An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In the Linux kernel     4.19.83, there is a use-after-free (read) in the     debugfs_remove function in fs/debugfs/inode.c (which is     used to remove a file or directory in debugfs that was     previously created with a call to another debugfs     function such as     debugfs_create_file).(CVE-2019-19770)mwifiex_tm_cmd in     driverset/wireless/marvell/mwifiex/cfg80211.c in the     Linux kernel before 5.1.6 has some error-handling cases     that did not free allocated hostcmd memory, aka     CID-003b686ace82. This will cause a memory leak and     denial of service.(CVE-2019-20095)TSX Asynchronous     Abort condition on some CPUs utilizing speculative     execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access.(CVE-2019-11135)A memory leak     in the crypto_report() function in     crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering crypto_report_alg()     failures, aka CID-ffdde5932042.(CVE-2019-19062)In the     Linux kernel before 5.1.6, there is a use-after-free in     serial_ir_init_module() in     drivers/media/rc/serial_ir.c.(CVE-2019-19543)In the     Linux kernel through 5.4.6, there is a NULL pointer     dereference in drivers/scsi/libsas/sas_discover.c     because of mishandling of port disconnection during     discovery, related to a PHY down race condition, aka     CID-f70267f379b5.(CVE-2019-19965)In the Linux kernel     before 5.1.6, there is a use-after-free in cpia2_exit()     in drivers/media/usb/cpia2/cpia2_v4l.c that will cause     denial of service, aka     CID-dea37a972655.(CVE-2019-19966)An issue was     discovered in drivers/xen/balloon.c in the Linux kernel     before 5.2.3, as used in Xen through 4.12.x, allowing     guest OS users to cause a denial of service because of     unrestricted resource consumption during the mapping of     guest memory, aka CID-6ef36ab967c7.(CVE-2019-17351)A     memory leak in the crypto_reportstat() function in     drivers/virt/vboxguest/vboxguest_utils.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial     of service (memory consumption) by triggering     copy_form_user() failures, aka     CID-e0b0cb938864.(CVE-2019-19048)kernel/sched/fair.c in     the Linux kernel before 5.3.9, when cpu.cfs_quota_us is     used (e.g., with Kubernetes), allows attackers to cause     a denial of service against non-cpu-bound applications     by generating a workload that triggers unwanted slice     expiration, aka CID-de53fd7aedb1. (In other words,     although this slice expiration would typically be seen     with benign workloads, it is possible that an attacker     could calculate how many stray requests are required to     force an entire Kubernetes cluster into a     low-performance state caused by slice expiration, and     ensure that a DDoS attack sent that number of stray     requests. An attack does not affect the stability of     the kernel it only causes mismanagement of application     execution.)(CVE-2019-19922)An out-of-bounds memory     write issue was found in the Linux Kernel, version 3.13     through 5.4, in the way the Linux kernel's KVM     hypervisor handled the 'KVM_GET_EMULATED_CPUID'     ioctl(2) request to get CPUID features emulated by the     KVM hypervisor. A user or process able to access the     '/dev/kvm' device could use this flaw to crash the     system, resulting in a denial of     service.(CVE-2019-19332)A flaw was found in the fix for     CVE-2019-11135, the way Intel CPUs handle speculative     execution of instructions when a TSX Asynchronous Abort     (TAA) error occurs. When a guest is running on a host     CPU affected by the TAA flaw (TAA_NO=0), but is not     affected by the MDS issue (MDS_NO=1), the guest was to     clear the affected buffers by using a VERW instruction     mechanism. But when the MDS_NO=1 bit was exported to     the guests, the guests did not use the VERW mechanism     to clear the affected buffers. This issue affects     guests running on Cascade Lake CPUs and requires that     host has 'TSX' enabled. Confidentiality of data is the     highest threat associated with this     vulnerability.(CVE-2019-19338)In the Linux kernel     5.0.0-rc7 (as distributed in ubuntu/linux.git on     kernel.ubuntu.com), mounting a crafted f2fs filesystem     image and performing some operations can lead to     slab-out-of-bounds read access in ttm_put_pages in     drivers/gpu/drm/ttm/ttm_page_alloc.c. This is related     to the vmwgfx or ttm module.(CVE-2019-19927)In the     Linux kernel 4.14 longterm through 4.14.165 and 4.19     longterm through 4.19.96 (and 5.x before 5.2), there is     a use-after-free (write) in the i915_ppgtt_close     function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka     CID-7dc40713618c. This is related to     i915_gem_context_destroy_ioctl in     drivers/gpu/drm/i915/i915_gem_context.c.(CVE-2020-7053)     In the Linux kernel through 5.4.6, there are     information leaks of uninitialized memory to a USB     device in the     driverset/can/usb/kvaser_usb/kvaser_usb_leaf.c driver,     aka CID-da2311a6385c.(CVE-2019-19947)In the Linux     kernel before 5.0.6, there is a NULL pointer     dereference in drop_sysctl_table() in     fs/proc/proc_sysctl.c, related to put_links, aka     CID-23da9588037e.(CVE-2019-20054)In the Linux kernel     before 5.1, there is a memory leak in
    __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)A heap-based buffer     overflow vulnerability was found in the Linux kernel,     version kernel-2.6.32, in Marvell WiFi chip driver. A     remote attacker could cause a denial of service (system     crash) or, possibly execute arbitrary code, when the     lbs_ibss_join_existing function is called after a STA     connects to an AP.(CVE-2019-14896)A heap-based buffer     overflow was discovered in the Linux kernel, all     versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi     chip driver. The flaw could occur when the station     attempts a connection negotiation during the handling     of the remote devices country settings. This could     allow the remote device to cause a denial of service     (system crash) or possibly execute arbitrary     code.(CVE-2019-14895)A stack-based buffer overflow was     found in the Linux kernel, version kernel-2.6.32, in     Marvell WiFi chip driver. An attacker is able to cause     a denial of service (system crash) or, possibly execute     arbitrary code, when a STA works in IBSS mode (allows     connecting stations together without the use of an AP)     and connects to another STA.(CVE-2019-14897)An     exploitable denial-of-service vulnerability exists in     the Linux kernel prior to mainline 5.3. An attacker     could exploit this vulnerability by triggering AP to     send IAPP location updates for stations before the     required authentication process has completed. This     could lead to different denial-of-service scenarios,     either by causing CAM table attacks, or by leading to     traffic flapping if faking already existing clients in     other nearby APs of the same wireless infrastructure.
    An attacker can forge Authentication and Association     Request packets to trigger this     vulnerability.(CVE-2019-5108)drivers/gpu/drm/radeon/rad     eon_display.c in the Linux kernel 5.2.14 does not check     the alloc_workqueue return value, leading to a NULL     pointer dereference.(CVE-2019-16230)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4286-1 advisory.

    It was discovered that the Linux kernel did not properly clear data structures on context switches for     certain Intel graphics processors. A local attacker could use this to expose sensitive information.
    (CVE-2019-14615)

    It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15220)

    Julien Grall discovered that the Xen balloon memory driver in the Linux kernel did not properly restrict     the amount of memory set aside for page mappings in some situations. An attacker could use this to cause a     denial of service (kernel memory exhaustion). (CVE-2019-17351)

    It was discovered that the Intel WiMAX 2400 driver in the Linux kernel did not properly deallocate memory     in certain situations. A local attacker could use this to cause a denial of service (kernel memory     exhaustion). (CVE-2019-19051)

    It was discovered that the Marvell Wi-Fi device driver in the Linux kernel did not properly deallocate     memory in certain error conditions. A local attacker could use this to possibly cause a denial of service     (kernel memory exhaustion). (CVE-2019-19056)

    It was discovered that the Brocade BFA Fibre Channel device driver in the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial     of service (kernel memory exhaustion). (CVE-2019-19066)

    It was discovered that the Realtek RTL8xxx USB Wi-Fi device driver in the Linux kernel did not properly     deallocate memory in certain error conditions. A local attacker could possibly use this to cause a denial     of service (kernel memory exhaustion). (CVE-2019-19068)

    Gao Chuan discovered that the SAS Class driver in the Linux kernel contained a race condition that could     lead to a NULL pointer dereference. A local attacker could possibly use this to cause a denial of service     (system crash). (CVE-2019-19965)

    It was discovered that the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel     did not properly deallocate memory in certain error conditions. An attacker could possibly use this to     cause a denial of service (kernel memory exhaustion). (CVE-2019-20096)

    Mitchell Frank discovered that the Wi-Fi implementation in the Linux kernel when used as an access point     would send IAPP location updates for stations before client authentication had completed. A physically     proximate attacker could use this to cause a denial of service. (CVE-2019-5108)

    It was discovered that ZR364XX Camera USB device driver for the Linux kernel did not properly initialize     memory. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15217)

    It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data     size information from the device. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2019-15221)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):Linux kernel CIFS     implementation, version 4.9.0 is vulnerable to a     relative paths injection in directory entry     lists.(CVE-2019-10220)A memory leak in the     i2400m_op_rfkill_sw_toggle() function in drivers/     net/wimax/i2400m/op-rfkill.c in the Linux kernel before     5.3.11 allows attackers to cause a denial of service     (memory consumption), aka     CID-6f3ef5c25cc7.(CVE-2019-19051)A memory leak in the     sdma_init() function in     drivers/infiniband/hw/hfi1/sdma.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption) by triggering     rhashtable_init() failures, aka     CID-34b3be18a04e.(CVE-2019-19065)Four memory leaks in     the acp_hw_init() function in     drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c in the Linux     kernel before 5.3.8 allow attackers to cause a denial     of service (memory consumption) by triggering     mfd_add_hotplug_devices() or pm_genpd_add_device()     failures, aka CID-57be09c6e874. NOTE: third parties     dispute the relevance of this because the attacker must     already have privileges for module     loading.(CVE-2019-19067)An issue was discovered in     drivers/xen/balloon.c in the Linux kernel before 5.2.3,     as used in Xen through 4.12.x, allowing guest OS users     to cause a denial of service because of unrestricted     resource consumption during the mapping of guest     memory, aka CID-6ef36ab967c7.(CVE-2019-17351)The     xen_biovec_phys_mergeable function in     drivers/xen/biomerge.c in Xen might allow local OS     guest users to corrupt block device data streams and     consequently obtain sensitive memory information, cause     a denial of service, or gain host OS privileges by     leveraging incorrect block IO merge-ability     calculation.(CVE-2017-12134)In the Linux kernel before     5.3.7, there is a use-after-free bug that can be caused     by a malicious USB device in the     drivers/usb/misc/adutux.c driver, aka     CID-44efc269db79.(CVE-2019-19523)In the Linux kernel     before 5.3.7, there is a use-after-free bug that can be     caused by a malicious USB device in the     drivers/usb/misc/iowarrior.c driver, aka     CID-edc4746f253d.(CVE-2019-19528)In the Linux kernel     before 5.2.10, there is a use-after-free bug that can     be caused by a malicious USB device in the     drivers/usb/class/cdc-acm.c driver, aka     CID-c52873e5a1ef.(CVE-2019-19530)In the Linux kernel     before 5.3.4, there is an info-leak bug that can be     caused by a malicious USB device in the     drivers/media/usb/ttusb-dec/ttusb_dec.c driver, aka     CID-a10feaf8c464.(CVE-2019-19533)In the Linux kernel     before 5.2.10, there is a race condition bug that can     be caused by a malicious USB device in the USB     character device driver layer, aka CID-303911cfc5b9.
    This affects drivers/usb/core/file.c.(CVE-2019-19537)In     the Linux kernel before 5.3.12, there is a     use-after-free bug that can be caused by a malicious     USB device in the drivers/input/ff-memless.c driver,     aka CID-fa3a5a1880c9.(CVE-2019-19524)In the Linux     kernel before 5.2.10, there is a use-after-free bug     that can be caused by a malicious USB device in the     drivers/hid/usbhid/hiddev.c driver, aka     CID-9c09b214f30e.(CVE-2019-19527)In the Linux kernel     before 5.3.9, there are multiple out-of-bounds write     bugs that can be caused by a malicious USB device in     the Linux kernel HID drivers, aka CID-d9d4b1e46d95.
    This affects drivers/hid/hid-axff.c,     drivers/hid/hid-dr.c, drivers/hid/hid-emsff.c,     drivers/hid/hid-gaff.c, drivers/hid/hid-holtekff.c,     drivers/hid/hid-lg2ff.c, drivers/hid/hid-lg3ff.c,     drivers/hid/hid-lg4ff.c, drivers/hid/hid-lgff.c,     drivers/hid/hid-logitech-hidpp.c,     drivers/hid/hid-microsoft.c, drivers/hid/hid-sony.c,     drivers/hid/hid-tmff.c, and     drivers/hid/hid-zpff.c.(CVE-2019-19532)The VFS     subsystem in the Linux kernel 3.x provides an     incomplete set of requirements for setattr operations     that underspecifies removing extended privilege     attributes, which allows local users to cause a denial     of service (capability stripping) via a failed     invocation of a system call, as demonstrated by using     chown to remove a capability from the ping or Wireshark     dumpcap program.(CVE-2015-1350)In the Linux kernel     before 5.2.9, there is a use-after-free bug that can be     caused by a malicious USB device in the     drivers/usb/misc/yurex.c driver, aka     CID-fc05481b2fca.(CVE-2019-19531)The Linux kernel     through 5.3.13 has a start_offset+size Integer Overflow     in cpia2_remap_buffer in     drivers/media/usb/cpia2/cpia2_core.c because cpia2 has     its own mmap implementation. This allows local users     (with /dev/video0 access) to obtain read and write     permissions on kernel physical pages, which can     possibly result in a privilege     escalation.(CVE-2019-18675)A flaw was found in the way     signature calculation was handled by cephx     authentication protocol. An attacker having access to     ceph cluster network who is able to alter the message     payload was able to bypass signature checks done by     cephx protocol. Ceph branches master, mimic, luminous     and jewel are believed to be     vulnerable.(CVE-2018-1129)A memory leak in the     alloc_sgtable() function in     driverset/wireless/intel/iwlwifi/fw/dbg.c in the Linux     kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering     alloc_page() failures, aka     CID-b4b814fec1a5.(CVE-2019-19058)A memory leak in the     ath9k_wmi_cmd() function in     driverset/wireless/ath/ath9k/wmi.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of     service (memory consumption), aka     CID-728c1e2a05e4.(CVE-2019-19074)Memory leaks in     driverset/wireless/ath/ath9k/htc_hst.c in the Linux     kernel through 5.3.11 allow attackers to cause a denial     of service (memory consumption) by triggering     wait_for_completion_timeout() failures. This affects     the htc_config_pipe_credits() function, the     htc_setup_complete() function, and the     htc_connect_service() function, aka     CID-853acf7caf10.(CVE-2019-19073)Two memory leaks in     the rtl_usb_probe() function in     driverset/wireless/realtek/rtlwifi/usb.c in the Linux     kernel through 5.3.11 allow attackers to cause a denial     of service (memory consumption), aka     CID-3f9361695113.(CVE-2019-19063)A memory leak in the     mwifiex_pcie_alloc_cmdrsp_buf() function in     driverset/wireless/marvell/mwifiex/pcie.c in the Linux     kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering     mwifiex_map_pci_memory() failures, aka     CID-db8fd2cde932.(CVE-2019-19056)Two memory leaks in     the mwifiex_pcie_init_evt_ring() function in     driverset/wireless/marvell/mwifiex/pcie.c in the Linux     kernel through 5.3.11 allow attackers to cause a denial     of service (memory consumption) by triggering     mwifiex_map_pci_memory() failures, aka     CID-d10dcb615c8e.(CVE-2019-19057)An issue was     discovered in the Linux kernel through 5.2.9. There is     a NULL pointer dereference caused by a malicious USB     device in the flexcop_usb_probe function in the     drivers/media/usb/b2c2/flexcop-usb.c     driver.(CVE-2019-15291)A use-after-free in binder.c     allows an elevation of privilege from an application to     the Linux Kernel. No user interaction is required to     exploit this vulnerability, however exploitation does     require either the installation of a malicious local     application or a separate vulnerability in a network     facing application.Product: AndroidAndroid ID:
    A-141720095(CVE-2019-2215)In task_get_unused_fd_flags     of binder.c, there is a possible memory corruption due     to a use after free. This could lead to local     escalation of privilege with no additional execution     privileges needed. User interaction is not needed for     exploitation. Product: Android Versions: Android kernel     Android ID: A-69164715 References: Upstream     kernel.(CVE-2018-9465)In the Android kernel in Pixel C     USB monitor driver there is a possible OOB write due to     a missing bounds check. This could lead to local     escalation of privilege with System execution     privileges needed. User interaction is not needed for     exploitation.(CVE-2019-9456)fs/btrfs/volumes.c in the     Linux kernel before 5.1 allows a     btrfs_verify_dev_extents NULL pointer dereference via a     crafted btrfs image because fs_devices->devices is     mishandled within find_device, aka     CID-09ba3bc9dd15.(CVE-2019-18885)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

ID	Name	Product	Family	Severity
196575	RHEL 5 : xen (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
133992	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1158)	Nessus	Huawei Local Security Checks	critical
133799	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4286-1)	Nessus	Ubuntu Local Security Checks	medium
132360	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-2693)	Nessus	Huawei Local Security Checks	high
128732	Photon OS 3.0: Linux PHSA-2019-3.0-0026	Nessus	PhotonOS Local Security Checks	critical

Detections

Analytics

CVE-2019-17351

medium

Tenable Plugins

critical

critical

medium

high

critical