kvm_pv_send_ipi in arch/x86/kvm/lapic.c in the Linux kernel through 4.19.2 allows local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where the apic map is uninitialized.

An update of the linux package has been released.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel     before 5.0.8. There is a race condition leading to a     use-after-free, related to net namespace     cleanup.(CVE-2019-11815)A flaw was found in the Linux     kernel's handle_rx() function in the vhost_net driver.
    A malicious virtual guest, under specific conditions,     can trigger an out-of-bounds write in a kmalloc-8 slab     on a virtual host which may lead to a kernel memory     corruption and a system panic. Due to the nature of the     flaw, privilege escalation cannot be fully ruled     out.(CVE-2018-16880)A NULL pointer dereference security     flaw was found in the Linux kernel in kvm_pv_send_ipi()     in arch/x86/kvm/lapic.c. This allows local users with     certain privileges to cause a denial of service via a     crafted system call to the KVM     subsystem.(CVE-2018-19406)The function     hso_get_config_data in driverset/usb/hso.c in the Linux     kernel through 4.19.8 reads if_num from the USB device     (as a u8) and uses it to index a small array, resulting     in an object out-of-bounds (OOB) read that potentially     allows arbitrary read in the kernel address     space.(CVE-2018-19985)** RESERVED ** This candidate has     been reserved by an organization or individual that     will use it when announcing a new security problem.
    When the candidate has been publicized, the details for     this candidate will be provided.(CVE-2019-3459)**     RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-3460)A flaw was found in the     Linux kernel in the function hid_debug_events_read() in     the drivers/hid/hid-debug.c file which may enter an     infinite loop with certain parameters passed from a     userspace. A local privileged user ('root') can cause a     system lock up and a denial of     service.(CVE-2019-3819)In the Linux kernel before     4.20.14, expand_downwards in mm/mmap.c lacks a check     for the mmap minimum address, which makes it easier for     attackers to exploit kernel NULL pointer dereferences     on non-SMAP platforms. This is related to a capability     check for the wrong task.(CVE-2019-9213)A flaw was     found in the Linux kernel's vfio interface     implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio     driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it     may cause a system memory exhaustion and thus a denial     of service (DoS). Versions 3.10, 4.14 and 4.18 are     vulnerable.(CVE-2019-3882)An infinite loop issue was     found in the vhost_net kernel module in Linux Kernel up     to and including v5.1-rc6, while handling incoming     packets in handle_rx(). It could occur if one end sends     packets faster than the other end can process them. A     guest user, maybe remote one, could use this flaw to     stall the vhost_net kernel thread, resulting in a DoS     scenario.(CVE-2019-3900)It was found that the net_dma     code in tcp_recvmsg() in the 2.6.32 kernel as shipped     in RHEL6 is thread-unsafe. So an unprivileged     multi-threaded userspace application calling recvmsg()     for the same network socket in parallel executed on     ioatdma-enabled hardware with net_dma enabled can leak     the memory, crash the host leading to a     denial-of-service or cause a random memory     corruption.(CVE-2019-3837)A race condition in     perf_event_open() allows local attackers to leak     sensitive data from setuid programs. As no relevant     locks (in particular the cred_guard_mutex) are held     during the ptrace_may_access() call, it is possible for     the specified target task to perform an execve()     syscall with setuid execution before perf_event_alloc()     actually attaches to it, allowing an attacker to bypass     the ptrace_may_access() check and the     perf_event_exit_task(current) call that is performed in     install_exec_creds() during privileged execve() calls.
    This issue affects kernel versions before 4.8.
    (CVE-2019-3901)** RESERVED ** This candidate has been     reserved by an organization or individual that will use     it when announcing a new security problem. When the     candidate has been publicized, the details for this     candidate will be     provided.(CVE-2019-8956)cipso_v4_validate in     includeet/cipso_ipv4.h in the Linux kernel before     3.11.7, when CONFIG_NETLABEL is disabled, allows     attackers to cause a denial of service (infinite loop     and crash), as demonstrated by icmpsic, a different     vulnerability than CVE-2013-0310.(CVE-2013-7470)Note1:
    kernel-4.19.36-vhulk1907.1.0.h529 and earlier versions     in EulerOS Virtualization for ARM 64 3.0.2.0 return     incorrect time information when executing the uname -a     command.Note2: The kernel version number naming format     has been changed after 4.19.36-1.2.184.aarch64, the new     version format is 4.19.36-vhulk1907.1.0.hxxx.aarch64,     which may lead to false positives of this security     advisory.

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This stable update contains important fixes across the tree including an important fix for a bug that causes filesystem corruption in some cases.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
142656	Photon OS 3.0: Linux PHSA-2020-3.0-0160	Nessus	PhotonOS Local Security Checks	high
125588	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1636)	Nessus	Huawei Local Security Checks	high
120661	Fedora 28 : kernel / kernel-headers / kernel-tools (2018-a0914af224)	Nessus	Fedora Local Security Checks	high
120445	Fedora 29 : kernel / kernel-headers / kernel-tools (2018-5904d0794d)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-19406

medium

Tenable Plugins

high

high

high

high