In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory.

  - In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add     from setsockopt and bind on an AF_PACKET socket. This issue exists because of the     15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a     certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier     register action. Later, packet_release operates on only one of the two applicable linked lists. The     attacker can achieve Program Counter control. (CVE-2018-18559)

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a speculative buffer overflow and     side-channel analysis. (CVE-2018-3693)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell     wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or     possibly execute arbitrary code. (CVE-2019-14814)

  - A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params()     function of Marvell Wifi Driver. (CVE-2019-14815)

  - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip     driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly     execute arbitrary code. (CVE-2019-14816)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is     not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to     arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. (CVE-2019-18660)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - In the Linux kernel through 4.20.11, af_alg_release() in crypto/af_alg.c neglects to set a NULL value for     a certain structure member, which leads to a use-after-free in sockfs_setattr. (CVE-2019-8912)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * Kernel: speculative bounds check bypass store (CVE-2018-3693)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

    * kernel: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member,     which leads to a use-after-free in sockfs_setattr (CVE-2019-8912)

    * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in     drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)

    * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

    * kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver (CVE-2019-14816)

    * kernel: buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c (CVE-2019-17133)

    * kernel: heap overflow in mwifiex_set_uap_rates() function of Marvell Wifi Driver leading to DoS     (CVE-2019-14814)

    * kernel: heap-overflow in mwifiex_set_wmm_params() function of Marvell WiFi driver leading to DoS     (CVE-2019-14815)

    * kernel: (powerpc) incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Kernel panic on job cleanup, related to SyS_getdents64 (BZ#1702057)

    * Kernel modules generated incorrectly when system is localized to non-English language (BZ#1705285)

    * RHEL-Alt-7.6 - Fixup tlbie vs store ordering issue on POWER9 (BZ#1756270)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4159 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Out-of-bounds heap access in xfrm (CVE-2017-7184)

    * kernel: Exploitable memory corruption due to UFO to non-UFO path switch (CVE-2017-1000112)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for     non-members (CVE-2018-13405)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * IPv6 UDP inconsistent usage of UFO and HW checksums (BZ#1773816)

    * UDPv6 packets badly fragmented when ESP in use on devices supporting UFO (BZ#1774503)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3967 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974)

    * Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer (CVE-2019-7221)

    * kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of     service (CVE-2017-18208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A cluster node has multiple hung mv processes that are accessing a gfs2 filesystem. (BZ#1716321)

    * Growing unreclaimable slab memory (BZ#1741918)

    * [LLNL 7.5 Bug] slab leak causing a crash when using kmem control group (BZ#1748236)

    * kernel build: parallelize redhat/mod-sign.sh (BZ#1755328)

    * kernel build: speed up module compression step (BZ#1755337)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This issue exists because of the 15fe076edea787807a7cdc168df832544b58eba6 incomplete fix for a race condition. The code mishandles a certain multithreaded case involving a packet_do_bind unregister action followed by a packet_notifier register action. Later, packet_release operates on only one of the two applicable linked lists. The attacker can achieve Program Counter control. (CVE-2018-18559)

Impact

An attacker can exploit this vulnerability by executing arbitrary code with elevated privileges.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by a vulnerability:

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by a vulnerability:

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1190 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

    * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633)

    * kernel: crypto: privilege escalation in skcipher_recvmsg function (CVE-2017-13215)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913)

    * kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message (CVE-2017-11600)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190)

    * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558)

    * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * update the MRG 2.5.z 3.10 kernel-rt sources (BZ#1692711)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1170 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw was found in the implementation of the fill buffer, a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page     fault, the execution will continue speculatively with incorrect data from the fill buffer while the data     is fetched from higher level caches. This response time can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

    * Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore     Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed     processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use     this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

    * Microprocessors use a load port subcomponent to perform load operations from memory or IO. During     a load operation, the load port receives data from the memory or IO subsystem and then provides the data     to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an     attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

    * Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11091)

    * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633)

    * kernel: crypto: privilege escalation in skcipher_recvmsg function (CVE-2017-13215)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913)

    * kernel: Out-of-bounds access via an XFRM_MSG_MIGRATE xfrm Netlink message (CVE-2017-11600)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190)

    * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558)

    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407)

    * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rwsem in inconsistent state leading system to hung (BZ#1690321)

    * efi_bgrt_init fails to ioremap error during boot (BZ#1692284)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In the Linux kernel through 4.19, a use-after-free can     occur due to a race condition between fanout_add from     setsockopt and bind on an AF_PACKET socket. This issue     exists because of the     15fe076edea787807a7cdc168df832544b58eba6 incomplete fix     for a race condition. The code mishandles a certain     multithreaded case involving a packet_do_bind     unregister action followed by a packet_notifier     register action. Later, packet_release operates on only     one of the two applicable linked lists. The attacker     can achieve Program Counter control.(CVE-2018-18559i1/4%0

  - The acpi_ns_terminate() function in     drivers/acpi/acpica/nsutils.c in the Linux kernel     before 4.12 does not flush the operand cache and causes     a kernel stack dump. A local users could obtain     sensitive information from kernel memory and bypass the     KASLR protection mechanism (in the kernel through 4.9)     via a crafted ACPI table.(CVE-2017-11472i1/4%0

  - Race condition in net/packet/af_packet.c in the Linux     kernel allows local users to cause a denial of service     (use-after-free) or possibly have unspecified other     impact via a multithreaded application that makes     PACKET_FANOUT setsockopt system calls.(CVE-2017-6346i1/4%0

  - Multiple race conditions in ipc/shm.c in the Linux     kernel before 3.12.2 allow local users to cause a     denial of service (use-after-free and system crash) or     possibly have unspecified other impact via a crafted     application that uses shmctl IPC_RMID operations in     conjunction with other shm system     calls.(CVE-2013-7026i1/4%0

  - An issue was discovered in the Linux kernel. A NULL     pointer dereference and panic in hfsplus_lookup() in     the fs/hfsplus/dir.c function can occur when opening a     file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is     mounted read-only without a metadata     directory.(CVE-2018-14617i1/4%0

  - The treo_attach function in drivers/usb/serial/visor.c     in the Linux kernel before 4.5 allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and system crash) or possibly have     unspecified other impact by inserting a USB device that     lacks a (1) bulk-in or (2) interrupt-in     endpoint.(CVE-2016-2782i1/4%0

  - An information-exposure flaw was found in the Linux     kernel where the pcpu_embed_first_chunk() function in     mm/percpu.c allows local users to obtain kernel-object     address information by reading the kernel log (dmesg).
    However, this address is not static and cannot be used     to commit a further attack.(CVE-2018-5995i1/4%0

  - Buffer overflow in net/ceph/auth_x.c in Ceph, as used     in the Linux kernel before 3.16.3, allows remote     attackers to cause a denial of service (memory     corruption and panic) or possibly have unspecified     other impact via a long unencrypted auth     ticket.(CVE-2014-6416i1/4%0

  - It was found that the Linux kernel's ptrace subsystem     allowed a traced process' instruction pointer to be set     to a non-canonical memory address without forcing the     non-sysret code path when returning to user space. A     local, unprivileged user could use this flaw to crash     the system or, potentially, escalate their privileges     on the system.Note: The CVE-2014-4699 issue only     affected systems using an Intel CPU.(CVE-2014-4699i1/4%0

  - The snd_compr_tstamp function in     sound/core/compress_offload.c in the Linux kernel     through 4.7, as used in Android before 2016-08-05 on     Nexus 5 and 7 (2013) devices, does not properly     initialize a timestamp data structure, which allows     attackers to obtain sensitive information via a crafted     application, aka Android internal bug 28770164 and     Qualcomm internal bug CR568717.(CVE-2014-9892i1/4%0

  - A flaw was found in the way the Linux kernel's ext4     file system handled the 'page size i1/4z block size'     condition when the fallocate zero range functionality     was used. A local attacker could use this flaw to crash     the system.(CVE-2015-0275i1/4%0

  - An information leak flaw was found in the way the Linux     kernel's ISO9660 file system implementation accessed     data on an ISO9660 image with RockRidge Extension     Reference (ER) records. An attacker with physical     access to the system could use this flaw to disclose up     to 255 bytes of kernel memory.(CVE-2014-9584i1/4%0

  - The pivot_root implementation in fs/namespace.c in the     Linux kernel through 3.17 does not properly interact     with certain locations of a chroot directory, which     allows local users to cause a denial of service     (mount-tree loop) via . (dot) values in both arguments     to the pivot_root system call.(CVE-2014-7970i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel before     4.8.12 does not properly initialize Code Segment (CS)     in certain error cases, which allows local users to     obtain sensitive information from kernel stack memory     via a crafted application.(CVE-2016-9756i1/4%0

  - A flaw was found in the Linux kernel where the     swiotlb_print_info() function in lib/swiotlb.c allows     local users to obtain some kernel address information     by reading the kernel log (dmesg). This address is not     useful to commit a further attack.(CVE-2018-5953i1/4%0

  - A flaw was found in the way the Linux kernel's file     system implementation handled rename operations in     which the source was inside and the destination was     outside of a bind mount. A privileged user inside a     container could use this flaw to escape the bind mount     and, potentially, escalate their privileges on the     system.(CVE-2015-2925i1/4%0

  - A use-after-free fault in the Linux kernel's usbtv     driver could allow an attacker to cause a denial of     service (system crash), or have unspecified other     impacts, by triggering failure of audio registration of     USB hardware using the usbtv kernel     module.(CVE-2017-17975i1/4%0

  - The mm subsystem in the Linux kernel through 4.10.10     does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read     or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access     restrictions) via an application that opens the     /dev/mem file, related to arch/x86/mm/init.c and     drivers/char/mem.c.(CVE-2017-7889i1/4%0

  - A flaw was discovered in the way the kernel allows     stackable filesystems to overlay. A local attacker who     is able to mount filesystems can abuse this flaw to     escalate privileges.(CVE-2014-9922i1/4%0

  - sound/core/timer.c in the Linux kernel before 4.4.1     retains certain linked lists after a close or stop     action, which allows local users to cause a denial of     service (system crash) via a crafted ioctl call,     related to the (1) snd_timer_close and (2)
    _snd_timer_stop functions.(CVE-2016-2548i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In the Linux kernel through 4.14.13, the     rds_message_alloc_sgs() function does not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size() function in 'net/rds/rdma.c') and     thus to a system panic. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the     rds_cmsg_atomic() function in 'net/rds/rdma.c'     mishandles cases where page pinning fails or an invalid     address is supplied by a user. This can lead to a NULL     pointer dereference in rds_atomic_free_op() and thus to     a system panic.(CVE-2018-5333)

  - A flaw was found in the Linux kernel's handling of     loopback devices. An attacker, who has permissions to     setup loopback disks, may create a denial of service or     other unspecified actions.(CVE-2018-5344)

  - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c     in the Linux kernel, through 4.14.15, allows local     users to obtain sensitive address information by     reading dmesg data from an SBS HC printk     call.(CVE-2018-5750)

  - The futex_requeue function in kernel/futex.c in the     Linux kernel, before 4.14.15, might allow attackers to     cause a denial of service (integer overflow) or     possibly have unspecified other impacts by triggering a     negative wake or requeue value. Due to the nature of     the flaw, privilege escalation cannot be fully ruled     out, although we believe it is unlikely.(CVE-2018-6927)

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757)

  - A an integer overflow vulnerability was discovered in     the Linux kernel, from version 3.4 through 4.15, in the     drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An     attacker with access to the udldrmfb driver could     exploit this to obtain full read and write permissions     on kernel physical pages, resulting in a code execution     in kernel space.(CVE-2018-8781)

  - A flaw was found in the way the Linux KVM module     processed the trap flag(TF) bit in EFLAGS during     emulation of the syscall instruction, which leads to a     debug exception(#DB) being raised in the guest stack. A     user/process inside a guest could use this flaw to     potentially escalate their privileges inside the guest.
    Linux guests are not affected by this.(CVE-2017-7518)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service.(CVE-2017-18360)

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19.(CVE-2018-18281)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - A security flaw was found in the Linux kernel in a way     that the cleancache subsystem clears an inode after the     final file truncation (removal). The new file created     with the same inode may contain leftover pages from     cleancache and the old file data instead of the new     one.(CVE-2018-16862)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out.(CVE-2018-18559)

  - A new software page cache side channel attack scenario     was discovered in operating systems that implement the     very common 'page cache' caching mechanism. A malicious     user/process could use 'in memory' page-cache knowledge     to infer access timings to shared memory and gain     knowledge which can be used to reduce effectiveness of     cryptographic strength by monitoring algorithmic     behavior, infer access patterns of memory to determine     code paths taken, and exfiltrate data to a blinded     attacker through page-granularity access times as a     side-channel.(CVE-2019-5489)

  - A flaw was found in mmap in the Linux kernel allowing     the process to map a null page. This allows attackers     to abuse this mechanism to turn null pointer     dereferences into workable exploits.(CVE-2019-9213)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - An issue was discovered in the Linux kernel through     4.19. An information leak in cdrom_ioctl_select_disc in     drivers/cdrom/cdrom.c could be used by local attackers     to read kernel memory because a cast from unsigned long     to int interferes with bounds checking.(CVE-2018-18710)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A new software page cache side channel attack scenario     was discovered in operating systems that implement the     very common 'page cache' caching mechanism. A malicious     user/process could use 'in memory' page-cache knowledge     to infer access timings to shared memory and gain     knowledge which can be used to reduce effectiveness of     cryptographic strength by monitoring algorithmic     behavior, infer access patterns of memory to determine     code paths taken, and exfiltrate data to a blinded     attacker through page-granularity access times as a     side-channel.(CVE-2019-5489)

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972)

  - A security flaw was found in the Linux kernel in a way     that the cleancache subsystem clears an inode after the     final file truncation (removal). The new file created     with the same inode may contain leftover pages from     cleancache and the old file data instead of the new     one.(CVE-2018-16862)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out.(CVE-2018-18559)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in     jbd2_journal_dirty_metadata(), a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10883)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service.i1/4^CVE-2017-18360i1/4%0

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.i1/4^CVE-2018-19824i1/4%0

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.i1/4^CVE-2018-18281i1/4%0

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out.i1/4^CVE-2018-18559i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.i1/4^CVE-2018-19824i1/4%0

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.i1/4^CVE-2016-10741i1/4%0

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service.i1/4^CVE-2017-18360i1/4%0

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.i1/4^CVE-2018-18281i1/4%0

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out.i1/4^CVE-2018-18559i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A flaw was discovered in the Linux kernel's USB     subsystem in the __usb_get_extra_descriptor() function     in the drivers/usb/core/usb.c which mishandles a size     check during the reading of an extra descriptor data.
    By using a specially crafted USB device which sends a     forged extra descriptor, an unprivileged user with     physical access to the system can potentially cause a     privilege escalation or trigger a system crash or lock     up and thus to cause a denial of service     (DoS).(CVE-2018-20169)

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in     jbd2_journal_dirty_metadata(), a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10883)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation.(CVE-2018-10902)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - NFS: commit direct writes even if they fail partially     (J. Bruce Fields) [Orabug: 28212440]

  - rds: update correct congestion map for loopback     transport (Mukesh Kacker) [Orabug: 29175685]

  - ext4: only look at the bg_flags field if it is valid     (Theodore Ts'o) [Orabug: 29316684] (CVE-2018-10876)     (CVE-2018-10876)

  - uek-rpm: Add kernel-uek version to kernel-ueknano     provides (Somasundaram Krishnasamy) [Orabug: 29357643]

  - net: Set sk_prot_creator when cloning sockets to the     right proto (Christoph Paasch) [Orabug: 29422739]     (CVE-2018-9568)

  - ext4: always check block group bounds in     ext4_init_block_bitmap (Theodore Ts'o) [Orabug:
    29428607] (CVE-2018-10878)

  - ext4: make sure bitmaps and the inode table don't     overlap with bg descriptors (Theodore Ts'o) [Orabug:
    29428607] (CVE-2018-10878)

  - vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on     s_flags (David Howells) [Orabug: 29428607]     (CVE-2018-10878)

  - iscsi: Capture iscsi debug messages using tracepoints     (Fred Herard) [Orabug: 29429855]

  - KEYS: add missing permission check for request_key     destination (Eric Biggers) [Orabug: 29304551]     (CVE-2017-17807)

  - KEYS: Don't permit request_key to construct a new     keyring (David Howells) [Orabug: 29304551]     (CVE-2017-17807)

  - mlx4_ib: Distribute completion vectors when zero is     supplied (H&aring kon Bugge) [Orabug: 29318191]

  - bnxt_en: Fix TX timeout during netpoll. (Michael Chan)     [Orabug: 29357977]

  - bnxt_en: Fix for system hang if request_irq fails (Vikas     Gupta) [Orabug: 29357977]

  - bnxt_en: Fix firmware message delay loop regression.
    (Michael Chan) [Orabug: 29357977]

  - bnxt_en: reduce timeout on initial HWRM calls (Andy     Gospodarek) [Orabug: 29357977]

  - bnxt_en: Fix NULL pointer dereference at bnxt_free_irq.
    (Michael Chan) [Orabug: 29357977]

  - bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa.
    (Michael Chan) [Orabug: 29357977]

  - bnxt_en: Do not modify max IRQ count after RDMA driver     requests/frees IRQs. (Michael Chan) [Orabug: 29357977]

  - mm: cleancache: fix corruption on missed inode     invalidation (Pavel Tikhomirov) [Orabug: 29364670]     (CVE-2018-16862)

  - l2tp: fix reading optional fields of L2TPv3 (Jacob Wen)     [Orabug: 29368048]

  - net/packet: fix a race in packet_bind and     packet_notifier (Eric Dumazet) [Orabug: 29385593]     (CVE-2018-18559)

  - ext4: verify the depth of extent tree in     ext4_find_extent (Theodore Ts'o) [Orabug: 29396712]     (CVE-2018-10877) (CVE-2018-10877)

  - blk-mq: Do not invoke .queue_rq for a stopped queue     (Bart Van Assche) [Orabug: 28766011]

  - uek-rpm: use multi-threaded xz compression for rpms     (Alexander Burmashev) [Orabug: 29323635]

  - uek-rpm: optimize find-requires usage (Alexander     Burmashev) [Orabug: 29323635]

  - find-debuginfo.sh: backport parallel files procession     (Alexander Burmashev) [Orabug: 29323635]

  - KVM: SVM: Add MSR-based feature support for serializing     LFENCE (Tom Lendacky) [Orabug: 29335274]

  - Enable RANDOMIZE_BASE (John Haxby) [Orabug: 29305587]

  - slub: make ->cpu_partial unsigned (Alexey Dobriyan)     [Orabug: 28620592]

  - dtrace: support kernels built with RANDOMIZE_BASE (Kris     Van Hees) [Orabug: 29204005]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4575 advisory.

    - ext4: only look at the bg_flags field if it is valid (Theodore Tso)  [Orabug: 29316684]     {CVE-2018-10876} {CVE-2018-10876}
    - net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch)  [Orabug: 29422739]     {CVE-2018-9568}
    - ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Tso)  [Orabug: 29428607]     {CVE-2018-10878}
    - ext4: make sure bitmaps and the inode table dont overlap with bg descriptors (Theodore Tso)  [Orabug:
    29428607]  {CVE-2018-10878}
    - vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells)  [Orabug: 29428607]     {CVE-2018-10878}
    - KEYS: add missing permission check for request_key() destination (Eric Biggers)  [Orabug: 29304551]     {CVE-2017-17807}
    - KEYS: Dont permit request_key() to construct a new keyring (David Howells)  [Orabug: 29304551]     {CVE-2017-17807}
    - mm: cleancache: fix corruption on missed inode invalidation (Pavel Tikhomirov)  [Orabug: 29364670]     {CVE-2018-16862}
    - net/packet: fix a race in packet_bind() and packet_notifier() (Eric Dumazet)  [Orabug: 29385593]     {CVE-2018-18559}
    - ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Tso)  [Orabug: 29396712]     {CVE-2018-10877} {CVE-2018-10877}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A security flaw was found in the ip_frag_reasm()     function in net/ipv4/ip_fragment.c in the Linux kernel     which can cause a later system crash in     ip_do_fragment(). With certain non-default, but     non-rare, configuration of a victim host, an attacker     can trigger this crash remotely, thus leading to a     remote denial of service.(CVE-2018-14641)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - The resv_map_release function in mm/hugetlb.c in the     Linux kernel, through 4.15.7, allows local users to     cause a denial of service (BUG) via a crafted     application that makes mmap system calls and has a     large pgoff argument to the remap_file_pages system     call. (CVE-2018-7740)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when     a L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

  - An information leakage issue was found in the way Linux     kernel's KVM hypervisor handled page fault exceptions     while emulating instructions like VMXON, VMCLEAR,     VMPTRLD, and VMWRITE with memory address as an operand.
    It occurs if the operand is a mmio address, as the     returned exception object holds uninitialized stack     memory contents. A guest user/process could use this     flaw to leak host's stack memory contents to a guest.
    (CVE-2019-7222)

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of service.
    (CVE-2018-10322)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the     ext4/mballoc.c:ext4_process_freed_data() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a kernel panic.(CVE-2018-1092)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

  - An issue was discovered in the XFS filesystem in     fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A     NULL pointer dereference may occur for a corrupted xfs     image after xfs_da_shrink_inode() is called with a NULL     bp. This can lead to a system crash and a denial of     service. (CVE-2018-13094)

  - A flaw was found in the Linux kernel with files on     tmpfs and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a     use-after-free issue. A user/process could use this     flaw to crash the guest VM resulting in a denial of     service issue or, potentially, gain privileged access     to a system. (CVE-2019-6974)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the OVMF / anaconda / anaconda-core / anaconda-dracut / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow flaw was found in     create_elf_tables(). An unprivileged local user with     access to SUID (or otherwise privileged) binary could     use this flaw to escalate their privileges on the     system.

  - It was discovered that a race condition between     packet_do_bind() and packet_notifier() in the     implementation of AF_PACKET could lead to     use-after-free. An unprivileged user on the host or in     a container could exploit this to crash the kernel or,     potentially, to escalate their privileges in the     system.

  - The Linux kernel was found to be vulnerable to a NULL     pointer dereference bug in the __netlink_ns_capable()     function in the net/netlink/af_netlink.c file. A local     attacker could exploit this when a net namespace with a     netnsid is assigned to cause a kernel panic and a     denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

* kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes and enhancements. Space precludes documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3827321

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-0163 advisory.

    - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: uffdio_copy: set the page dirty if VM_WRITE is not set (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: add i_size checks (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [fs] userfaultfd: disable irqs when taking the waitqueue lock (Andrea Arcangeli) [1640518 1640519]     {CVE-2018-18397}
    - [fs] userfaultfd.c: remove redundant pointer uwq (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
    - [fs] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails (Andrea Arcangeli)     [1640518 1640519] {CVE-2018-18397}
    - [fs] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [mm] userfaultfd: prevent non-cooperative events vs mcopy_atomic races (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [fs] userfaultfd: convert to use anon_inode_getfd() (Andrea Arcangeli) [1640518 1640519]     {CVE-2018-18397}
    - [fs] mm, userfaultfd, thp: avoid waiting when PMD under THP migration (Andrea Arcangeli) [1640518     1640519] {CVE-2018-18397}
    - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1643680 1643681]     {CVE-2018-18559}
    - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - kernel: Use-after-free due to race condition in     AF_PACKET implementation (CVE-2018-18559)

  - kernel: userfaultfd bypasses tmpfs file permissions     (CVE-2018-18397)

Bug Fix(es) :

See the descriptions in the related Knowledge Article :

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0188 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * The kernel-rt packages have been upgraded to the 3.10.0-957.5.1 source tree, which provides a number of     bug fixes over the previous version. (BZ#1653822)

    * Under certain circumstances, the following warning message, which indicated a SCHED_DEADLINE bandwidth     tracking mechanism error, occurred:

    WARNING: CPU: 8 PID: 19536 at kernel/sched/deadline.c:64 dequeue_task_dl+0x121/0x140

    This update fixes the sched_setscheduler() core kernel function, and backports multiple upstream patches     to the SCHED_DEADLINE scheduler. As a result, the SCHED_DEADLINE bandwidth tracking mechanism is prevented     from error conditions, and the warning message no longer occurs. (BZ#1655439)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0163 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes and enhancements. Space precludes     documenting all of the bug fixes in this advisory. See the descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3827321

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - It was discovered that a race condition between     packet_do_bind() and packet_notifier() in the     implementation of AF_PACKET could lead to     use-after-free. An unprivileged user on the host or in     a container could exploit this to crash the kernel or,     potentially, to escalate their privileges in the     system.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
208574	CentOS 7 : kernel-alt (RHSA-2020:0174)	Nessus	CentOS Local Security Checks	critical
133162	RHEL 7 : kernel-alt (RHSA-2020:0174)	Nessus	Red Hat Local Security Checks	critical
131980	RHEL 7 : kernel (RHSA-2019:4159)	Nessus	Red Hat Local Security Checks	high
131375	RHEL 7 : kernel (RHSA-2019:3967)	Nessus	Red Hat Local Security Checks	high
129311	F5 Networks BIG-IP : Linux kernel vulnerability (K28241423)	Nessus	F5 Networks Local Security Checks	high
127243	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Vulnerability (NS-SA-2019-0055)	Nessus	NewStart CGSL Local Security Checks	high
127240	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Vulnerability (NS-SA-2019-0053)	Nessus	NewStart CGSL Local Security Checks	high
125192	RHEL 6 : kernel-rt (RHSA-2019:1190)	Nessus	Red Hat Local Security Checks	high
125039	RHEL 7 : kernel (RHSA-2019:1170)	Nessus	Red Hat Local Security Checks	high
124977	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1524)	Nessus	Huawei Local Security Checks	high
124834	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1512)	Nessus	Huawei Local Security Checks	high
124430	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1303)	Nessus	Huawei Local Security Checks	high
123721	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1253)	Nessus	Huawei Local Security Checks	high
123712	EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1244)	Nessus	Huawei Local Security Checks	high
123605	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1131)	Nessus	Huawei Local Security Checks	high
122837	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0009)	Nessus	OracleVM Local Security Checks	high
122803	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4575)	Nessus	Oracle Linux Local Security Checks	high
122699	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1076)	Nessus	Huawei Local Security Checks	high
122611	Virtuozzo 7 : OVMF / anaconda / anaconda-core / anaconda-dracut / etc (VZA-2019-013)	Nessus	Virtuozzo Local Security Checks	high
121547	CentOS 7 : kernel (CESA-2019:0163)	Nessus	CentOS Local Security Checks	high
121496	Oracle Linux 7 : kernel (ELSA-2019-0163)	Nessus	Oracle Linux Local Security Checks	high
121456	Scientific Linux Security Update : kernel on SL7.x x86_64 (20190129)	Nessus	Scientific Linux Local Security Checks	high
121450	RHEL 7 : kernel-rt (RHSA-2019:0188)	Nessus	Red Hat Local Security Checks	high
121449	RHEL 7 : kernel (RHSA-2019:0163)	Nessus	Red Hat Local Security Checks	high
121099	Virtuozzo 7 : readykernel-patch (VZA-2018-077)	Nessus	Virtuozzo Local Security Checks	high

Detections

Analytics

CVE-2018-18559

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high