In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1070 advisory.

  - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the     userspace API. However, the code allows larger values such as 23. (CVE-2015-9289)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num     from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds     (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before     register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and     panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to     CVE-2013-4343. (CVE-2018-7191)

  - A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before     4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware     could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
    (CVE-2019-10207)

  - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel     image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the     attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic     is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a network namespace. (CVE-2019-10639)

  - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because     install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the     ptrace_may_access() check has a race condition when reading /proc/pid/stat. (CVE-2019-11190)

  - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a     local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command,     because a name field may not end with a '\0' character. (CVE-2019-11884)

  - An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL     pointer dereference (CVE-2019-12382)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by     default. (CVE-2019-14283)

  - A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params()     function of Marvell Wifi Driver. (CVE-2019-14815)

  - An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a     malicious USB device in the sound/usb/line6/pcm.c driver. (CVE-2019-15221)

  - An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in     register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. (CVE-2019-15916)

  - An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check     the length of variable elements in a beacon head, leading to a buffer overflow. (CVE-2019-16746)

  - A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs.
    As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it     is possible for the specified target task to perform an execve() syscall with setuid execution before     perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check     and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged     execve() calls. This issue affects kernel versions before 4.8. (CVE-2019-3901)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the linux package has been released.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1016 advisory.

    - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705005]     {CVE-2019-11487}
    - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski)     [1705005] {CVE-2019-11487}
    - [wireless] rtlwifi: Fix potential overflow on P2P code (Josef Oskera) [1775236] {CVE-2019-17666}
    - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1779768]     {CVE-2019-19338}
    - [x86] kvm: x86: Mark expected switch fall-throughs (Paolo Bonzini) [1779768] {CVE-2019-19338}
    - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1779768] {CVE-2019-19338}
    - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1779768] {CVE-2019-19338}
    - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1779768]     {CVE-2019-19338}
    - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1779768] {CVE-2019-19338}
    - [wireless] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Stanislaw Gruszka)     [1776157] {CVE-2019-14901}
    - [x86] x86/speculation: Remove unneeded STIBP code (Waiman Long) [1766540] {CVE-2019-11135}
    - [x86] x86/speculation: Fix redundant MDS mitigation message (Waiman Long) [1766540] {CVE-2019-11135}
    - [documentation] x86/speculation: Fix incorrect MDS/TAA mitigation status (Waiman Long) [1766540]     {CVE-2019-11135}
    - [x86] x86/speculation/taa: Fix printing of TAA_MSG_SMT on IBRS_ALL CPUs (Waiman Long) [1766540]     {CVE-2019-11135}
    - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Waiman Long) [1766540] {CVE-2019-11135}
    - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766540]     {CVE-2019-11135}
    - [x86] x86/tsx: Add 'auto' option to the tsx= cmdline parameter (Waiman Long) [1766540] {CVE-2019-11135}
    - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766540]     {CVE-2019-11135}
    - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766540] {CVE-2019-11135}
    - [x86] x86/cpu: Add a 'tsx=' cmdline option with TSX disabled by default (Waiman Long) [1766540]     {CVE-2019-11135}
    - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766540] {CVE-2019-11135}
    - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766540] {CVE-2019-11135}
    - [documentation] documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] kvm: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] kvm: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] kvm: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] kvm: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [x86] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] kvm: x86: mmu: Remove unused parameter of __direct_map() (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [virt] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [x86] kvm: mmu: drop vcpu param in gpte_access (Paolo Bonzini) [1690343] {CVE-2018-12207}
    - [virt] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1690343]     {CVE-2018-12207}
    - [media] cx24116: fix a buffer overflow when checking userspace params (Jarod Wilson) [1737279]     {CVE-2015-9289}
    - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756816] {CVE-2019-0154}
    - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756816] {CVE-2019-0154}
    - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756883]     {CVE-2019-0155}
    - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756883] {CVE-2019-0155}
    - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756883] {CVE-2019-0155}
    - [net] sysfs: Fix mem leak in netdev_register_kobject (Stefano Brivio) [1752690] {CVE-2019-15916}
    - [kernel] perf/core: Fix perf_event_open() vs. execve() race (Jiri Olsa) [1701620] {CVE-2019-3901}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3517 advisory.

    - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}
    - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}
    - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714476] {CVE-2019-3846}
    - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari)     [1743076] {CVE-2019-9506}
    - [bluetooth] Bluetooth: hci_uart: check for missing tty operations (Gopal Tiwari) [1734239]     {CVE-2019-10207}
    - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [net] sunrpc: make visible processing error in bc_svc_process() ('J. Bruce Fields') [1660823]     {CVE-2018-16884}
    - [net] sunrpc: remove unused xpo_prep_reply_hdr callback ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: remove svc_tcp_bc_class ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ('J. Bruce Fields') [1660823]     {CVE-2018-16884}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3517 advisory.

  - kernel: Linux stack ASLR implementation Integer overflow (CVE-2015-1593)

  - kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

  - kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c (CVE-2018-19854)

  - kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

  - kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

  - kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c     (CVE-2019-10126)

  - kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

  - Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

  - kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

  - kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

  - kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command (CVE-2019-11884)

  - kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)

  - kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

  - kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via     sigreturn() system call (CVE-2019-13648)

  - Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

  - kernel: out-of-bounds array access in __xfrm_policy_unlink (CVE-2019-15666)

  - kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

  - kernel: memory leak in genl_register_family() in net/netlink/genetlink.c (CVE-2019-15921)

  - kernel: null pointer dereference in drivers/net/ethernet/intel/fm10k/fm10k_main.c (CVE-2019-15924)

  - kernel: Memory leak in sit_init_net() in net/ipv6/sit.c (CVE-2019-16994)

  - kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

  - kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

  - kernel: SCTP socket buffer memory leak leading to denial of service (CVE-2019-3874)

  - kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

  - Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

  - Kernel: page cache side channel attacks (CVE-2019-5489)

  - Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

  - hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

  - kernel: use-after-free read in napi_gro_frags() in the Linux kernel (CVE-2020-10720)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the     userspace API. However, the code allows larger values such as 23. (CVE-2015-9289)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before     register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and     panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to     CVE-2013-4343. (CVE-2018-7191)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - ** DISPUTED ** An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the     Linux kernel through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as     not being a vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance     for a NULL pointer dereference. (CVE-2019-12382)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by     default. (CVE-2019-14283)

  - There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip     driver in Linux kernel, that allows local users to cause a denial of service(system crash) or possibly     execute arbitrary code. (CVE-2019-14816)

  - A heap-based buffer overflow was discovered in the Linux kernel, all versions 3.x.x and 4.x.x before     4.18.0, in Marvell WiFi chip driver. The flaw could occur when the station attempts a connection     negotiation during the handling of the remote devices country settings. This could allow the remote device     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-14895)

  - The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could     use this flaw to obtain sensitive information, cause a denial of service, or possibly have other     unspecified impacts by triggering a race condition with mmget_not_zero or get_task_mm calls.
    (CVE-2019-14898)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in     register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. (CVE-2019-15916)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where,     the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error     occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by     the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
    (CVE-2019-19338)

  - A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs.
    As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it     is possible for the specified target task to perform an execve() syscall with setuid execution before     perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check     and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged     execve() calls. This issue affects kernel versions before 4.8. (CVE-2019-3901)

  - In the Android kernel in Pixel C USB monitor driver there is a possible OOB write due to a missing bounds     check. This could lead to local escalation of privilege with System execution privileges needed. User     interaction is not needed for exploitation. (CVE-2019-9456)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2851 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

    * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

    * Kernel: vfio: access to disabled MMIO space of some devices may lead to DoS scenario (CVE-2020-12888)

    * kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: perf_event_open() and execve() race in setuid programs allows a data leak (CVE-2019-3901)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: powerpc: incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel: hw: provide reporting and microcode mitigation toggle for CVE-2020-0543 / Special Register     Buffer Data Sampling (SRBDS) (BZ#1840677)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2522 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c     (CVE-2017-18595)

    * kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

    * Kernel: NetLabel: null pointer dereference while receiving CIPSO packet with null category may cause     kernel panic (CVE-2020-10711)

    * kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: perf_event_open() and execve() race in setuid programs allows a data leak (CVE-2019-3901)

    * kernel: brcmfmac frame validation bypass (CVE-2019-9503)

    * kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: integer overflow and OOB read in drivers/block/floppy.c (CVE-2019-14283)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Backport: Guest microcode version mismatch on secondary processors (BZ#1814002)

    * Realtek 8111, 8112 stop working after upgrading to 3.10.0-1062 (BZ#1814601)

    * [mlx5] Crash on reboot while having VF configured and in switchdev mode (BZ#1814800)

    * qla2xxx: Urgent driver fix needed. Initiator does not relogin to target after receiving an explicit     logout (BZ#1815595)

    * High iSCSI read latency resolved by 'tcp: implement coalescing on backlog queue' (BZ#1817498)

    * [RHEL7.8][Azure]Commits to resolve high network latency (BZ#1817934)

    * NETDEV WATCHDOG: enp3s0 (r8169): transmit queue 0 timed out (BZ#1822541)

    * RHEL7: block mq hang of a blk_mq_freeze_queue_wait(),  which waits for a zero of a q_usage_counter,     which never happens (BZ#1824545)

    * Kernel crashes with a message fs/fscache/operation.c:449! (BZ#1826293)

    * kernel BUG at fs/fscache/operation.c:70! FS-Cache: 4 == 5 is false - current state is     FSCACHE_OP_ST_COMPLETE but should be FSCACHE_OP_CANCELLED in fscache_enqueue_operation (BZ#1839756)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

* kernel: out of bound read in DVB connexant driver. * kernel: Missing permissions check for request_key() destination allows local attackers to add keys to keyring without Write permission * kernel: denial of service via ioctl call in network tun handling * kernel: usb: missing size check in the __usb_get_extra_descriptor() * kernel:
perf_event_open() and execve() race in setuid programs allows a data leak * kernel: brcmfmac frame validation bypass * kernel: NULL pointer dereference in hci_uart_set_flow_control * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command * kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service * kernel: use-after-free in arch/x86/lib/insn-eval.c * kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via sigreturn() system call * kernel: integer overflow and OOB read in drivers/block/floppy.c * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service * kernel: buffer-overflow hardening in WiFi beacon validation code. * kernel: (powerpc) incomplete Spectre-RSB mitigation leads to information exposure * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c * Kernel: net: weak IP ID generation leads to remote device tracking * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR * kernel: ASLR bypass for setuid binaries due to late install_exec_creds()

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1016 advisory.

  - In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size for a DiSEqC command is 6, according to the     userspace API. However, the code allows larger values such as 23. (CVE-2015-9289)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num     from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds     (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before     register_netdevice. This allows local users to cause a denial of service (NULL pointer dereference and     panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. This is similar to     CVE-2013-4343. (CVE-2018-7191)

  - A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before     4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware     could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
    (CVE-2019-10207)

  - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel     image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the     attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic     is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a network namespace. (CVE-2019-10639)

  - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because     install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the     ptrace_may_access() check has a race condition when reading /proc/pid/stat. (CVE-2019-11190)

  - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a     local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command,     because a name field may not end with a '\0' character. (CVE-2019-11884)

  - An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash). NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is handled sufficiently and there is no chance for a NULL     pointer dereference (CVE-2019-12382)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel through 5.2.1 on the powerpc platform, when hardware transactional memory is disabled,     a local user can cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn()     system call that sends a crafted signal frame. This affects arch/powerpc/kernel/signal_32.c and     arch/powerpc/kernel/signal_64.c. (CVE-2019-13648)

  - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by     default. (CVE-2019-14283)

  - There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell     wifi chip driver in Linux kernel, that allows local users to cause a denial of service(system crash) or     possibly execute arbitrary code. (CVE-2019-14814)

  - A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params()     function of Marvell Wifi Driver. (CVE-2019-14815)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the     qedi_dbg_* family of functions, there is an out-of-bounds read. (CVE-2019-15090)

  - An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound     subsystem because card disconnection causes certain data structures to be deleted too early. This is     related to sound/core/init.c and sound/core/info.c. (CVE-2019-15214)

  - An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a     malicious USB device in the sound/usb/line6/pcm.c driver. (CVE-2019-15221)

  - An issue was discovered in the Linux kernel before 5.0.1. There is a memory leak in     register_queue_kobjects() in net/core/net-sysfs.c, which will cause denial of service. (CVE-2019-15916)

  - An issue was discovered in net/wireless/nl80211.c in the Linux kernel through 5.2.17. It does not check     the length of variable elements in a beacon head, leading to a buffer overflow. (CVE-2019-16746)

  - The Linux kernel before 5.4.1 on powerpc allows Information Exposure because the Spectre-RSB mitigation is     not in place for all applicable CPUs, aka CID-39e72bf96f58. This is related to     arch/powerpc/kernel/entry_64.S and arch/powerpc/kernel/security.c. (CVE-2019-18660)

  - A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs.
    As no relevant locks (in particular the cred_guard_mutex) are held during the ptrace_may_access() call, it     is possible for the specified target task to perform an execve() syscall with setuid execution before     perf_event_alloc() actually attaches to it, allowing an attacker to bypass the ptrace_may_access() check     and the perf_event_exit_task(current) call that is performed in install_exec_creds() during privileged     execve() calls. This issue affects kernel versions before 4.8. (CVE-2019-3901)

  - An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An     attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations     before the required authentication process has completed. This could lead to different denial-of-service     scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already     existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge     Authentication and Association Request packets to trigger this vulnerability. (CVE-2019-5108)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1016 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: out of bound read in DVB connexant driver. (CVE-2015-9289)

    * kernel: Missing permissions check for request_key() destination allows local attackers to add keys to     keyring without Write permission (CVE-2017-17807)

    * kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: perf_event_open() and execve() race in setuid programs allows a data leak (CVE-2019-3901)

    * kernel: brcmfmac frame validation bypass (CVE-2019-9503)

    * kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

    * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command     (CVE-2019-11884)

    * kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: denial of service in arch/powerpc/kernel/signal_32.c and arch/powerpc/kernel/signal_64.c via     sigreturn() system call (CVE-2019-13648)

    * kernel: integer overflow and OOB read in drivers/block/floppy.c (CVE-2019-14283)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

    * kernel: (powerpc) incomplete Spectre-RSB mitigation leads to information exposure (CVE-2019-18660)

    * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

    * Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: ASLR bypass for setuid binaries due to late install_exec_creds() (CVE-2019-11190)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1070 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: out of bound read in DVB connexant driver. (CVE-2015-9289)

    * kernel: Missing permissions check for request_key() destination allows local attackers to add keys to     keyring without Write permission (CVE-2017-17807)

    * kernel: denial of service via ioctl call in network tun handling (CVE-2018-7191)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: perf_event_open() and execve() race in setuid programs allows a data leak (CVE-2019-3901)

    * kernel: brcmfmac frame validation bypass (CVE-2019-9503)

    * kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

    * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command     (CVE-2019-11884)

    * kernel: unchecked kstrdup of fwstr in drm_load_edid_firmware leads to denial of service (CVE-2019-12382)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: integer overflow and OOB read in drivers/block/floppy.c (CVE-2019-14283)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: buffer-overflow hardening in WiFi beacon validation code. (CVE-2019-16746)

    * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

    * Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

    * Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR     (CVE-2019-10639)

    * kernel: ASLR bypass for setuid binaries due to late install_exec_creds() (CVE-2019-11190)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):Heap-based buffer overflow     in the udf_load_logicalvol function in fs/udf/super.c     in the Linux kernel before 3.4.5 allows remote     attackers to cause a denial of service (system crash)     or possibly have unspecified other impact via a crafted     UDF filesystem.(CVE-2012-3400)The     mmc_ioctl_cdrom_read_data function in     drivers/cdrom/cdrom.c in the Linux kernel through 3.10     allows local users to obtain sensitive information from     kernel memory via a read operation on a malfunctioning     CD-ROM drive.(CVE-2013-2164)The     sctp_sf_do_5_2_4_dupcook function in     net/sctp/sm_statefuns.c in the SCTP implementation in     the Linux kernel before 3.8.5 does not properly handle     associations during the processing of a duplicate     COOKIE ECHO chunk, which allows remote attackers to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via crafted SCTP traffic.(CVE-2013-2206)The (1)     get_user and (2) put_user API functions in the Linux     kernel before 3.5.5 on the v6k and v7 ARM platforms do     not validate certain addresses, which allows attackers     to read or modify the contents of arbitrary kernel     memory locations via a crafted application, as     exploited in the wild against Android devices in     October and November 2013.(CVE-2013-6282)An issue was     discovered in the Linux kernel before 4.20. There is a     race condition in smp_task_timedout() and     smp_task_done() in drivers/scsi/libsas/sas_expander.c,     leading to a use-after-free.(CVE-2018-20836)The Siemens     R3964 line discipline driver in drivers/tty/n_r3964.c     in the Linux kernel before 5.0.8 has multiple race     conditions.(CVE-2019-11486)The Linux kernel before     5.1-rc5 allows page->_refcount reference count     overflow, with resultant use-after-free issues, if     about 140 GiB of RAM exists. This is related to     fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It     can occur with FUSE requests.(CVE-2019-11487)The     coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly     have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls.
    This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c.(CVE-2019-11599)A     n issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes     a Denial of Service, related to a     use-after-free.(CVE-2019-11810)An issue was discovered     in the Linux kernel before 5.0.4. There is a     use-after-free upon attempted read access to     /proc/ioports after the ipmi_si module is removed,     related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c.(CVE-2019-11811)A     flaw was found in the Linux kernel's handle_rx()     function in the [vhost_net] driver. A malicious virtual     guest, under specific conditions, can trigger an     out-of-bounds write in a kmalloc-8 slab on a virtual     host which may lead to a kernel memory corruption and a     system panic. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out. Versions from     v4.16 and newer are vulnerable.(CVE-2018-16880)An issue     was discovered in rds_tcp_kill_sock in net/rds/tcp.c in     the Linux kernel before 5.0.8. There is a race     condition leading to a use-after-free, related to net     namespace cleanup.(CVE-2019-11815)A flaw was found in     the Linux kernel in the function     hid_debug_events_read() in drivers/hid/hid-debug.c file     which may enter an infinite loop with certain     parameters passed from a userspace. A local privileged     user ('root') can cause a system lock up and a denial     of service. Versions from v4.18 and newer are     vulnerable.(CVE-2019-3819)A flaw was found in the Linux     kernel's vfio interface implementation that permits     violation of the user's locked memory limit. If a     device is bound to a vfio driver, such as vfio-pci, and     the local attacker is administratively granted     ownership of the device, it may cause a system memory     exhaustion and thus a denial of service (DoS). Versions     3.10, 4.14 and 4.18 are vulnerable.(CVE-2019-3882)An     infinite loop issue was found in the vhost_net kernel     module in Linux Kernel up to and including v5.1-rc6,     while handling incoming packets in handle_rx(). It     could occur if one end sends packets faster than the     other end can process them. A guest user, maybe remote     one, could use this flaw to stall the vhost_net kernel     thread, resulting in a DoS scenario.(CVE-2019-3900)In     the Linux Kernel before versions 4.20.8 and 4.19.21 a     use-after-free error in the 'sctp_sendmsg()' function     (net/sctp/socket.c) when handling SCTP_SENDALL flag can     be exploited to corrupt memory.(CVE-2019-8956)A flaw     was found in the Linux kernel's implementation of ext4     extent management. The kernel doesn't correctly     initialize memory regions in the extent tree block     which may be exported to a local user to obtain     sensitive information by reading empty/uninitialized     data from the filesystem.(CVE-2019-11833)An issue was     discovered in drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr,     which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash).
    NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is     handled sufficiently and there is no chance for a NULL     pointer dereference.(CVE-2019-12382)An issue was     discovered in the efi subsystem in the Linux kernel     through 5.1.5. phys_efi_set_virtual_address_map in     arch/x86/platform/efi/efi.c and efi_call_phys_prolog in     arch/x86/platform/efi/efi_64.c mishandle memory     allocation failures. NOTE: This id is disputed as not     being an issue because ?All the code touched by the     referenced commit runs only at boot, before any user     processes are started. Therefore, there is no     possibility for an unprivileged user to control     it.(CVE-2019-12380)An issue was discovered in the Linux     kernel before 5.2.3. An out of bounds access exists in     the function hclge_tm_schd_mode_vnet_base_cfg in the     file drivers     et/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c.(CVE-2019-     15925)An issue was discovered in     dlpar_parse_cc_property in     arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of     prop-i1/4zname, which might allow an attacker to cause a     denial of service (NULL pointer dereference and system     crash).(CVE-2019-12614)An issue was discovered in     net/ipv4/sysctl_net_ipv4.c in the Linux kernel before     5.0.11. There is a net/ipv4/tcp_input.c signed integer     overflow in tcp_ack_update_rtt() when userspace writes     a very large integer to     /proc/syset/ipv4/tcp_min_rtt_wlen, leading to a denial     of service or possibly unspecified other impact, aka     CID-19fad20d15a6.(CVE-2019-18805)A flaw was found in     the way PTRACE_TRACEME functionality was handled in the     Linux kernel. The kernel's implementation of ptrace can     inadvertently grant elevated permissions to an attacker     who can then abuse the relationship between the tracer     and the process being traced. This flaw could allow a     local, unprivileged user to increase their privileges     on the system or cause a denial of     service.(CVE-2019-13272)An issue was discovered in     ip6_ra_control in net/ipv6/ipv6_sockglue.c in the Linux     kernel through 5.1.5. There is an unchecked kmalloc of     new_ra, which might allow an attacker to cause a denial     of service (NULL pointer dereference and system crash).
    NOTE: This has been disputed as not an     issue.(CVE-2019-12378)An issue was discovered in     ip_ra_control in net/ipv4/ip_sockglue.c in the Linux     kernel through 5.1.5. There is an unchecked kmalloc of     new_ra, which might allow an attacker to cause a denial     of service (NULL pointer dereference and system crash).
    NOTE: this is disputed because new_ra is never used if     it is NULL.(CVE-2019-12381)An issue was discovered in     sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c     in the Linux kernel through 5.1.5. There is an     unchecked kstrndup of derived_name, which might allow     an attacker to cause a denial of service (NULL pointer     dereference and system crash). NOTE: This id is     disputed as not being an issue because 'The memory     allocation that was not checked is part of a code that     only runs at boot time, before user processes are     started. Therefore, there is no possibility for an     unprivileged user to control it, and no denial of     service.'.(CVE-2019-12455)An issue was discovered in     the MPT3COMMAND case in _ctl_ioctl_main in     drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel     through 5.1.5. It allows local users to cause a denial     of service or possibly have unspecified other impact by     changing the value of ioc_number between two kernel     reads of that value, aka a ''double fetch''     vulnerability. NOTE: a third party reports that this is     unexploitable because the doubly fetched value is not     used.(CVE-2019-12456)An issue was discovered in     get_vdev_port_node_info in arch/sparc/kernel/mdesc.c in     the Linux kernel through 5.1.6. There is an unchecked     kstrdup_const of node_info-i1/4zvdev_port.name, which     might allow an attacker to cause a denial of service     (NULL pointer dereference and system     crash).(CVE-2019-12615)In parse_hid_report_descriptor     in drivers/input/tablet/gtco.c in the Linux kernel     through 5.2.1, a malicious USB device can send an HID     report that triggers an out-of-bounds write during     generation of debugging messages.(CVE-2019-13631)A     vulnerability was found in the Linux kernelaEURtms floppy     disk driver implementation. A local attacker with     access to the floppy device could call set_geometry in     drivers/block/floppy.c, which does not validate the     sect and head fields, causing an integer overflow and     out-of-bounds read. This flaw may crash the system or     allow an attacker to gather information causing     subsequent successful     attacks.(CVE-2019-14283)check_input_term in     sound/usb/mixer.c in the Linux kernel through 5.2.9     mishandles recursion, leading to kernel stack     exhaustion.(CVE-2019-15118)An issue was discovered in     the Linux kernel before 5.2.6. There is a     use-after-free caused by a malicious USB device in the     drivers/media/v4l2-core/v4l2-dev.c driver because     drivers/media/radio/radio-raremono.c does not properly     allocate memory.(CVE-2019-15211)An issue was discovered     in the Linux kernel before 5.0.10. There is a     use-after-free in the sound subsystem because card     disconnection causes certain data structures to be     deleted too early. This is related to sound/core/init.c     and sound/core/info.c.(CVE-2019-15214)An issue was     discovered in the Linux kernel before 5.1.8. There is a     NULL pointer dereference caused by a malicious USB     device in the drivers/media/usb/siano/smsusb.c     driver.(CVE-2019-15218)An issue was discovered in the     Linux kernel before 5.1.8. There is a NULL pointer     dereference caused by a malicious USB device in the     drivers/usb/misc/sisusbvga/sisusb.c     driver.(CVE-2019-15219)An issue was discovered in the     Linux kernel before 5.2.1. There is a use-after-free     caused by a malicious USB device in the     driverset/wireless/intersil/p54/p54usb.c     driver.(CVE-2019-15220)An issue was discovered in the     Linux kernel before 5.1.17. There is a NULL pointer     dereference caused by a malicious USB device in the     sound/usb/line6/pcm.c driver.(CVE-2019-15221)An issue     was discovered in the Linux kernel before 5.0.9. There     is a use-after-free in atalk_proc_exit, related to     net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and     net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)An     issue was discovered in xfs_setattr_nonsize in     fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9.
    XFS partially wedges when a chgrp fails on account of     being out of disk quota. xfs_setattr_nonsize is failing     to unlock the ILOCK after the xfs_qm_vop_chown_reserve     call fails. This is primarily a local DoS attack     vector, but it might result as well in remote DoS if     the XFS filesystem is exported for instance via     NFS.(CVE-2019-15538)An issue was discovered in the     Linux kernel before 5.0.19. There is an out-of-bounds     array access in __xfrm_policy_unlink, which will cause     denial of service, because verify_newpolicy_info in     net/xfrm/xfrm_user.c mishandles directory     validation.(CVE-2019-15666)In the Linux kernel before     5.1.13, there is a memory leak in     drivers/scsi/libsas/sas_expander.c when SAS expander     discovery fails. This will cause a BUG and denial of     service.(CVE-2019-15807)An issue was discovered in the     Linux kernel before 5.0.5. There is a use-after-free     issue when hci_uart_register_dev() fails in     hci_uart_set_proto() in     drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)An issue     was discovered in the Linux kernel before 5.0.10.
    SMB2_write in fs/cifs/smb2pdu.c has a     use-after-free.(CVE-2019-15919)An issue was discovered     in the Linux kernel before 5.0.10. SMB2_read in     fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was     not fixed correctly in 5.0.10 see the 5.0.11 ChangeLog,     which documents a memory leak.(CVE-2019-15920)An issue     was discovered in the Linux kernel before 5.0.4. The 9p     filesystem did not protect i_size_write() properly,     which causes an i_size_read() infinite loop and denial     of service on SMP systems.(CVE-2019-16413)An issue was     discovered in can_can_gw_rcv in net/can/gw.c in the     Linux kernel through 4.19.13. The CAN frame     modification rules allow bitwise logical operations     that can be also applied to the can_dlc field. Because     of a missing check, the CAN drivers may write arbitrary     content beyond the data registers in the CAN     controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701)A flaw was found in the Linux     kernel's Marvell wifi chip driver. A heap overflow in     mwifiex_update_bss_desc_with_ie function in     marvell/mwifiex/scan.c allows remote attackers to cause     a denial of service(system crash) or execute arbitrary     code.(CVE-2019-3846)A new software page cache side     channel attack scenario was discovered in operating     systems that implement the very common 'page cache'     caching mechanism. A malicious user/process could use     'in memory' page-cache knowledge to infer access     timings to shared memory and gain knowledge which can     be used to reduce effectiveness of cryptographic     strength by monitoring algorithmic behavior, infer     access patterns of memory to determine code paths     taken, and exfiltrate data to a blinded attacker     through page-granularity access times as a     side-channel.(CVE-2019-5489)In the Android kernel in     the video driver there is a kernel pointer leak due to     a WARN_ON statement. This could lead to local     information disclosure with System execution privileges     needed. User interaction is not needed for     exploitation.(CVE-2019-9455)A vulnerability was found     in the arch/x86/lib/insn-eval.c function in the Linux     kernel. An attacker could corrupt the memory due to a     flaw in use-after-free access to an LDT entry caused by     a race condition between modify_ldt() and a #BR     exception for an MPX bounds violation.(CVE-2019-13233)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3517 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

    * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in     drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)

    * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

    * kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c (CVE-2018-19854)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: SCTP socket buffer memory leak leading to denial of service (CVE-2019-3874)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command     (CVE-2019-11884)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: Linux stack ASLR implementation Integer overflow (CVE-2015-1593)

    * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    * Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3309 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: nfs: use-after-free in svc_process_common() (CVE-2018-16884)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * hardware: bluetooth: BR/EDR encryption key negotiation attacks (KNOB) (CVE-2019-9506)

    * kernel: Heap overflow in mwifiex_uap_parse_tail_ies function in     drivers/net/wireless/marvell/mwifiex/ie.c (CVE-2019-10126)

    * Kernel: KVM: OOB memory access via mmio ring buffer (CVE-2019-14821)

    * kernel: Information Disclosure in crypto_report_one in crypto/crypto_user.c (CVE-2018-19854)

    * kernel: usb: missing size check in the __usb_get_extra_descriptor() leading to DoS (CVE-2018-20169)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: SCTP socket buffer memory leak leading to denial of service (CVE-2019-3874)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: null-pointer dereference in hci_uart_set_flow_control (CVE-2019-10207)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: sensitive information disclosure from kernel stack memory via HIDPCONNADD command     (CVE-2019-11884)

    * kernel: use-after-free in arch/x86/lib/insn-eval.c (CVE-2019-13233)

    * kernel: memory leak in register_queue_kobjects() in net/core/net-sysfs.c leads to denial of service     (CVE-2019-15916)

    * kernel: oob memory read in hso_probe in drivers/net/usb/hso.c (CVE-2018-19985)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    * Kernel: net: weak IP ID generation leads to remote device tracking (CVE-2019-10638)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1103186)CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1111331)CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)

CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699).

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)

CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)

CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests.
(bsc#1133190)

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)

CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)

CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)

CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)

CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848)

CVE-2019-9500: An issue was discovered that lead to brcmfmac heap buffer overflow. (bsc#1132681)

CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access.
(bsc#1135278)

CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bsc#1135278)

CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may have lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bsc#1122767)

CVE-2019-12819: The function __mdiobus_register() called put_device(), which triggered a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bsc#1138291)

CVE-2019-3882: A flaw was found in the Linux kernel's vfio interface implementation that permitted violation of the user's locked memory limit. If a device was bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may have caused a system memory exhaustion and thus a denial of service (DoS). (bsc#1131427)

CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bsc#1136424)

CVE-2019-8564: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132673)

CVE-2019-9503: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132828)

CVE-2019-9003: In the Linux kernel, attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop. (bsc#1126704)

CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data.
Further, it would consume additional resources such as CPU and NIC processing power.

CVE-2018-16871: A NULL pointer dereference due to an anomalized NFS message sequence was fixed. (bnc#1137103).

CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c. There was an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).

CVE-2019-12817: On the PowerPC architecture, local attackers could access other users processes memory (bnc#1138263).

CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).

CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses (bnc#1140575 1140577).

CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image was exposed. This attack could be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable because IP ID generation was changed to have a dependency on an address associated with a network namespace (bnc#1140577).

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c (bnc#1131645 1133738).

CVE-2019-13233: In arch/x86/lib/insn-eval.c in the Linux kernel, there was a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation (bnc#1140454).

CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).

CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).

CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).

CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame.
(bnc#1142254)

CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default.
(bnc#1143191)

CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero.
(bnc#1143189)

CVE-2019-12456: An issue was discovered in the MPT3COMMAND case in
_ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a 'double fetch' vulnerability.
NOTE: a third-party reports that this is unexploitable because the doubly fetched value is not used. (bsc#1136922)

CVE-2019-12380: An issue was discovered in the efi subsystem in the Linux kernel phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures.
(bsc#1136598)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4118-1 advisory.

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode     validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause     a denial of service (system crash). (CVE-2018-13093)

    Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098, CVE-2018-13099,     CVE-2018-13100, CVE-2018-14614, CVE-2018-14615, CVE-2018-14616)

    Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not     properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when     mounted, could cause a denial of service (system crash). (CVE-2018-14609, CVE-2018-14610, CVE-2018-14611,     CVE-2018-14612, CVE-2018-14613)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not     properly initialize new files in some situations. A local attacker could use this to expose sensitive     information. (CVE-2018-16862)

    Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not     properly validate metadata received from the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2018-19985)

    Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle     size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause     a denial of service (system crash). (CVE-2018-20169)

    Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kernel process scheduler.
    A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)

    It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel     when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

    Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not     properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An     attacker could use this to expose sensitive information. (CVE-2018-5383)

    It was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain     Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of     service (Wi-Fi disconnect). (CVE-2019-0136)

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    It was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for     missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)

    Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values     generated for connectionless networking protocols. A remote attacker could use this to track particular     Linux devices. (CVE-2019-10638)

    Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the     implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly     use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)

    Adam Zabrocki discovered that the Intel i915 kernel mode graphics driver in the Linux kernel did not     properly restrict mmap() ranges in some situations. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-11085)

    It was discovered that an integer overflow existed in the Linux kernel when reference counting pages,     leading to potential use-after-free issues. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-11487)

    Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local     attacker could use this to cause a denial of service (system crash) or expose sensitive information.
    (CVE-2019-11599)

    It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-11810)

    It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram     Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is disabled via blocklist by     default in Ubuntu.

    If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-11815)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-11833)

    It was discovered that the Bluetooth Human Interface Device Protocol (HIDP) implementation in the Linux     kernel did not properly verify strings were NULL terminated in certain situations. A local attacker could     use this to expose sensitive information (kernel memory). (CVE-2019-11884)

    It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication     (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system     crash). (CVE-2019-12818)

    It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device     reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-12819)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the     initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)

    It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading     to a buffer overread. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-14283)

    It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls,     leading to a division-by-zero. A local attacker could use this to cause a denial of service (system     crash). (CVE-2019-14284)

    Tuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in     the Linux kernel. A physically proximate attacker could use this to cause a denial of service.
    (CVE-2019-14763)

    It was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the     Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2019-15090)

    It was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly     allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2019-15211)

    It was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)

    It was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem     of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)

    It was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux     kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)

    It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15220)

    It was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux     kernel if an error occurs during initialization. A local attacker could use this to cause a denial of     service (system crash). (CVE-2019-15292)

    It was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained     a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-2024)

    It was discovered that the USB video device class implementation in the Linux kernel did not properly     validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to     possibly expose sensitive information (kernel memory). (CVE-2019-2101)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

    Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux     kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host     system. (CVE-2019-3900)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol     BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically     proximate attacker could use this to expose sensitive information. (CVE-2019-9506)

    It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent     kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could     use this to expose sensitive information. (CVE-2018-20511)

    It was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper     assumptions about the device characteristics. A physically proximate attacker could use this cause a     denial of service (system crash). (CVE-2019-15218)

    It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data     size information from the device. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2019-15221)

    Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly     restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges     could use this to execute arbitrary code. (CVE-2019-3701)

    Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly     validate passed parameters in some situations. A local privileged attacker could use this to cause a     denial of service (infinite loop). (CVE-2019-3819)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126)

Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638)

It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-12984)

Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13233)

Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272)

It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash).
(CVE-2019-14283)

It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284)

It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846)

Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4094-1 advisory.

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode     validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause     a denial of service (system crash). (CVE-2018-13093)

    Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100, CVE-2018-14614,     CVE-2018-14616, CVE-2018-13096, CVE-2018-13098, CVE-2018-14615)

    Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not     properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when     mounted, could cause a denial of service (system crash). (CVE-2018-14610, CVE-2018-14611, CVE-2018-14612,     CVE-2018-14613, CVE-2018-14609)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not     properly initialize new files in some situations. A local attacker could use this to expose sensitive     information. (CVE-2018-16862)

    Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle     size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause     a denial of service (system crash). (CVE-2018-20169)

    It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel     when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

    Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not     properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An     attacker could use this to expose sensitive information. (CVE-2018-5383)

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions     during speculative execution. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-1125)

    It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for     allocation errors in some situations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-12614)

    It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication     (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system     crash). (CVE-2019-12818)

    It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device     reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-12819)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained     a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-2024)

    It was discovered that the USB video device class implementation in the Linux kernel did not properly     validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to     possibly expose sensitive information (kernel memory). (CVE-2019-2101)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

    It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent     kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could     use this to expose sensitive information. (CVE-2018-20511)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4093-1 advisory.

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    Andrei Vlad Lutas and Dan Lutas discovered that some x86 processors incorrectly handle SWAPGS instructions     during speculative execution. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-1125)

    It was discovered that the PowerPC dlpar implementation in the Linux kernel did not properly check for     allocation errors in some situations. A local attacker could possibly use this to cause a denial of     service (system crash). (CVE-2019-12614)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2018-20836     chenxiang reported a race condition in libsas, the     kernel subsystem supporting Serial Attached SCSI (SAS)     devices, which could lead to a use-after-free. It is not     clear how this might be exploited.

  - CVE-2019-1125     It was discovered that most x86 processors could     speculatively skip a conditional SWAPGS instruction used     when entering the kernel from user mode, and/or could     speculatively execute it when it should be skipped. This     is a subtype of Spectre variant 1, which could allow     local users to obtain sensitive information from the     kernel or other processes. It has been mitigated by     using memory barriers to limit speculative execution.
    Systems using an i386 kernel are not affected as the     kernel does not use SWAPGS.

  - CVE-2019-1999     A race condition was discovered in the Android binder     driver, which could lead to a use-after-free. If this     driver is loaded, a local user might be able to use this     for denial-of-service (memory corruption) or for     privilege escalation.

  - CVE-2019-10207     The syzkaller tool found a potential null dereference in     various drivers for UART-attached Bluetooth adapters. A     local user with access to a pty device or other suitable     tty device could use this for denial-of-service     (BUG/oops).

  - CVE-2019-10638     Amit Klein and Benny Pinkas discovered that the     generation of IP packet IDs used a weak hash function,     'jhash'. This could enable tracking individual computers     as they communicate with different remote servers and     from different networks. The 'siphash' function is now     used instead.

  - CVE-2019-12817     It was discovered that on the PowerPC (ppc64el)     architecture, the hash page table (HPT) code did not     correctly handle fork() in a process with memory mapped     at addresses above 512 TiB. This could lead to a     use-after-free in the kernel, or unintended sharing of     memory between user processes. A local user could use     this for privilege escalation. Systems using the radix     MMU, or a custom kernel with a 4 KiB page size, are not     affected.

  - CVE-2019-12984     It was discovered that the NFC protocol implementation     did not properly validate a netlink control message,     potentially leading to a NULL pointer dereference. A     local user on a system with an NFC interface could use     this for denial-of-service (BUG/oops).

  - CVE-2019-13233     Jann Horn discovered a race condition on the x86     architecture, in use of the LDT. This could lead to a     use-after-free. A local user could possibly use this for     denial-of-service.

  - CVE-2019-13631     It was discovered that the gtco driver for USB input     tablets could overrun a stack buffer with constant data     while parsing the device's descriptor. A physically     present user with a specially constructed USB device     could use this to cause a denial-of-service (BUG/oops),     or possibly for privilege escalation.

  - CVE-2019-13648     Praveen Pandey reported that on PowerPC (ppc64el)     systems without Transactional Memory (TM), the kernel     would still attempt to restore TM state passed to the     sigreturn() system call. A local user could use this for     denial-of-service (oops).

  - CVE-2019-14283     The syzkaller tool found a missing bounds check in the     floppy disk driver. A local user with access to a floppy     disk device, with a disk present, could use this to read     kernel memory beyond the I/O buffer, possibly obtaining     sensitive information.

  - CVE-2019-14284     The syzkaller tool found a potential division-by-zero in     the floppy disk driver. A local user with access to a     floppy disk device could use this for denial-of-service     (oops).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses (bnc#1140575 1140577).

CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image was exposed. This attack could be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable because IP ID generation was changed to have a dependency on an address associated with a network namespace (bnc#1140577).

CVE-2019-13233: In arch/x86/lib/insn-eval.c in the Linux kernel, there was a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation (bnc#1140454).

CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).

CVE-2019-10126: A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might have lead to memory corruption and possibly other consequences (bnc#1136935).

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c (bnc#1131645 1133738).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
208490	CentOS 7 : kernel-rt (RHSA-2020:1070)	Nessus	CentOS Local Security Checks	critical
202873	Photon OS 3.0: Linux PHSA-2019-3.0-0021	Nessus	PhotonOS Local Security Checks	high
180720	Oracle Linux 7 : kernel (ELSA-2020-1016)	Nessus	Oracle Linux Local Security Checks	critical
180632	Oracle Linux 8 : kernel (ELSA-2019-3517)	Nessus	Oracle Linux Local Security Checks	critical
164612	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17.1)	Nessus	Misc.	critical
164596	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.15.3)	Nessus	Misc.	high
164595	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18)	Nessus	Misc.	critical
145665	CentOS 8 : kernel (CESA-2019:3517)	Nessus	CentOS Local Security Checks	critical
143971	NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel Multiple Vulnerabilities (NS-SA-2020-0108)	Nessus	NewStart CGSL Local Security Checks	critical
138171	RHEL 7 : kernel (RHSA-2020:2851)	Nessus	Red Hat Local Security Checks	high
137363	RHEL 7 : kernel (RHSA-2020:2522)	Nessus	Red Hat Local Security Checks	high
135813	Scientific Linux Security Update : kernel on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	critical
135316	CentOS 7 : kernel (RHSA-2020:1016)	Nessus	CentOS Local Security Checks	critical
135080	RHEL 7 : kernel (RHSA-2020:1016)	Nessus	Red Hat Local Security Checks	critical
135078	RHEL 7 : kernel-rt (RHSA-2020:1070)	Nessus	Red Hat Local Security Checks	critical
134387	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1186)	Nessus	Huawei Local Security Checks	critical
130547	RHEL 8 : kernel (RHSA-2019:3517)	Nessus	Red Hat Local Security Checks	critical
130526	RHEL 8 : kernel-rt (RHSA-2019:3309)	Nessus	Red Hat Local Security Checks	critical
129284	SUSE SLED15 / SLES15 Security Update : kernel-source-rt (SUSE-SU-2019:2430-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)	Nessus	SuSE Local Security Checks	high
128478	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-4118-1)	Nessus	Ubuntu Local Security Checks	critical
128477	Ubuntu 19.04 : linux-aws vulnerabilities (USN-4117-1)	Nessus	Ubuntu Local Security Checks	critical
127889	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1)	Nessus	Ubuntu Local Security Checks	critical
127888	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-4093-1)	Nessus	Ubuntu Local Security Checks	critical
127491	Debian DSA-4495-1 : linux - security update	Nessus	Debian Local Security Checks	high
126897	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1757)	Nessus	SuSE Local Security Checks	critical
126743	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1854-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-13233

high

Tenable Plugins

critical

high

critical

critical

critical

high

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical

critical