The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the     fact that memory writes occur to an address which     depends on the untrusted value. Such writes cause an     update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to influence speculative execution     and/or read privileged memory by conducting targeted     cache side-channel attacks.(CVE-2018-3693)

  - A flaw named SegmentSmack was found in the way the     Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending     specially modified packets within ongoing TCP sessions     which could lead to a CPU saturation and hence a denial     of service on the system. Maintaining the denial of     service condition requires continuous two-way TCP     sessions to a reachable open port, thus the attacks     cannot be performed using spoofed IP     addresses.(CVE-2018-5390)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation.(CVE-2018-10902)

  - Integer overflow in the aio_setup_single_vector     function in fs/aio.c in the Linux kernel 4.0 allows     local users to cause a denial of service or possibly     have unspecified other impact via a large AIO iovec.
    NOTE: this vulnerability exists because of a     CVE-2012-6701 regression.(CVE-2015-8830)

  - A flaw was found in the Linux networking subsystem     where a local attacker with CAP_NET_ADMIN capabilities     could cause an out-of-bounds memory access by creating     a smaller-than-expected ICMP header and sending to its     destination via sendto().(CVE-2016-8399)

  - Out-of-bounds kernel heap access vulnerability was     found in xfrm, kernel's IP framework for transforming     packets. An error dealing with netlink messages from an     unprivileged user leads to arbitrary read/write and     privilege escalation.(CVE-2017-7184)

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.i1/4^CVE-2018-14646i1/4%0

  - A flaw was found where the kernel truncated the value     used to indicate the size of a buffer which it would     later become zero using an untruncated value. This can     corrupt memory outside of the original     allocation.(CVE-2017-9725)

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation.(CVE-2017-13166)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5754 relies on the     fact that, on impacted microprocessors, during     speculative execution of instruction permission faults,     exception generation triggered by a faulting access is     suppressed until the retirement of the whole     instruction block. In a combination with the fact that     memory accesses may populate the cache even when the     block is being dropped and never committed (executed),     an unprivileged local attacker could use this flaw to     read privileged (kernel space) memory by conducting     targeted cache side-channel attacks. Note:
    CVE-2017-5754 affects Intel x86-64 microprocessors. AMD     x86-64 microprocessors are not affected by this     issue.(CVE-2017-5754)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5753 triggers the     speculative execution by performing a bounds-check     bypass. It relies on the presence of a     precisely-defined instruction sequence in the     privileged code as well as the fact that memory     accesses may cause allocation into the microprocessor's     data cache even for speculatively executed instructions     that never actually commit (retire). As a result, an     unprivileged attacker could use this flaw to cross the     syscall boundary and read privileged memory by     conducting targeted cache side-channel     attacks.(CVE-2017-5753)

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a     privilege escalation.i1/4^CVE-2017-13215i1/4%0

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact     by leveraging the presence of xt_TCPMSS in an iptables     action. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.i1/4^CVE-2017-18017i1/4%0

  - A kernel data leak due to an out-of-bound read was     found in the Linux kernel in     inet_diag_msg_sctp{,l}addr_fill() and     sctp_get_sctp_info() functions present since version     4.7-rc1 through version 4.13. A data leak happens when     these functions fill in sockaddr data structures used     to export socket's diagnostic information. As a result,     up to 100 bytes of the slab data could be leaked to a     userspace.i1/4^CVE-2017-7558i1/4%0

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is     unlikely.i1/4^CVE-2017-0861i1/4%0

  - Improper validation in the bnx2x network card driver of     the Linux kernel version 4.15 can allow for denial of     service (DoS) attacks via a packet with a gso_size     larger than ~9700 bytes. Untrusted guest VMs can     exploit this vulnerability in the host machine, causing     a crash in the network card.i1/4^CVE-2018-1000026i1/4%0

  - An error in the '_sctp_make_chunk()' function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS.i1/4^CVE-2018-5803i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.i1/4^CVE-2018-14646i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OVMF / anaconda / anaconda-core / anaconda-dracut / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow flaw was found in     create_elf_tables(). An unprivileged local user with     access to SUID (or otherwise privileged) binary could     use this flaw to escalate their privileges on the     system.

  - It was discovered that a race condition between     packet_do_bind() and packet_notifier() in the     implementation of AF_PACKET could lead to     use-after-free. An unprivileged user on the host or in     a container could exploit this to crash the kernel or,     potentially, to escalate their privileges in the     system.

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bounds write and a     denial of service or unspecified other impact is     possible by mounting and operating a crafted ext4     filesystem image.(CVE-2018-10878)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10881)

  - A flaw was found in the Linux kernel's ext4 filesystem     code. A stack-out-of-bounds write in     ext4_update_inline_data() is possible when mounting and     writing to a crafted ext4 image. An attacker could use     this to cause a system crash and a denial of     service.(CVE-2018-10880)

  - The crypto API in the Linux kernel through 3.9-rc8 does     not initialize certain length variables, which allows     local users to obtain sensitive information from kernel     stack memory via a crafted recvmsg or recvfrom system     call, related to the hash_recvmsg function in     crypto/algif_hash.c and the skcipher_recvmsg function     in crypto/algif_skcipher.c.(CVE-2013-3076)

  - weakness was found in the Linux kernel's implementation     of random seed data. Programs, early in the boot     sequence, could use the data allocated for the seed     before it was sufficiently generated.(CVE-2018-1108)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972)

  - A security flaw was found in the     chap_server_compute_md5() function in the ISCSI target     code in the Linux kernel in a way an authentication     request from an ISCSI initiator is processed. An     unauthenticated remote attacker can cause a stack     buffer overflow and smash up to 17 bytes of the stack.
    The attack requires the iSCSI target to be enabled on     the victim host. Depending on how the target's code was     built (i.e. depending on a compiler, compile flags and     hardware architecture) an attack may lead to a system     crash and thus to a denial of service or possibly to a     non-authorized access to data exported by an iSCSI     target. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is highly unlikely.(CVE-2018-14633)

  - An issue was discovered in the Linux kernel before     4.18.6. An information leak in cdrom_ioctl_drive_status     in drivers/cdrom/cdrom.c could be used by local     attackers to read kernel memory because a cast from     unsigned long to int interferes with bounds     checking.(CVE-2018-16658)

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to     long form.(CVE-2018-18690)

  - A security flaw was found in the Linux kernel in     drivers/tty/n_tty.c which allows local attackers (ones     who are able to access pseudo terminals) to lock them     up and block further usage of any pseudo terminal     devices due to an EXTPROC versus ICANON confusion in     TIOCINQ handler.(CVE-2018-18386)

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.(CVE-2018-14646)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.5 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service (CVE-2018-14646)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Christian Brauner for reporting this issue.

Bug Fix(es) :

* Previously, the kernel architectures for IBM z Systems were missing support to display the status of the Spectre v2 mitigations. As a consequence, the /sys/devices/system/cpu/vulnerabilities/spectre_v2 file did not exist. With this update, the kernel now shows the status in the above mentioned file and as a result, the file now reports either 'Vulnerable' or 'Mitigation: execute trampolines' message.
(BZ#1636884)

* Previously, under certain conditions, the page direct reclaim code was occasionally stuck in a loop when waiting for the reclaim to finish. As a consequence, affected applications became unresponsive with no progress possible. This update fixes the bug by modifying the page direct reclaim code to bound the waiting time for the reclaim to finish. As a consequence, the affected applications no longer hang in the described scenario. (BZ# 1635132)

* Previously, a packet was missing the User Datagram Protocol (UDP) payload checksum during a full checksum computation, if the hardware checksum was not applied. As a consequence, a packet with an incorrect checksum was dropped by a peer. With this update, the kernel includes the UDP payload checksum during the full checksum computation. As a result, the checksum is computed correctly and the packet can be received by the peer. (BZ#1635796)

* Previously, on user setups running a mixed workload, the scheduler did not pick up tasks because the runqueues were throttled for a long time. As a consequence, the system became partially unresponsive. To fix this bug, the kernel now sets a flag in the cfs_bandwidth struct to secure better task distribution. As a result, the system no longer becomes unresponsive in the described scenario. (BZ#1640676)

* Previously, clearing a CPU mask with the cgroups feature triggered the following warning :

kernel: WARNING: CPU: 422 PID: 364940 at kernel/cpuset.c:955 update_cpumasks_hier+0x3af/0x410

As a consequence, the user's log file was flooded with similar warning messages as above. This update fixes the bug and the warning message no longer appears in the described scenario. (BZ#1644237)

* Previously, a lot of CPU time was occasionally spent in the kernel during a teardown of a container with a lot of memory assigned. As a consequence, an increased risk of CPU soft lockups could occur due to higher latency of a CPU scheduler for other processes during the container teardown. To fix the problem, the kernel now adds a reschedule to the tight kernel loop. As a result, the CPU scheduler latency is not increased by the container teardown and there is not the increased risk of CPU soft lockups in the described scenario.
(BZ#1644672)

* When a user created a VLAN device, the kernel set the wanted_features set of the VLAN to the current features of the base device. As a consequence, when the base device got new features, the features were not propagated to the VLAN device. This update fixes the bug and the VLAN device receives the new features in the described scenario.

Note that this only affects TCP Segmentation Offload (TSO).
(BZ#1644674)

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target (CVE-2018-14633)

* kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service (CVE-2018-14646)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Vincent Pelletier for reporting CVE-2018-14633 and Christian Brauner for reporting CVE-2018-14646.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes. Space precludes documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article:
https://access.redhat.com/articles/3714371

Security Fix(es) :

  - kernel: stack-based buffer overflow in     chap_server_compute_md5() in iscsi target     (CVE-2018-14633)

  - kernel: NULL pointer dereference in     af_netlink.c:__netlink_ns_capable() allows for denial of     service (CVE-2018-14646)

Bug Fix(es) :

See the descriptions in the related Knowledge Article :

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3651 advisory.

  - A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux     kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote     attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the     iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e.
    depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and     thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target.
    Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is     highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. (CVE-2018-14633)

  - The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the
    __netlink_ns_capable() function in the net/netlink/af_netlink.c file. A local attacker could exploit this     when a net namespace with a netnsid is assigned to cause a kernel panic and a denial of service.
    (CVE-2018-14646)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3666 advisory.

  - kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target (CVE-2018-14633)

  - kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service     (CVE-2018-14646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3651 advisory.

  - kernel: stack-based buffer overflow in chap_server_compute_md5() in iscsi target (CVE-2018-14633)

  - kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service     (CVE-2018-14646)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124992	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1539)	Nessus	Huawei Local Security Checks	critical
123700	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1232)	Nessus	Huawei Local Security Checks	medium
122611	Virtuozzo 7 : OVMF / anaconda / anaconda-core / anaconda-dracut / etc (VZA-2019-013)	Nessus	Virtuozzo Local Security Checks	high
122201	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1028)	Nessus	Huawei Local Security Checks	high
121101	Virtuozzo 7 : readykernel-patch (VZA-2018-085)	Nessus	Virtuozzo Local Security Checks	medium
119758	RHEL 7 : kernel (RHSA-2018:3843)	Nessus	Red Hat Local Security Checks	medium
119662	CentOS 7 : kernel (CESA-2018:3651)	Nessus	CentOS Local Security Checks	high
119251	Scientific Linux Security Update : kernel on SL7.x x86_64 (20181127)	Nessus	Scientific Linux Local Security Checks	high
119247	Oracle Linux 7 : kernel (ELSA-2018-3651)	Nessus	Oracle Linux Local Security Checks	high
119173	RHEL 7 : kernel-rt (RHSA-2018:3666)	Nessus	Red Hat Local Security Checks	high
119169	RHEL 7 : kernel (RHSA-2018:3651)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-14646

medium

Tenable Plugins

critical

medium

high

high

medium

medium

high

high

high

high

high