An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted f2fs image.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4118-1 advisory.

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode     validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause     a denial of service (system crash). (CVE-2018-13093)

    Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098, CVE-2018-13099,     CVE-2018-13100, CVE-2018-14614, CVE-2018-14615, CVE-2018-14616)

    Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not     properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when     mounted, could cause a denial of service (system crash). (CVE-2018-14609, CVE-2018-14610, CVE-2018-14611,     CVE-2018-14612, CVE-2018-14613)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not     properly initialize new files in some situations. A local attacker could use this to expose sensitive     information. (CVE-2018-16862)

    Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not     properly validate metadata received from the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2018-19985)

    Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle     size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause     a denial of service (system crash). (CVE-2018-20169)

    Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kernel process scheduler.
    A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)

    It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel     when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

    Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not     properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An     attacker could use this to expose sensitive information. (CVE-2018-5383)

    It was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain     Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of     service (Wi-Fi disconnect). (CVE-2019-0136)

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    It was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for     missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)

    Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values     generated for connectionless networking protocols. A remote attacker could use this to track particular     Linux devices. (CVE-2019-10638)

    Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the     implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly     use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)

    Adam Zabrocki discovered that the Intel i915 kernel mode graphics driver in the Linux kernel did not     properly restrict mmap() ranges in some situations. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-11085)

    It was discovered that an integer overflow existed in the Linux kernel when reference counting pages,     leading to potential use-after-free issues. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-11487)

    Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local     attacker could use this to cause a denial of service (system crash) or expose sensitive information.
    (CVE-2019-11599)

    It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-11810)

    It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram     Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is disabled via blocklist by     default in Ubuntu.

    If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-11815)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-11833)

    It was discovered that the Bluetooth Human Interface Device Protocol (HIDP) implementation in the Linux     kernel did not properly verify strings were NULL terminated in certain situations. A local attacker could     use this to expose sensitive information (kernel memory). (CVE-2019-11884)

    It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication     (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system     crash). (CVE-2019-12818)

    It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device     reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-12819)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the     initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)

    It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading     to a buffer overread. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-14283)

    It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls,     leading to a division-by-zero. A local attacker could use this to cause a denial of service (system     crash). (CVE-2019-14284)

    Tuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in     the Linux kernel. A physically proximate attacker could use this to cause a denial of service.
    (CVE-2019-14763)

    It was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the     Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2019-15090)

    It was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly     allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2019-15211)

    It was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)

    It was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem     of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)

    It was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux     kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)

    It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15220)

    It was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux     kernel if an error occurs during initialization. A local attacker could use this to cause a denial of     service (system crash). (CVE-2019-15292)

    It was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained     a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-2024)

    It was discovered that the USB video device class implementation in the Linux kernel did not properly     validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to     possibly expose sensitive information (kernel memory). (CVE-2019-2101)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

    Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux     kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host     system. (CVE-2019-3900)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol     BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically     proximate attacker could use this to expose sensitive information. (CVE-2019-9506)

    It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent     kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could     use this to expose sensitive information. (CVE-2018-20511)

    It was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper     assumptions about the device characteristics. A physically proximate attacker could use this cause a     denial of service (system crash). (CVE-2019-15218)

    It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data     size information from the device. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2019-15221)

    Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly     restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges     could use this to execute arbitrary code. (CVE-2019-3701)

    Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly     validate passed parameters in some situations. A local privileged attacker could use this to cause a     denial of service (infinite loop). (CVE-2019-3819)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4094-1 advisory.

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode     validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause     a denial of service (system crash). (CVE-2018-13093)

    Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614,     CVE-2018-14616, CVE-2018-13096, CVE-2018-13098, CVE-2018-14615)

    Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not     properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when     mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612,     CVE-2018-14613, CVE-2018-14609)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not     properly initialize new files in some situations. A local attacker could use this to expose sensitive     information. (CVE-2018-16862)

    Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle     size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause     a denial of service (system crash). (CVE-2018-20169)

    It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel     when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

    Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not     properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An     attacker could use this to expose sensitive information. (CVE-2018-5383)

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions     during speculative execution. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-1125)

    It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for     allocation errors in some situations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-12614)

    It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication     (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system     crash). (CVE-2019-12818)

    It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device     reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-12819)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained     a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-2024)

    It was discovered that the USB video device class implementation in the Linux kernel did not properly     validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to     possibly expose sensitive information (kernel memory). (CVE-2019-2101)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

    It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent     kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could     use this to expose sensitive information. (CVE-2018-20511)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-18249

A race condition was discovered in the disk space allocator of F2FS. A user with access to an F2FS volume could use this to cause a denial of service or other security impact.

CVE-2018-1128, CVE-2018-1129

The cephx authentication protocol used by Ceph was susceptible to replay attacks, and calculated signatures incorrectly. These vulnerabilities in the server required changes to authentication that are incompatible with existing clients. The kernel's client code has now been updated to be compatible with the fixed server.

CVE-2018-3639 (SSB)

Multiple researchers have discovered that Speculative Store Bypass (SSB), a feature implemented in many processors, could be used to read sensitive information from another context. In particular, code in a software sandbox may be able to read sensitive information from outside the sandbox. This issue is also known as Spectre variant 4.

This update adds a further mitigation for this issue in the eBPF (Extended Berkeley Packet Filter) implementation.

CVE-2018-5391 (FragmentSmack)

Juha-Matti Tilli discovered a flaw in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker can take advantage of this flaw to trigger time and calculation expensive fragment reassembly algorithms by sending specially crafted packets, leading to remote denial of service.

This was previously mitigated by reducing the default limits on memory usage for incomplete fragmented packets. This update replaces that mitigation with a more complete fix.

CVE-2018-5848

The wil6210 wifi driver did not properly validate lengths in scan and connection requests, leading to a possible buffer overflow. On systems using this driver, a local user with the CAP_NET_ADMIN capability could use this for denial of service (memory corruption or crash) or potentially for privilege escalation.

CVE-2018-12896, CVE-2018-13053

Team OWL337 reported possible integer overflows in the POSIX timer implementation. These might have some security impact.

CVE-2018-13096, CVE-2018-13097, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616

Wen Xu from SSLab at Gatech reported that crafted F2FS volumes could trigger a crash (BUG, Oops, or division by zero) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2018-13406

Dr Silvio Cesare of InfoSect reported a potential integer overflow in the uvesafb driver. A user with permission to access such a device might be able to use this for denial of service or privilege escalation.

CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613

Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes could trigger a crash (Oops) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2018-15471 ((XSA-270)

Felix Wilhelm of Google Project Zero discovered a flaw in the hash handling of the xen-netback Linux kernel module. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in privilege escalation, denial of service, or information leaks.

https://xenbits.xen.org/xsa/advisory-270.html

CVE-2018-16862

Vasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team discovered that the cleancache memory management feature did not invalidate cached data for deleted files. On Xen guests using the tmem driver, local users could potentially read data from other users' deleted files if they were able to create new files on the same volume.

CVE-2018-17972

Jann Horn reported that the /proc/*/stack files in procfs leaked sensitive data from the kernel. These files are now only readable by users with the CAP_SYS_ADMIN capability (usually only root)

CVE-2018-18281

Jann Horn reported a race condition in the virtual memory manager that can result in a process briefly having access to memory after it is freed and reallocated. A local user could possibly exploit this for denial of service (memory corruption) or for privilege escalation.

CVE-2018-18690

Kanda Motohiro reported that XFS did not correctly handle some xattr (extended attribute) writes that require changing the disk format of the xattr. A user with access to an XFS volume could use this for denial of service.

CVE-2018-18710

It was discovered that the cdrom driver does not correctly validate the parameter to the CDROM_SELECT_DISC ioctl. A user with access to a cdrom device could use this to read sensitive information from the kernel or to cause a denial of service (crash).

CVE-2018-19407

Wei Wu reported a potential crash (Oops) in the KVM implementation for x86 processors. A user with access to /dev/kvm could use this for denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.144-3.1~deb8u1. This version also includes fixes for Debian bugs #890034, #896911, #907581, #915229, and #915231; and other fixes included in upstream stable updates.

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New kernel packages are available for Slackware 14.2 to fix security issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3821-2 advisory.

    USN-3821-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that     xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-10880)

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the f2fs filesystem implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13096)

    Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem implementation in the Linux kernel did not     properly handle relocations in some situations. An attacker could use this to construct a malicious btrfs     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14609)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly     restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to     expose sensitive information. (CVE-2018-17972)

    It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly     handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to     cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3821-1 advisory.

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that     xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-10880)

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the f2fs filesystem implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13096)

    Wen Xu and Po-Ning Tseng discovered that the btrfs filesystem implementation in the Linux kernel did not     properly handle relocations in some situations. An attacker could use this to construct a malicious btrfs     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-14609)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly     restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to     expose sensitive information. (CVE-2018-17972)

    It was discovered that the KVM implementation in the Linux kernel on ARM 64bit processors did not properly     handle some ioctls. An attacker with the privilege to create KVM-based virtual machines could use this to     cause a denial of service (host system crash) or execute arbitrary code in the host. (CVE-2018-18021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
128478	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-4118-1)	Nessus	Ubuntu Local Security Checks	critical
127889	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1)	Nessus	Ubuntu Local Security Checks	critical
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	high
122879	Debian DLA-1715-1 : linux-4.9 security update (Spectre)	Nessus	Debian Local Security Checks	high
121505	Slackware 14.2 : Slackware 14.2 kernel (SSA:2019-030-01)	Nessus	Slackware Local Security Checks	high
118972	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3821-2)	Nessus	Ubuntu Local Security Checks	high
118971	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3821-1)	Nessus	Ubuntu Local Security Checks	high
118194	openSUSE Security Update : the Linux Kernel (openSUSE-2018-1184)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-13096

medium

Tenable Plugins

critical

critical

high

high

high

high

high

high