The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K83102920 advisory.

  - The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain     UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if     the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and     mm/userfaultfd.c. (CVE-2018-18397)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - A flaw was found in the implementation of userfaultfd.
    An attacker is able to bypass file permissions on     filesystems mounted with tmpfs/hugetlbs to modify a     file and possibly disrupt normal system behaviour. At     this time there is an understanding there is no crash     or priviledge escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - Integer overflow in the aio_setup_single_vector function     in fs/aio.c in the Linux kernel 4.0 allows local users     to cause a denial of service or possibly have     unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701     regression. (CVE-2015-8830)

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited. (CVE-2016-3672)

  - The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) via vectors     involving omission of the firmware name from a certain     data structure. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2016-7913)

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.
    (CVE-2017-0861)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (>1024) index value. (CVE-2017-1000252)

  - Linux kernel Virtualization Module (CONFIG_KVM) for the     Intel processor family (CONFIG_KVM_INTEL) is vulnerable     to a DoS issue. It could occur if a guest was to flood     the I/O port 0x80 with write requests. A guest user     could use this flaw to crash the host kernel resulting     in DoS. (CVE-2017-1000407)

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can be     sent to an attacker leaking data in kernel address     space. (CVE-2017-1000410)

  - A race condition was found in the Linux kernel before     version 4.11-rc1 in 'fs/timerfd.c' file which allows a     local user to cause a kernel list corruption or use-     after-free via simultaneous operations with a file     descriptor which leverage improper 'might_cancel'     queuing. An unprivileged local user could use this flaw     to cause a denial of service of the system. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although we believe it is unlikely.
    (CVE-2017-10661)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization (nVMX) feature     enabled (nested=1), is vulnerable to a crash due to     disabled external interrupts. As L2 guest could access     (r/w) hardware CR8 register of the host(L0). In a nested     visualization setup, L2 guest user could use this flaw     to potentially crash the host(L0) resulting in DoS.
    (CVE-2017-12154)

  - It was found that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'     do unbalanced pages refcounting if IO vector has small     consecutive buffers belonging to the same page.
    bio_add_pc_page() merges them into one, but the page     reference is never dropped, causing a memory leak and     possible system lockup due to out-of-memory condition.
    (CVE-2017-12190)

  - A flaw was found in the Linux kernel's implementation of     valid_master_desc() in which a memory buffer would be     compared to a userspace value with an incorrect size of     comparison. By bruteforcing the comparison, an attacker     could determine what was in memory after the description     and possibly obtain sensitive information from kernel     memory. (CVE-2017-13305)

  - A use-after-free vulnerability was found in a network     namespaces code affecting the Linux kernel since     v4.0-rc1 through v4.15-rc5. The function     get_net_ns_by_id() does not check for the net::count     value after it has found a peer network in netns_ids idr     which could lead to double free and memory corruption.
    This vulnerability could allow an unprivileged local     user to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     it is thought to be unlikely. (CVE-2017-15129)

  - A use-after-free vulnerability was found when issuing an     ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption or     possibly privilege escalation. (CVE-2017-15265)

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel oops).
    (CVE-2017-15274)

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel, through     4.14.4, does not restrict observations of Netlink     messages to a single net namespace, when CONFIG_NLMON is     enabled. This allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system. (CVE-2017-17449)

  - The usb_destroy_configuration() function, in     'drivers/usb/core/config.c' in the USB core subsystem,     in the Linux kernel through 4.14.5 does not consider the     maximum number of configurations and interfaces before     attempting to release resources. This allows local users     to cause a denial of service, due to out-of-bounds write     access, or possibly have unspecified other impact via a     crafted USB device. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2017-17558)

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial of     service (uninitialized-memory free and kernel crash) or     have an unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable. (CVE-2017-17805)

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact by     leveraging the presence of xt_TCPMSS in an iptables     action. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-18017)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with CAP_SYS_ADMIN     capability) can directly perform the ioctl operations     for dm device creation and removal and this would     typically be outside the direct control of the     unprivileged attacker. (CVE-2017-18203)

  - The madvise_willneed function in the Linux kernel allows     local users to cause a denial of service (infinite loop)     by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found where the kernel truncated the value     used to indicate the size of a buffer which it would     later become zero using an untruncated value. This can     corrupt memory outside of the original allocation.
    (CVE-2017-9725)

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2018-1000004)

  - Improper validation in the bnx2x network card driver of     the Linux kernel version 4.15 can allow for denial of     service (DoS) attacks via a packet with a gso_size     larger than ~9700 bytes. Untrusted guest VMs can exploit     this vulnerability in the host machine, causing a crash     in the network card. (CVE-2018-1000026)

  - By mmap()ing a FUSE-backed file onto a process's memory     containing command line arguments (or environment     strings), an attacker can cause utilities from psutils     or procps (such as ps, w) or any other program which     makes a read() call to the /proc//cmdline (or     /proc//environ) files to block indefinitely (denial     of service) or for some controlled time (as a     synchronization primitive for other attacks).
    (CVE-2018-1120)

  - A null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in the Linux kernel allows a local     user to cause a denial of service by a number of certain     crafted system calls. (CVE-2018-1130)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary task.
    (CVE-2018-17972)

  - A flaw was found in the Linux kernel with files on tmpfs     and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to long     form. (CVE-2018-18690)

  - A flaw was found in the Linux kernel's handling of     loopback devices. An attacker, who has permissions to     setup loopback disks, may create a denial of service or     other unspecified actions. (CVE-2018-5344)

  - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c     in the Linux kernel, through 4.14.15, allows local users     to obtain sensitive address information by reading dmesg     data from an SBS HC printk call. (CVE-2018-5750)

  - An error in the _sctp_make_chunk() function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS. (CVE-2018-5803)

  - In the function wmi_set_ie() in the Linux kernel the     length validation code does not handle unsigned integer     overflow properly. As a result, a large value of the     ie_len argument can cause a buffer overflow and thus a     memory corruption leading to a system crash or other or     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2018-5848)

  - ALSA sequencer core initializes the event pool on demand     by invoking snd_seq_pool_init() when the first write     happens and the pool is empty. A user can reset the pool     size manually via ioctl concurrently, and this may lead     to UAF or out-of-bound access. (CVE-2018-7566)

  - A possible memory corruption due to a type confusion was     found in the Linux kernel in the sk_clone_lock()     function in the net/core/sock.c. The possibility of     local escalation of privileges cannot be fully ruled out     for a local unprivileged attacker. (CVE-2018-9568)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - Integer overflow in the aio_setup_single_vector function     in fs/aio.c in the Linux kernel 4.0 allows local users     to cause a denial of service or possibly have     unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701     regression. (CVE-2015-8830)

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited. (CVE-2016-3672)

  - The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) via vectors     involving omission of the firmware name from a certain     data structure. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2016-7913)

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.
    (CVE-2017-0861)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (>1024) index value. (CVE-2017-1000252)

  - Linux kernel Virtualization Module (CONFIG_KVM) for the     Intel processor family (CONFIG_KVM_INTEL) is vulnerable     to a DoS issue. It could occur if a guest was to flood     the I/O port 0x80 with write requests. A guest user     could use this flaw to crash the host kernel resulting     in DoS. (CVE-2017-1000407)

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can be     sent to an attacker leaking data in kernel address     space. (CVE-2017-1000410)

  - A race condition was found in the Linux kernel before     version 4.11-rc1 in 'fs/timerfd.c' file which allows a     local user to cause a kernel list corruption or use-     after-free via simultaneous operations with a file     descriptor which leverage improper 'might_cancel'     queuing. An unprivileged local user could use this flaw     to cause a denial of service of the system. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although we believe it is unlikely.
    (CVE-2017-10661)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization (nVMX) feature     enabled (nested=1), is vulnerable to a crash due to     disabled external interrupts. As L2 guest could access     (r/w) hardware CR8 register of the host(L0). In a nested     visualization setup, L2 guest user could use this flaw     to potentially crash the host(L0) resulting in DoS.
    (CVE-2017-12154)

  - It was found that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'     do unbalanced pages refcounting if IO vector has small     consecutive buffers belonging to the same page.
    bio_add_pc_page() merges them into one, but the page     reference is never dropped, causing a memory leak and     possible system lockup due to out-of-memory condition.
    (CVE-2017-12190)

  - A flaw was found in the Linux kernel's implementation of     valid_master_desc() in which a memory buffer would be     compared to a userspace value with an incorrect size of     comparison. By bruteforcing the comparison, an attacker     could determine what was in memory after the description     and possibly obtain sensitive information from kernel     memory. (CVE-2017-13305)

  - A use-after-free vulnerability was found in a network     namespaces code affecting the Linux kernel since     v4.0-rc1 through v4.15-rc5. The function     get_net_ns_by_id() does not check for the net::count     value after it has found a peer network in netns_ids idr     which could lead to double free and memory corruption.
    This vulnerability could allow an unprivileged local     user to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     it is thought to be unlikely. (CVE-2017-15129)

  - A use-after-free vulnerability was found when issuing an     ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption or     possibly privilege escalation. (CVE-2017-15265)

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel oops).
    (CVE-2017-15274)

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel, through     4.14.4, does not restrict observations of Netlink     messages to a single net namespace, when CONFIG_NLMON is     enabled. This allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system. (CVE-2017-17449)

  - The usb_destroy_configuration() function, in     'drivers/usb/core/config.c' in the USB core subsystem,     in the Linux kernel through 4.14.5 does not consider the     maximum number of configurations and interfaces before     attempting to release resources. This allows local users     to cause a denial of service, due to out-of-bounds write     access, or possibly have unspecified other impact via a     crafted USB device. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2017-17558)

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial of     service (uninitialized-memory free and kernel crash) or     have an unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable. (CVE-2017-17805)

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact by     leveraging the presence of xt_TCPMSS in an iptables     action. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-18017)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with CAP_SYS_ADMIN     capability) can directly perform the ioctl operations     for dm device creation and removal and this would     typically be outside the direct control of the     unprivileged attacker. (CVE-2017-18203)

  - The madvise_willneed function in the Linux kernel allows     local users to cause a denial of service (infinite loop)     by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found where the kernel truncated the value     used to indicate the size of a buffer which it would     later become zero using an untruncated value. This can     corrupt memory outside of the original allocation.
    (CVE-2017-9725)

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2018-1000004)

  - Improper validation in the bnx2x network card driver of     the Linux kernel version 4.15 can allow for denial of     service (DoS) attacks via a packet with a gso_size     larger than ~9700 bytes. Untrusted guest VMs can exploit     this vulnerability in the host machine, causing a crash     in the network card. (CVE-2018-1000026)

  - By mmap()ing a FUSE-backed file onto a process's memory     containing command line arguments (or environment     strings), an attacker can cause utilities from psutils     or procps (such as ps, w) or any other program which     makes a read() call to the /proc//cmdline (or     /proc//environ) files to block indefinitely (denial     of service) or for some controlled time (as a     synchronization primitive for other attacks).
    (CVE-2018-1120)

  - A null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in the Linux kernel allows a local     user to cause a denial of service by a number of certain     crafted system calls. (CVE-2018-1130)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary task.
    (CVE-2018-17972)

  - A flaw was found in the Linux kernel with files on tmpfs     and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to long     form. (CVE-2018-18690)

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimization) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3646)

  - A flaw was found in the Linux kernel's handling of     loopback devices. An attacker, who has permissions to     setup loopback disks, may create a denial of service or     other unspecified actions. (CVE-2018-5344)

  - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c     in the Linux kernel, through 4.14.15, allows local users     to obtain sensitive address information by reading dmesg     data from an SBS HC printk call. (CVE-2018-5750)

  - An error in the _sctp_make_chunk() function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS. (CVE-2018-5803)

  - In the function wmi_set_ie() in the Linux kernel the     length validation code does not handle unsigned integer     overflow properly. As a result, a large value of the     ie_len argument can cause a buffer overflow and thus a     memory corruption leading to a system crash or other or     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2018-5848)

  - ALSA sequencer core initializes the event pool on demand     by invoking snd_seq_pool_init() when the first write     happens and the pool is empty. A user can reset the pool     size manually via ioctl concurrently, and this may lead     to UAF or out-of-bound access. (CVE-2018-7566)

  - A possible memory corruption due to a type confusion was     found in the Linux kernel in the sk_clone_lock()     function in the net/core/sock.c. The possibility of     local escalation of privileges cannot be fully ruled out     for a local unprivileged attacker. (CVE-2018-9568)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):Use-after-free     vulnerability in driverset/tun.c in the Linux kernel     through 3.11.1 allows local users to gain privileges by     leveraging the CAP_NET_ADMIN capability and providing     an invalid tuntap interface name in a TUNSETIFF ioctl     call.(CVE-2013-4343)It was found that when the gcc     stack protector was enabled, reading the /proc/keys     file could cause a panic in the Linux kernel due to     stack corruption. This happened because an incorrect     buffer size was used to hold a 64-bit timeout value     rendered as weeks.(CVE-2016-7042)A flaw was found in     the Linux kernel that fs/ocfs2/aops.c omits use of a     semaphore and consequently has a race condition for     access to the extent tree during read operations in     DIRECT mode. This allows local users to cause a denial     of service by modifying a certain e_cpos     field.(CVE-2017-18224)The sctp_v6_create_accept_sk     function in net/sctp/ipv6.c in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9075)In     the function sbusfb_ioctl_helper() in     drivers/video/fbdev/sbuslib.c in the Linux kernel, up     to and including 4.15, an integer signedness error     allows arbitrary information leakage for the     FBIOPUTCMAP_SPARC and FBIOGETCMAP_SPARC     commands.(CVE-2018-6412)A race condition flaw was found     in the way the Linux kernel's mmap(2), madvise(2), and     fallocate(2) system calls interacted with each other     while operating on virtual memory file system files. A     local user could use this flaw to cause a denial of     service.(CVE-2014-4171)** RESERVED ** This candidate     has been reserved by an organization or individual that     will use it when announcing a new security problem.
    When the candidate has been publicized, the details for     this candidate will be provided.(CVE-2018-1095)A NULL     pointer dereference flaw was found in the way the Linux     kernel's Stream Control Transmission Protocol (SCTP)     implementation handled simultaneous connections between     the same hosts. A remote attacker could use this flaw     to crash the system.(CVE-2014-5077)A vulnerability was     found in the fs/inode.c:inode_init_owner() function     logic of the LInux kernel that allows local users to     create files with an unintended group ownership and     with group execution and SGID permission bits set, in a     scenario where a directory is SGID and belongs to a     certain group and is writable by a user who is not a     member of this group. This can lead to excessive     permissions granted in case when they should     not.(CVE-2018-13405)In the Linux kernel before 4.20.8,     kvm_ioctl_create_device in virt/kvm/kvm_main.c     mishandles reference counting because of a race     condition, leading to a use-after-free.(CVE-2019-6974)A     flaw was found in the way Linux kernel allocates heap     memory to build the scattergather list from a fragment     list(skb_shinfo(skb)-i1/4zfrag_list) in the socket     buffer(skb_buff). The heap overflow occurred if     'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST'     feature are both used together. A remote user or     process could use this flaw to potentially escalate     their privilege on a system.(CVE-2017-7477)Multiple     integer overflows in Alchemy LCD frame-buffer drivers     in the Linux kernel before 3.12 allow local users to     create a read-write memory mapping for the entirety of     kernel memory, and consequently gain privileges, via     crafted mmap operations, related to the (1)     au1100fb_fb_mmap function in drivers/video/au1100fb.c     and the (2) au1200fb_fb_mmap function in     drivers/video/au1200fb.c.(CVE-2013-4511)It was found     that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in     'block/bio.c' do unbalanced pages refcounting if IO     vector has small consecutive buffers belonging to the     same page. bio_add_pc_page() merges them into one, but     the page reference is never dropped, causing a memory     leak and possible system lockup due to out-of-memory     condition.(CVE-2017-12190)An issue was discovered in     the Linux kernel before 4.19.3. crypto_report_one() and     related functions in crypto/crypto_user.c (the crypto     user configuration API) do not fully initialize     structures that are copied to userspace, potentially     leaking sensitive memory to user programs. NOTE: this     is a CVE-2013-2547 regression but with easier     exploitability because the attacker does not need a     capability (however, the system must have the     CONFIG_CRYPTO_USER kconfig option).(CVE-2018-19854)The     userfaultfd implementation in the Linux kernel before     4.19.7 mishandles access control for certain UFFDIO_     ioctl calls, as demonstrated by allowing local users to     write data into holes in a tmpfs file (if the user has     read-only access to that file, and that file contains     holes), related to fs/userfaultfd.c and     mm/userfaultfd.c.(CVE-2018-18397)The TCP stack in the     Linux kernel through 4.10.6 mishandles the     SCM_TIMESTAMPING_OPT_STATS feature, which allows local     users to obtain sensitive information from the kernel's     internal socket data structures or cause a denial of     service (out-of-bounds read) via crafted system calls,     related to net/core/skbuff.c and     net/socket.c.(CVE-2017-7277)A flaw was found in the way     the Linux kernel's vhost driver treated userspace     provided log file descriptor when processing the     VHOST_SET_LOG_FD ioctl command. The file descriptor was     never released and continued to consume kernel memory.
    A privileged local user with access to the     /dev/vhost-net files could use this flaw to create a     denial-of-service attack.(CVE-2015-6252)A buffer     overflow flaw was found in the way the Linux kernel's     virtio-net subsystem handled certain fraglists when the     GRO (Generic Receive Offload) functionality was enabled     in a bridged network configuration. An attacker on the     local network could potentially use this flaw to crash     the system, or, although unlikely, elevate their     privileges on the system.(CVE-2015-5156)The MSM QDSP6     audio driver (aka sound driver) for the Linux kernel     3.x, as used in Qualcomm Innovation Center (QuIC)     Android contributions for MSM devices and other     products, allows attackers to gain privileges or cause     a denial of service (integer overflow, and buffer     overflow or buffer over-read) via a crafted application     that performs a (1) AUDIO_EFFECTS_WRITE or (2)     AUDIO_EFFECTS_READ operation, aka Qualcomm internal bug     CR1006609.(CVE-2016-2068)The icmp6_send function in     net/ipv6/icmp.c in the Linux kernel through 4.8.12     omits a certain check of the dst data structure which     allows remote attackers to cause a denial of service     (panic) via a fragmented IPv6 packet.(CVE-2016-9919)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0831 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * kernel: lack of check for mmap minimum address in expand_downwards in mm/mmap.c leads to NULL pointer     dereferences exploit on non-SMAP platforms (CVE-2019-9213)

    * kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c (CVE-2018-14734)

    * kernel: Unprivileged users able to inspect kernel stacks of arbitrary tasks (CVE-2018-17972)

    * kernel: TLB flush happens too late on mremap (CVE-2018-18281)

    * kernel: Type confusion in drivers/tty/n_tty.c allows for a denial of service (CVE-2018-18386)

    * kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

    * kernel: Integer overflow in the alarm_timer_nsleep function (CVE-2018-13053)

    * kernel: NULL pointer dereference in xfs_da_shrink_inode function (CVE-2018-13094)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Failed to boot with ftrace=function in kvm with 2vcpu (BZ#1501024)

    * [ALT-7.5][x86_64] perf test 63 - inet_pton fails on x86_64 (BZ#1518836)

    * BUG: potential out-of-bounds string access when forcing a SELinux label on a file (BZ#1595706)

    * stack out-of-bounds in smb{2,3}_create_lease_buf() on SMB2/SMB3 mounts (BZ#1598757)

    * [ALT-7.6][KVM][PANIC] ltp/lite proc01 - Unable to handle kernel paging request at virtual address     ffff7fe000200018 (BZ#1623193)

    * Kernel lock up due to read/write lock (BZ#1636261)

    * [RHEL-ALT] Fix potential Spectre v1 in tty code (BZ#1639679)

    * [Huawei AArch64 7.6 Bug] HNS3: Vlan on HNS3 NIC cannot communicate (BZ#1639713)

    * [RHEL7.6-ALT][AWS] backport nvme: update timeout module parameter type (BZ#1654958)

    * ignore STABLE_FLAG of rmap_item->address in rmap_walk_ksm (BZ#1663565)

    * RHEL-Alt-7.6 - kernel: zcrypt: fix specification exception on z196 at ap probe (BZ#1670018)

    * [Huawei AArch64 7.6 Bug] Flock over NFSv3 failed (BZ#1670650)

    * [Huawei AArch64 7.6/7.6-z Bug] HNS3: if a single transmit packet(skb) has more than 8 frags, will cause     the NIC to be unavailable (BZ#1677643)

    * krb5{,i,p} doesn't work with older enctypes on aarch64 (BZ#1678922)

    Users of kernel are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A security flaw was found in the ip_frag_reasm()     function in net/ipv4/ip_fragment.c in the Linux kernel     which can cause a later system crash in     ip_do_fragment(). With certain non-default, but     non-rare, configuration of a victim host, an attacker     can trigger this crash remotely, thus leading to a     remote denial of service.(CVE-2018-14641)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - The resv_map_release function in mm/hugetlb.c in the     Linux kernel, through 4.15.7, allows local users to     cause a denial of service (BUG) via a crafted     application that makes mmap system calls and has a     large pgoff argument to the remap_file_pages system     call. (CVE-2018-7740)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when     a L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

  - An information leakage issue was found in the way Linux     kernel's KVM hypervisor handled page fault exceptions     while emulating instructions like VMXON, VMCLEAR,     VMPTRLD, and VMWRITE with memory address as an operand.
    It occurs if the operand is a mmio address, as the     returned exception object holds uninitialized stack     memory contents. A guest user/process could use this     flaw to leak host's stack memory contents to a guest.
    (CVE-2019-7222)

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of service.
    (CVE-2018-10322)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the     ext4/mballoc.c:ext4_process_freed_data() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a kernel panic.(CVE-2018-1092)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

  - An issue was discovered in the XFS filesystem in     fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A     NULL pointer dereference may occur for a corrupted xfs     image after xfs_da_shrink_inode() is called with a NULL     bp. This can lead to a system crash and a denial of     service. (CVE-2018-13094)

  - A flaw was found in the Linux kernel with files on     tmpfs and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a     use-after-free issue. A user/process could use this     flaw to crash the guest VM resulting in a denial of     service issue or, potentially, gain privileged access     to a system. (CVE-2019-6974)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3903-2 advisory.

    USN-3903-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04     LTS.

    Jason Wang discovered that the vhost net driver in the Linux kernel contained an out of bounds write     vulnerability. An attacker in a guest virtual machine could use this to cause a denial of service (host     system crash) or possibly execute arbitrary code in the host kernel. (CVE-2018-16880)

    Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict     access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397)

    Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker     could use this to gain access to services that cache authorizations. (CVE-2019-6133)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Jason Wang discovered that the vhost net driver in the Linux kernel contained an out of bounds write vulnerability. An attacker in a guest virtual machine could use this to cause a denial of service (host system crash) or possibly execute arbitrary code in the host kernel.
(CVE-2018-16880)

Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397)

Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker could use this to gain access to services that cache authorizations. (CVE-2019-6133).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3901-2 advisory.

    USN-3901-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu     16.04 LTS.

    Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict     access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397)

    It was discovered that the crypto subsystem of the Linux kernel leaked uninitialized memory to user space     in some situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2018-19854)

    Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker     could use this to gain access to services that cache authorizations. (CVE-2019-6133)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3901-1 advisory.

    Jann Horn discovered that the userfaultd implementation in the Linux kernel did not properly restrict     access to certain ioctls. A local attacker could use this possibly to modify files. (CVE-2018-18397)

    It was discovered that the crypto subsystem of the Linux kernel leaked uninitialized memory to user space     in some situations. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2018-19854)

    Jann Horn discovered a race condition in the fork() system call in the Linux kernel. A local attacker     could use this to gain access to services that cache authorizations. (CVE-2019-6133)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0324 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The timeout handling in the libfc.ko kernel module did not work correctly. This was happening during     certain steps of the Fibre Channel login procedure, when the timeout handling was not synchronized with     the state of a partially offloaded Fibre Channel over Ethernet (FCoE) in the lower-level driver.
    Consequently, the offloaded FCoE state was incorrect, which led to I/O timeout errors until the SCSI error     recovery issued a host reset. This update fixes the bug by improving the libfc.ko error handling during     the fabric login. As a result, the fabric login errors are addressed in time, without the I/O timeouts in     the described scenario. (BZ#1655042)

    * Symmetric Multi-Processing (SMP) or Non-Uniform Memory Access (NUMA) systems in some cases experienced     deadlocks during a task migration and task wakeup operations. Consequently, the systems terminated     unexpectedly with the following message:

        NMI watchdog: Watchdog detected hard LOCKUP on <some CPU #>

    This update fixes the bug by queueing the stopper thread to run after locks are released. As a result, the     deadlocks and the system crashes no longer occur in the described scenario. (BZ#1667326)

    Users of kernel are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4541 advisory.

    - proc: restrict kernel stack dumps to root (Jann Horn)  [Orabug: 29114876]  {CVE-2018-17972}
    - alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner)  [Orabug: 29269148]     {CVE-2018-13053}
    - KVM: Fix UAF in nested posted interrupt processing (Cfir Cohen)  [Orabug: 29172125]  {CVE-2018-16882}
    - Change mincore() to count 'mapped' pages rather than 'cached' pages (Linus Torvalds)  [Orabug: 29187408]     {CVE-2019-5489}
    - userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli)     [Orabug: 29163742]  {CVE-2018-18397}
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli)  [Orabug:
    29163742]  {CVE-2018-18397}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - rds: congestion updates can be missed when kernel low on     memory (Mukesh Kacker) [Orabug: 28425811]

  - net/rds: ib: Fix endless RNR Retries caused by memory     allocation failures (Venkat Venkatsubra) [Orabug:
    28127993]

  - net: rds: fix excess initialization of the recv SGEs     (Zhu Yanjun) [Orabug: 29004503]

  - xhci: fix usb2 resume timing and races. (Mathias Nyman)     [Orabug: 29028940]

  - xhci: Fix a race in usb2 LPM resume, blocking U3 for     usb2 devices (Mathias Nyman) [Orabug: 29028940]

  - userfaultfd: check VM_MAYWRITE was set after verifying     the uffd is registered (Andrea Arcangeli) [Orabug:
    29163750] (CVE-2018-18397)

  - userfaultfd: shmem/hugetlbfs: only allow to register     VM_MAYWRITE vmas (Andrea Arcangeli) [Orabug: 29163750]     (CVE-2018-18397)

  - x86/apic/x2apic: set affinity of a single interrupt to     one cpu (Jianchao Wang) [Orabug: 29196396]

  - xen/blkback: rework validate_io_op (Dongli Zhang)     [Orabug: 29199843]

  - xen/blkback: optimize validate_io_op to filter     BLKIF_OP_RESERVED_1 operation (Dongli Zhang) [Orabug:
    29199843]

  - xen/blkback: do not BUG for invalid blkif_request from     frontend (Dongli Zhang) [Orabug: 29199843]

  - net/rds: WARNING: at net/rds/recv.c:222     rds_recv_hs_exthdrs+0xf8/0x1e0 (Venkat Venkatsubra)     [Orabug: 29201779]

  - xen-netback: wake up xenvif_dealloc_kthread when it     should stop (Dongli Zhang) [Orabug: 29217927]

  - Revert 'xfs: remove nonblocking mode from     xfs_vm_writepage' (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: remove xfs_cancel_ioend' (Wengang Wang)     [Orabug: 29279692]

  - Revert 'xfs: Introduce writeback context for writepages'     (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: xfs_cluster_write is redundant' (Wengang     Wang) [Orabug: 29279692]

  - Revert 'xfs: factor mapping out of xfs_do_writepage'     (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: don't chain ioends during writepage     submission' (Wengang Wang) [Orabug: 29279692]

  - mstflint: Fix coding style issues - left with     LINUX_VERSION_CODE (Idan Mehalel) [Orabug: 28878697]

  - mstflint: Fix coding-style issues (Idan Mehalel)     [Orabug: 28878697]

  - mstflint: Fix errors found with checkpatch script (Idan     Mehalel) [Orabug: 28878697]

  - Added support for 5th Gen devices in Secure Boot module     and mtcr (Adham Masarwah) [Orabug: 28878697]

  - Fix typos in mst_kernel (Adham Masarwah) [Orabug:
    28878697]

  - bnxt_en: Report PCIe link properties with     pcie_print_link_status (Brian Maly) [Orabug: 28942099]

  - selinux: Perform both commoncap and selinux xattr checks     (Eric W. Biederman) [Orabug: 28951521]

  - Introduce v3 namespaced file capabilities (Serge E.
    Hallyn) [Orabug: 28951521]

  - rds: ib: Use a delay when reconnecting to the very same     IP address (H&aring kon Bugge) [Orabug: 29138813]

  - Change mincore to count 'mapped' pages rather than     'cached' pages (Linus Torvalds) [Orabug: 29187415]     (CVE-2019-5489)

  - NFSD: Set the attributes used to store the verifier for     EXCLUSIVE4_1 (Kinglong Mee) [Orabug: 29204157]

  - ext4: update i_disksize when new eof exceeds it (Shan     Hai) [Orabug: 28940828]

  - ext4: update i_disksize if direct write past ondisk size     (Eryu Guan) [Orabug: 28940828]

  - ext4: protect i_disksize update by i_data_sem in direct     write path (Eryu Guan) [Orabug: 28940828]

  - ALSA: usb-audio: Fix UAF decrement if card has no live     interfaces in card.c (Hui Peng) [Orabug: 29042981]     (CVE-2018-19824)

  - ALSA: usb-audio: Replace probing flag with active     refcount (Takashi Iwai) [Orabug: 29042981]     (CVE-2018-19824)

  - ALSA: usb-audio: Avoid nested autoresume calls (Takashi     Iwai) [Orabug: 29042981] (CVE-2018-19824)

  - ext4: validate that metadata blocks do not overlap     superblock (Theodore Ts'o) [Orabug: 29114440]     (CVE-2018-1094)

  - ext4: update inline int ext4_has_metadata_csum(struct     super_block *sb) (John Donnelly) [Orabug: 29114440]     (CVE-2018-1094)

  - ext4: always initialize the crc32c checksum driver     (Theodore Ts'o) [Orabug: 29114440] (CVE-2018-1094)     (CVE-2018-1094)

  - Revert 'bnxt_en: Reduce default rings on multi-port     cards.' (Brian Maly) [Orabug: 28687746]

  - mlx4_core: Disable P_Key Violation Traps (H&aring kon     Bugge) [Orabug: 27693633]

  - rds: RDS connection does not reconnect after CQ access     violation error (Venkat Venkatsubra) [Orabug: 28733324]

  - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL     (KarimAllah Ahmed) [Orabug: 28069548]

  - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL -     reloaded (Mihai Carabas) [Orabug: 28069548]

  - KVM/x86: Add IBPB support (Ashok Raj) [Orabug: 28069548]

  - KVM: x86: pass host_initiated to functions that read     MSRs (Paolo Bonzini) [Orabug: 28069548]

  - KVM: VMX: make MSR bitmaps per-VCPU (Paolo Bonzini)     [Orabug: 28069548]

  - KVM: VMX: introduce alloc_loaded_vmcs (Paolo Bonzini)     [Orabug: 28069548]

  - KVM: nVMX: Eliminate vmcs02 pool (Jim Mattson) [Orabug:
    28069548]

  - KVM: nVMX: fix msr bitmaps to prevent L2 from accessing     L0 x2APIC (Radim Kr&#x10D m&aacute &#x159 ) [Orabug:
    28069548]

  - ocfs2: don't clear bh uptodate for block read (Junxiao     Bi) [Orabug: 28762940]

  - ocfs2: clear journal dirty flag after shutdown journal     (Junxiao Bi) [Orabug: 28924775]

  - ocfs2: fix panic due to unrecovered local alloc (Junxiao     Bi) [Orabug: 28924775]

  - net: rds: fix rds_ib_sysctl_max_recv_allocation error     (Zhu Yanjun) [Orabug: 28947481]

  - x86/speculation: Always disable IBRS in     disable_ibrs_and_friends (Alejandro Jimenez) [Orabug:
    29139710]

  - pinctrl: amd: Use devm_pinctrl_register for pinctrl     registration (Laxman Dewangan) [Orabug: 27539246]     (CVE-2017-18174)

  - mlock: fix mlock count can not decrease in race     condition (Yisheng Xie) [Orabug: 27677611]     (CVE-2017-18221)

  - perf/core: Fix the perf_cpu_time_max_percent check (Tan     Xiaojun) [Orabug: 27823815] (CVE-2017-18255)

  - x86/microcode/intel: Fix a wrong assignment of revision     in _save_mc (Zhenzhong Duan) [Orabug: 28190263]

  - mm: cma: fix incorrect type conversion for size during     dma allocation (Rohit Vaswani) [Orabug: 28407826]     (CVE-2017-9725)

  - x86/speculation: Make enhanced IBRS the default spectre     v2 mitigation (Alejandro Jimenez) [Orabug: 28474851]

  - x86/speculation: Enable enhanced IBRS usage (Alejandro     Jimenez) [Orabug: 28474851]

  - x86/speculation: functions for supporting enhanced IBRS     (Alejandro Jimenez) [Orabug: 28474851]

  - xen/blkback: fix disconnect while I/Os in flight     (Juergen Gross) [Orabug: 28744234]

  - mlx4_vnic: use the mlid while calling ib_detach_mcast     (aru kolappan) [Orabug: 29029705]

  - ext4: fail ext4_iget for root directory if unallocated     (Theodore Ts'o) [Orabug: 29048557] (CVE-2018-1092)     (CVE-2018-1092)

  - Bluetooth: hidp: buffer overflow in hidp_process_report     (Mark Salyzyn) [Orabug: 29121215] (CVE-2018-9363)     (CVE-2018-9363)

  - HID: debug: check length before copy_to_user (Daniel     Rosenberg) [Orabug: 29128165] (CVE-2018-9516)

  - x86/MCE: Serialize sysfs changes (Seunghun Han) [Orabug:
    29149888] (CVE-2018-7995)

  - Input: i8042 - fix crash at boot time (Chen Hong)     [Orabug: 29152328] (CVE-2017-18079)

  - base/memory, hotplug: fix a kernel oops in     show_valid_zones (Toshi Kani) [Orabug: 29050538]

  - mm/memory_hotplug.c: check start_pfn in     test_pages_in_a_zone (Toshi Kani) [Orabug: 29050538]

  - drivers/base/memory.c: prohibit offlining of memory     blocks with missing sections (Seth Jennings) [Orabug:
    29050538]

  - mm: Check if section present during memory block     (un)registering (Yinghai Lu) [Orabug: 29050538]

  - hugetlb: take PMD sharing into account when flushing     tlb/caches (Mike Kravetz) [Orabug: 28951854]

  - mm: migration: fix migration of huge PMD shared pages     (Mike Kravetz) [Orabug: 28951854]

  - hugetlbfs: use truncate mutex to prevent pmd sharing     race (Mike Kravetz) [Orabug: 28896255]

  - rds: ib: Improve tracing during failover/back     (H&aring kon Bugge) [Orabug: 28860366]

  - rds: ib: Remove superfluous add of address on fail-back     device (H&aring kon Bugge) [Orabug: 28860366]

  - libiscsi: Fix NULL pointer dereference in     iscsi_eh_session_reset (Fred Herard) [Orabug: 28946207]

  - wil6210: missing length check in wmi_set_ie (Lior David)     [Orabug: 28951265] (CVE-2018-5848)

  - netfilter: xt_osf: Add missing permission checks (Kevin     Cernekee) [Orabug: 29037831] (CVE-2017-17450)

  - x86/speculation: Fix bad argument to rdmsrl in     cpu_set_bug_bits (Alejandro Jimenez) [Orabug: 29044805]

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

This update brings following features :

Support for Enhanced-IBRS on new Intel CPUs (fate#326564)

The following security bugs were fixed: CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).

CVE-2018-12232: In net/socket.c there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions.
fchownat did not increment the file descriptor reference count, which allowed close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash (bnc#1097593).

CVE-2018-14625: A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients (bnc#1106615).

CVE-2018-16862: A security flaw was found in the way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (bnc#1117186).

CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).

CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).

CVE-2018-18397: The userfaultfd implementation mishandled access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c (bnc#1117656).

CVE-2018-18710: An information leak in cdrom_ioctl_select_disc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658 (bnc#1113751).

CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).

CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).

CVE-2018-19854: An issue was discovered in the crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs.
NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker did not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option) (bnc#1118428).

CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).

CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel for Azure was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic was uninitialized (bnc#1116841).

CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).

CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).

CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation (bnc#1118319).

CVE-2018-16862: A security flaw was found in the way that the cleancache subsystem clears an inode after the final file truncation (removal). The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (bnc#1117186).

CVE-2018-14625: A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients (bnc#1106615).

CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).

CVE-2018-12232: In net/socket.c there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions.
fchownat did not increment the file descriptor reference count, which allowed close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash (bnc#1097593).

CVE-2018-18397: The userfaultfd implementation mishandled access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c (bnc#1117656).

CVE-2018-19854: An issue was discovered in the crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs.
NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker did not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option) (bnc#1118428).

CVE-2018-19824: A local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usb_audio_probe in sound/usb/card.c (bnc#1118152).

CVE-2018-18281: The mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. (bnc#1113769).

CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1074578)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4528 advisory.

    - userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli)     [Orabug: 29163750]  {CVE-2018-18397}
    - userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli)  [Orabug:
    29163750]  {CVE-2018-18397}
    - Change mincore() to count 'mapped' pages rather than 'cached' pages (Linus Torvalds)  [Orabug: 29187415]     {CVE-2019-5489}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

* kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes and enhancements. Space precludes documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3827321

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-0163 advisory.

    - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: uffdio_copy: set the page dirty if VM_WRITE is not set (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: add i_size checks (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [fs] userfaultfd: disable irqs when taking the waitqueue lock (Andrea Arcangeli) [1640518 1640519]     {CVE-2018-18397}
    - [fs] userfaultfd.c: remove redundant pointer uwq (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
    - [fs] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [fs] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: prevent non-cooperative events vs mcopy_atomic races (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [fs] userfaultfd: convert to use anon_inode_getfd() (Andrea Arcangeli) [1640518 1640519]     {CVE-2018-18397}
    - [fs] mm, userfaultfd, thp: avoid waiting when PMD under THP migration (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1643680 1643681]     {CVE-2018-18559}
    - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-9568: In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. (bnc#1118319).

CVE-2018-12232: In net/socket.c in the there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions. fchownat did not increment the file descriptor reference count, which allowed close to set the socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash (bnc#1097593).

CVE-2018-14625: A flaw was found where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients (bnc#1106615).

CVE-2018-16862: A security flaw was found in a way that the cleancache subsystem clears an inode after the final file truncation (removal).
The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one (bnc#1117186).

CVE-2018-16884: NFS41+ shares mounted in different network namespaces at the same time can make bc_svc_process() use wrong back-channel IDs and cause a use-after-free vulnerability. Thus a malicious container user can cause a host kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out (bnc#1119946).

CVE-2018-18397: The userfaultfd implementation mishandled access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c (bnc#1117656).

CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).

CVE-2018-19854: An issue was discovered in the crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs.
NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker did not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option) (bnc#1118428).

CVE-2018-19985: The function hso_probe read if_num from the USB device (as an u8) and used it without a length check to index an array, resulting in an OOB memory read in hso_probe or hso_get_config_data that could be used by local attackers (bnc#1120743).

CVE-2018-20169: The USB subsystem mishandled size checks during the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c (bnc#1119714).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - kernel: Use-after-free due to race condition in     AF_PACKET implementation (CVE-2018-18559)

  - kernel: userfaultfd bypasses tmpfs file permissions     (CVE-2018-18397)

Bug Fix(es) :

See the descriptions in the related Knowledge Article :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0202 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * When applying two instances of the kprobe debugging mechanism to the same function, one of the kprobes     in some cases failed, depending on the kernel address space layout. Consequently, a kprobe registration     error occurred. This update fixes the bug in the kprobes registration code to properly detect and handle     ftrace-based kprobes. As a result, both kprobes now apply successfully in the described scenario.
    (BZ#1647815)

    * Under heavy mad packet load, the SELinux checks in the mad packet queries for InfiniBand (IB) fabrics     significantly increased the mad packet execution time. Consequently, if a single machine was executing a     large perfquery to the IB switches of a High Performance (HPC) fabric, mad_rpc timeouts occurred, and the     query failed even with SELinux disabled. This update eliminates the SELinux checks when SELinux is     disabled. As a result, the mad packet queries through perfquery now have their original run times when     SELinux is disabled. (BZ#1648810)

    * Previously, a file-system shutdown process caused by an I/O error could race against a running fstrim     process to acquire a xfs buffer lock. Consequently, the file-system shutdown process never completed due     to a deadlock and the file-system became unresponsive, unable to be unmounted. This update fixes the lock     ordering so that the deadlock no longer occurs and the file-system shutdown process now completes in the     described scenario. (BZ#1657142)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0163 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes and enhancements. Space precludes     documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3827321

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
151465	F5 Networks BIG-IP : Linux kernel vulnerability (K83102920)	Nessus	F5 Networks Local Security Checks	medium
133451	Virtuozzo 7 : readykernel-patch (VZA-2019-006)	Nessus	Virtuozzo Local Security Checks	medium
127281	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0074)	Nessus	NewStart CGSL Local Security Checks	critical
127272	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0070)	Nessus	NewStart CGSL Local Security Checks	critical
124984	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1531)	Nessus	Huawei Local Security Checks	high
124257	RHEL 7 : kernel-alt (RHSA-2019:0831)	Nessus	Red Hat Local Security Checks	high
122699	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1076)	Nessus	Huawei Local Security Checks	high
122669	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3903-2)	Nessus	Ubuntu Local Security Checks	high
122668	Ubuntu 18.10 : linux, linux-azure, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3903-1)	Nessus	Ubuntu Local Security Checks	high
122647	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3901-2)	Nessus	Ubuntu Local Security Checks	medium
122646	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3901-1)	Nessus	Ubuntu Local Security Checks	medium
122142	RHEL 7 : kernel (RHSA-2019:0324)	Nessus	Red Hat Local Security Checks	medium
122141	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4541)	Nessus	Oracle Linux Local Security Checks	high
121605	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0002)	Nessus	OracleVM Local Security Checks	critical
121571	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:0224-1)	Nessus	SuSE Local Security Checks	high
121569	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0222-1) (Spectre)	Nessus	SuSE Local Security Checks	high
121566	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4528)	Nessus	Oracle Linux Local Security Checks	medium
121547	CentOS 7 : kernel (CESA-2019:0163)	Nessus	CentOS Local Security Checks	high
121496	Oracle Linux 7 : kernel (ELSA-2019-0163)	Nessus	Oracle Linux Local Security Checks	high
121466	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0196-1)	Nessus	SuSE Local Security Checks	high
121456	Scientific Linux Security Update : kernel on SL7.x x86_64 (20190129)	Nessus	Scientific Linux Local Security Checks	high
121453	RHEL 7 : kernel (RHSA-2019:0202)	Nessus	Red Hat Local Security Checks	medium
121449	RHEL 7 : kernel (RHSA-2019:0163)	Nessus	Red Hat Local Security Checks	high
121289	openSUSE Security Update : the Linux Kernel (openSUSE-2019-65)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-18397

medium

Tenable Plugins

medium

medium

critical

critical

high

high

high

high

high

medium

medium

medium

high

critical

high

high

medium

high

high

high

high

medium

high

high