre variant 4.

This update allows the issue to be mitigated on some x86 processors by disabling SSB. This requires an update to the processor's microcode, which is non-free. It may be included in an update to the system BIOS or UEFI firmware, or in a future update to the intel-microcode or amd64-microcode packages.

Disabling SSB can reduce performance significantly, so by default it is only done in tasks that use the seccomp feature. Applications that require this mitigation should request it explicitly through the prctl() system call. Users can control where the mitigation is enabled with the spec_store_bypass_disable kernel parameter.

CVE-2018-5814

Jakub Jirasek reported race conditions in the USB/IP host driver. A malicious client could use this to cause a denial of service (crash or memory corruption), and possibly to execute code, on a USB/IP server.

CVE-2018-10021

A physically present attacker who unplugs a SAS cable can cause a denial of service (memory leak and WARN).

CVE-2018-10087, CVE-2018-10124

zhongjiang found that the wait4() and kill() system call implementations did not check for the invalid pid value of INT_MIN. If a user passed this value, the behaviour of the code was formally undefined and might have had a security impact.

CVE-2018-10853

Andy Lutomirski and Mika Penttil&auml; reported that KVM for x86 processors did not perform a necessary privilege check when emulating certain instructions. This could be used by an unprivileged user in a guest VM to escalate their privileges within the guest.

CVE-2018-10876, CVE-2018-10877, CVE-2018-10878, CVE-2018-10879, CVE-2018-10880, CVE-2018-10881, CVE-2018-10882, CVE-2018-10883

Wen Xu at SSLab, Gatech, reported that crafted ext4 filesystem images could trigger a crash or memory corruption. A local user able to mount arbitrary filesystems, or an attacker providing filesystems to be mounted, could use this for denial of service or possibly for privilege escalation.

CVE-2018-10940

Dan Carpenter reported that the optical disc driver (cdrom) does not correctly validate the parameter to the CDROM_MEDIA_CHANGED ioctl. A user with access to a cdrom device could use this to cause a denial of service (crash).

CVE-2018-11506

Piotr Gabriel Kosinski and Daniel Shapira reported that the SCSI optical disc driver (sr) did not allocate a sufficiently large buffer for sense data. A user with access to a SCSI optical disc device that can produce more than 64 bytes of sense data could use this to cause a denial of service (crash or memory corruption), and possibly for privilege escalation.

CVE-2018-12233

Shankara Pailoor reported that a crafted JFS filesystem image could trigger a denial of service (memory corruption). This could possibly also be used for privilege escalation.

CVE-2018-1000204

The syzbot software found that the SCSI generic driver (sg) would in some circumstances allow reading data from uninitialised buffers, which could include sensitive information from the kernel or other tasks. However, only privileged users with the CAP_SYS_ADMIN or CAP_SYS_RAWIO capability were allowed to do this, so this has little or no security impact.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.110-1~deb8u1. This update additionally fixes Debian bugs #860900, #872907, #892057, #896775, #897590, and #898137; and includes many more bug fixes from stable updates 4.9.89-4.9.110 inclusive.

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The previous update to linux failed to build for the armhf (ARM EABI hard-float) architecture. This update corrects that. For all other architectures, there is no need to upgrade or reboot again. For reference, the relevant part of the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-5715

Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using new microcoded features.

This mitigation requires an update to the processor's microcode, which is non-free. For recent Intel processors, this is included in the intel-microcode package from version 3.20180425.1~deb8u1. For other processors, it may be included in an update to the system BIOS or UEFI firmware, or in a later update to the amd64-microcode package.

This vulnerability was already mitigated for the x86 architecture by the 'retpoline' feature.

CVE-2017-5753

Further instances of code that was vulnerable to Spectre variant 1 (bounds-check bypass) have been mitigated.

CVE-2018-1066

Dan Aloni reported to Red Hat that the CIFS client implementation would dereference a NULL pointer if the server sent an invalid response during NTLMSSP setup negotiation. This could be used by a malicious server for denial of service.

The previously applied mitigation for this issue was not appropriate for Linux 3.16 and has been replaced by an alternate fix.

CVE-2018-1093

Wen Xu reported that a crafted ext4 filesystem image could trigger an out-of-bounds read in the ext4_valid_block_bitmap() function. A local user able to mount arbitrary filesystems could use this for denial of service.

CVE-2018-1130

The syzbot software found that the DCCP implementation of sendmsg() does not check the socket state, potentially leading to a NULL pointer dereference. A local user could use this to cause a denial of service (crash). 

CVE-2018-3665

Multiple researchers have discovered that some Intel x86 processors can speculatively read floating-point and vector registers even when access to those registers is disabled. The Linux kernel's 'lazy FPU' feature relies on that access control to avoid saving and restoring those registers for tasks that do not use them, and was enabled by default on x86 processors that do not support the XSAVEOPT instruction.

If 'lazy FPU' is enabled on one of the affected processors, an attacker controlling an unprivileged process may be able to read sensitive information from other users' processes or the kernel. This specifically affects processors based on the 'Nehalem' and 'Westemere' core designs. This issue has been mitigated by disabling 'lazy FPU' by default on all x86 processors that support the FXSAVE and FXRSTOR instructions, which includes all processors known to be affected and most processors that perform speculative execution. It can also be mitigated by adding the kernel parameter: eagerfpu=on

CVE-2018-5814

Jakub Jirasek reported race conditions in the USB/IP host driver. A malicious client could use this to cause a denial of service (crash or memory corruption), and possibly to execute code, on a USB/IP server.

CVE-2018-9422

It was reported that the futex() system call could be used by an unprivileged user for privilege escalation.

CVE-2018-10853

Andy Lutomirski and Mika Penttil&auml; reported that KVM for x86 processors did not perform a necessary privilege check when emulating certain instructions. This could be used by an unprivileged user in a guest VM to escalate their privileges within the guest.

CVE-2018-10940

Dan Carpenter reported that the optical disc driver (cdrom) does not correctly validate the parameter to the CDROM_MEDIA_CHANGED ioctl. A user with access to a cdrom device could use this to cause a denial of service (crash).

CVE-2018-11506

Piotr Gabriel Kosinski and Daniel Shapira reported that the SCSI optical disc driver (sr) did not allocate a sufficiently large buffer for sense data. A user with access to a SCSI optical disc device that can produce more than 64 bytes of sense data could use this to cause a denial of service (crash or memory corruption), and possibly for privilege escalation.

CVE-2018-12233

Shankara Pailoor reported that a crafted JFS filesystem image could trigger a denial of service (memory corruption). This could possibly also be used for privilege escalation.

CVE-2018-1000204

The syzbot software found that the SCSI generic driver (sg) would in some circumstances allow reading data from uninitialised buffers, which could include sensitive information from the kernel or other tasks. However, only privileged users with the CAP_SYS_ADMIN or CAP_SYS_RAWIO capability were allowed to do this, so this has little or no security impact.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.57-1. This update additionally fixes Debian bug #898165, and includes many more bug fixes from stable update 3.16.57.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.136 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-5848: In the function wmi_set_ie(), the length     validation code did not handle unsigned integer overflow     properly. As a result, a large value of the 'ie_len'     argument could have caused a buffer overflow     (bnc#1097356).

  - CVE-2017-18249: The add_free_nid function did not     properly track an allocated nid, which allowed local     users to cause a denial of service (race condition) or     possibly have unspecified other impact via concurrent     threads (bnc#1087036).

  - CVE-2018-3665: Prevent disclosure of FPU registers     (including XMM and AVX registers) between processes.
    These registers might contain encryption keys when doing     SSE accelerated AES enc/decryption (bsc#1087086).

  - CVE-2017-18241: Prevent a NULL pointer dereference by     using a noflush_merge option that triggers a NULL value     for a flush_cmd_control data structure (bnc#1086400).

  - CVE-2017-17741: The KVM implementation in the Linux     kernel allowed attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio     stack-based out-of-bounds read (bnc#1073311).

  - CVE-2018-12233: In the ea_get function in     fs/jfs/xattr.c, a memory corruption bug in JFS can be     triggered by calling setxattr twice with two different     extended attribute names on the same file. This     vulnerability can be triggered by an unprivileged user     with the ability to create files and execute programs. A     kmalloc call is incorrect, leading to slab-out-of-bounds     in jfs_xattr (bnc#1097234).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 42.3 was updated to 4.4.138 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2018-3639: Systems with microprocessors utilizing     speculative execution and speculative execution of     memory reads before the addresses of all prior memory     writes are known may allow unauthorized disclosure of     information to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4 (bsc#1085308 bsc#1087082) This update     improves the previous Spectre Variant 4 fixes and also     mitigates them on the ARM architecture.

  - CVE-2018-3665: The FPU state and registers of x86 CPUs     were saved and restored in a lazy fashion, which opened     its disclosure by speculative side channel attacks. This     has been fixed by replacing the lazy save/restore by     eager saving and restoring (bnc#1087086)

  - CVE-2018-5848: In the function wmi_set_ie(), the length     validation code did not handle unsigned integer overflow     properly. As a result, a large value of the 'ie_len'     argument can cause a buffer overflow (bnc#1097356).

  - CVE-2017-18249: The add_free_nid function in     fs/f2fs/node.c did not properly track an allocated nid,     which allowed local users to cause a denial of service     (race condition) or possibly have unspecified other     impact via concurrent threads (bnc#1087036).

  - CVE-2017-18241: fs/f2fs/segment.c kernel allowed local     users to cause a denial of service (NULL pointer     dereference and panic) by using a noflush_merge option     that triggers a NULL value for a flush_cmd_control data     structure (bnc#1086400).

  - CVE-2017-17741: The KVM implementation allowed attackers     to obtain potentially sensitive information from kernel     memory, aka a write_mmio stack-based out-of-bounds read,     related to arch/x86/kvm/x86.c and     include/trace/events/kvm.h (bnc#1073311 1091815).

  - CVE-2017-13305: A information disclosure vulnerability     in the encrypted-keys. (bnc#1094353).

  - CVE-2018-1093: The ext4_valid_block_bitmap function in     fs/ext4/balloc.c allowed attackers to cause a denial of     service (out-of-bounds read and system crash) via a     crafted ext4 image because balloc.c and ialloc.c do not     validate bitmap block numbers (bnc#1087095).

  - CVE-2018-1094: The ext4_fill_super function in     fs/ext4/super.c did not always initialize the crc32c     checksum driver, which allowed attackers to cause a     denial of service (ext4_xattr_inode_hash NULL pointer     dereference and system crash) via a crafted ext4 image     (bnc#1087007 1092903).

  - CVE-2018-1092: The ext4_iget function in fs/ext4/inode.c     mishandled the case of a root directory with a zero     i_links_count, which allowed attackers to cause a denial     of service (ext4_process_freed_data NULL pointer     dereference and OOPS) via a crafted ext4 image     (bnc#1087012).

  - CVE-2018-12233: In the ea_get function in     fs/jfs/xattr.c, a memory corruption bug in JFS could be     triggered by calling setxattr twice with two different     extended attribute names on the same file. This     vulnerability can be triggered by an unprivileged user     with the ability to create files and execute programs. A     kmalloc call is incorrect, leading to slab-out-of-bounds     in jfs_xattr. (bsc#1097234)

ID	Name	Product	Family	Severity
124802	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1478)	Nessus	Huawei Local Security Checks	high
123226	openSUSE Security Update : the Linux Kernel (openSUSE-2019-536) (Spectre)	Nessus	SuSE Local Security Checks	high
121980	Photon OS 2.0: Linux PHSA-2018-2.0-0083	Nessus	PhotonOS Local Security Checks	high
121874	Photon OS 1.0: Linux PHSA-2018-1.0-0174	Nessus	PhotonOS Local Security Checks	high
120067	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)	Nessus	SuSE Local Security Checks	high
112189	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure, GCP, OEM) vulnerabilities (USN-3752-3)	Nessus	Ubuntu Local Security Checks	high
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	critical
112112	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3753-2)	Nessus	Ubuntu Local Security Checks	high
112111	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3753-1)	Nessus	Ubuntu Local Security Checks	high
112110	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3752-2)	Nessus	Ubuntu Local Security Checks	high
112109	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3752-1)	Nessus	Ubuntu Local Security Checks	high
111833	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:2366-1) (Foreshadow)	Nessus	SuSE Local Security Checks	high
111782	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:2332-1) (Foreshadow)	Nessus	SuSE Local Security Checks	high
111414	openSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)	Nessus	SuSE Local Security Checks	high
111165	Debian DLA-1423-1 : linux-4.9 new package (Spectre)	Nessus	Debian Local Security Checks	high
111082	Debian DLA-1422-2 : linux security update (Spectre)	Nessus	Debian Local Security Checks	high
110660	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1772-1)	Nessus	SuSE Local Security Checks	high
110658	openSUSE Security Update : the Linux Kernel (openSUSE-2018-656) (Spectre)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-12233

high

Tenable Plugins

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high