A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled. A guest could use this flaw to potentially crash the host kernel resulting in DoS issue. Kernel versions from 4.16 and newer are vulnerable to this issue.

An update of the linux package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:2703 advisory.

  - kernel: Use-after-free in sound/usb/card.c:usb_audio_probe() (CVE-2018-19824)

  - kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

  - kernel: ppc: unrelated processes being able to read/write to each other's virtual memory (CVE-2019-12817)

  - kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

  - Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS (CVE-2019-3887)

  - kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results (CVE-2019-9500)

  - kernel: brcmfmac frame validation bypass (CVE-2019-9503)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2741 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

    * Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS (CVE-2019-3887)

    * kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results (CVE-2019-9500)

    * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

    * kernel: brcmfmac frame validation bypass (CVE-2019-9503)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * BUG: scheduling while atomic in zswap (BZ#1726362)

    * kernel-rt: update to the RHEL8.0.z batch#3 source tree (BZ#1734475)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2703 advisory.

    - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
    - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501]     {CVE-2019-1125}
    - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500     1724501] {CVE-2019-1125}
    - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf)     [1724500 1724501] {CVE-2019-1125}
    - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501]     {CVE-2019-1125}
    - [mm] powerpc/mm/64s/hash: Reallocate context ids on fork (Gustavo Duarte) [1734689 1723808]     {CVE-2019-12817}
    - [sound] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Jaroslav Kysela)     [1726371 1658924] {CVE-2018-19824}
    - [wireless] mwifiex: Abort at too short BSS descriptor element (Jarod Wilson) [1714475 1714476]     {CVE-2019-3846}
    - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Jarod Wilson) [1714475     1714476] {CVE-2019-3846}
    - [wireless] brcmfmac: add subtype check for event handling in data path (Stanislaw Gruszka) [1733895     1704684] {CVE-2019-9503}
    - [wireless] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1705385 1705386]     {CVE-2019-9500}
    - [include] fs: fix kABI for struct pipe_buf_operations (Miklos Szeredi) [1705006 1705007]     {CVE-2019-11487}
    - [fs] fs: prevent page refcount overflow in pipe_buf_get (Miklos Szeredi) [1705006 1705007]     {CVE-2019-11487}
    - [mm] mm: prevent get_user_pages() from overflowing page refcount (Miklos Szeredi) [1705006 1705007]     {CVE-2019-11487}
    - [include] mm: add 'try_get_page()' helper function (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
    - [include] mm: make page ref count overflow check tighter and more explicit (Miklos Szeredi) [1705006     1705007] {CVE-2019-11487}
    - [fs] fuse: call pipe_buf_release() under pipe lock (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
    - [kvm] KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) (Vitaly Kuznetsov) [1697198     1697199]
    - Revert: [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1726353     1640855] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2703 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Heap overflow in mwifiex_update_bss_desc_with_ie function in marvell/mwifiex/scan.c     (CVE-2019-3846)

    * Kernel: KVM: nVMX: guest accesses L0 MSR causes potential DoS (CVE-2019-3887)

    * kernel: brcmfmac heap buffer overflow in brcmf_wowl_nd_results (CVE-2019-9500)

    * kernel: Count overflow in FUSE request leading to use-after-free issues. (CVE-2019-11487)

    * kernel: ppc: unrelated processes being able to read/write to each other's virtual memory     (CVE-2019-12817)

    * kernel: Use-after-free in sound/usb/card.c:usb_audio_probe() (CVE-2018-19824)

    * kernel: brcmfmac frame validation bypass (CVE-2019-9503)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [DELL EMC 8.0 BUG]: pciehp deadlock resulting in NVMe device not being recognized when hot plugged     (BZ#1712261)

    * Host crashed while try to boot a compatible guest attached huge page by-object memory-backend-file
    *[1G-P9] (BZ#1714758)

    * Setting malformed authenc key will crash the system  (BZ#1715335)

    * BUG: memory allocation failure in inode_doinit_with_dentry()/context_to_sid() (BZ#1717780)

    * [HPEMC 8.1 BUG] Protect against concurrent calls into UV BIOS (BZ#1724534)

    * PHC jumping on I350 (igb) (BZ#1726352)

    * aarch64 kernel missing vulnerabilities status files (BZ#1726353)

    * BUG: KASAN: use-after-free in skb_release_data() (BZ#1726354)

    * [RHEL8][PANIC][aarch64] kernel panic when loading the dme1737 module (BZ#1726355)

    * [RHEL8] [aarch64] Changes for BZ1672997 break kaslr (BZ#1726357)

    * Network fails to come up when booting with kernel 3.10.0-862.el7.x86_64, several hung tasks can be seen     in logs. (BZ#1726358)

    * [Intel] 'cpupower frequency-set' produces unexpected results for some processors (BZ#1726360)

    * HDMI/DP audio: ELD not updated on hotplug event (BZ#1726361)

    * [mlx5_core] CX5 Adapter works not as expected when MTU is 9000, Unable to handle kernel paging request     at virtual address 3ae0aafeff4b6b5a (BZ#1726372)

    * [DELL 8.0 Bug] - hid-multitouch 0018:1FD2:8008.0001 ,lost function from S3 resume  (BZ#1727098)

    * [RHEL8.1 Pre Beta] [Power8] data corruption while returning from watchpoint exception handler     (BZ#1733281)

    * RHEL8.1 pre-Beta - cacheinfo code unsafe vs LPM (BZ#1733282)

    * RHEL8.1 pre-Beta - [ZZ/Zeppelin] [kernel-4.18.0-100.el8.ppc64le] Hash MMU allows child to write parents     process address space (BZ#1734689)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3980-2 advisory.

    USN-3980-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04     LTS.

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas,     Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi,     Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered that memory     previously stored in microarchitectural fill buffers of an Intel CPU core may be exposed to a malicious     process that is executing on the same CPU core. A local attacker could use this to expose sensitive     information. (CVE-2018-12130)

    Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan van Schaik, Alyssa Milburn,     Sebastian sterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that     memory previously stored in microarchitectural load ports of an Intel CPU core may be exposed to a     malicious process that is executing on the same CPU core. A local attacker could use this to expose     sensitive information. (CVE-2018-12127)

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael     Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Berk Sunar, Frank Piessens, and Yuval Yarom discovered     that memory previously stored in microarchitectural store buffers of an Intel CPU core may be exposed to a     malicious process that is executing on the same CPU core. A local attacker could use this to expose     sensitive information. (CVE-2018-12126)

    Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+     subsystem when multiple network namespaces are in use. A local attacker in a container could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

    Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Volodrmyr Pikhur, Moritz Lipp, Michael Schwarz,     Daniel Gruss, Stephan van Schaik, Alyssa Milburn, Sebastian sterlund, Pietro Frigo, Kaveh Razavi,     Herbert Bos, and Cristiano Giuffrida discovered that uncacheable memory previously stored in     microarchitectural buffers of an Intel CPU core may be exposed to a malicious process that is executing on     the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11091)

    Matteo Croce, Natale Vinto, and Andrea Spagnolo discovered that the cgroups subsystem of the Linux kernel     did not properly account for SCTP socket buffers. A local attacker could use this to cause a denial of     service (system crash). (CVE-2019-3874)

    Alex Williamson discovered that the vfio subsystem of the Linux kernel did not properly limit DMA     mappings. A local attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2019-3882)

    Marc Orr discovered that the KVM hypervisor implementation in the Linux kernel did not properly restrict     APIC MSR register values when nested virtualization is used. An attacker in a guest vm could use this to     cause a denial of service (host OS crash). (CVE-2019-3887)

    Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel contained a heap buffer     overflow. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2019-9500)

    Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel did not properly prevent     remote firmware events from being processed for USB Wifi devices. A physically proximate attacker could     use this to send firmware events to the device. (CVE-2019-9503)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered that memory previously stored in microarchitectural fill buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information.
(CVE-2018-12130)

Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that memory previously stored in microarchitectural load ports of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12127)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Berk Sunar, Frank Piessens, and Yuval Yarom discovered that memory previously stored in microarchitectural store buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12126)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Volodrmyr Pikhur, Moritz Lipp, Michael Schwarz, Daniel Gruss, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that uncacheable memory previously stored in microarchitectural buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11091)

Matteo Croce, Natale Vinto, and Andrea Spagnolo discovered that the cgroups subsystem of the Linux kernel did not properly account for SCTP socket buffers. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-3874)

Alex Williamson discovered that the vfio subsystem of the Linux kernel did not properly limit DMA mappings. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-3882)

Marc Orr discovered that the KVM hypervisor implementation in the Linux kernel did not properly restrict APIC MSR register values when nested virtualization is used. An attacker in a guest vm could use this to cause a denial of service (host OS crash). (CVE-2019-3887)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel contained a heap buffer overflow. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9500)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel did not properly prevent remote firmware events from being processed for USB Wifi devices. A physically proximate attacker could use this to send firmware events to the device. (CVE-2019-9503).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered that memory previously stored in microarchitectural fill buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information.
(CVE-2018-12130)

Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that memory previously stored in microarchitectural load ports of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12127)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Berk Sunar, Frank Piessens, and Yuval Yarom discovered that memory previously stored in microarchitectural store buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12126)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Volodrmyr Pikhur, Moritz Lipp, Michael Schwarz, Daniel Gruss, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that uncacheable memory previously stored in microarchitectural buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11091)

It was discovered that the IPv4 generic receive offload (GRO) for UDP implementation in the Linux kernel did not properly handle padded packets. A remote attacker could use this to cause a denial of service (system crash). (CVE-2019-11683)

It was discovered that a race condition existed in the Binder IPC driver for the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2019-1999)

Matteo Croce, Natale Vinto, and Andrea Spagnolo discovered that the cgroups subsystem of the Linux kernel did not properly account for SCTP socket buffers. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-3874)

Alex Williamson discovered that the vfio subsystem of the Linux kernel did not properly limit DMA mappings. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-3882)

Marc Orr discovered that the KVM hypervisor implementation in the Linux kernel did not properly restrict APIC MSR register values when nested virtualization is used. An attacker in a guest vm could use this to cause a denial of service (host OS crash). (CVE-2019-3887)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel contained a heap buffer overflow. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9500)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel did not properly prevent remote firmware events from being processed for USB Wifi devices. A physically proximate attacker could use this to send firmware events to the device. (CVE-2019-9503).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 5.0.7 update contains a number of important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
203713	Photon OS 3.0: Linux PHSA-2020-3.0-0118	Nessus	PhotonOS Local Security Checks	high
145668	CentOS 8 : kernel (CESA-2019:2703)	Nessus	CentOS Local Security Checks	high
128859	RHEL 8 : kernel-rt (RHSA-2019:2741)	Nessus	Red Hat Local Security Checks	high
128845	Oracle Linux 8 : kernel (ELSA-2019-2703)	Nessus	Oracle Linux Local Security Checks	high
128665	RHEL 8 : kernel (RHSA-2019:2703)	Nessus	Red Hat Local Security Checks	high
126115	Photon OS 3.0: Linux PHSA-2019-3.0-0015	Nessus	PhotonOS Local Security Checks	critical
125140	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3980-2)	Nessus	Ubuntu Local Security Checks	high
125139	Ubuntu 18.10 : Linux kernel vulnerabilities (USN-3980-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Ubuntu Local Security Checks	high
125138	Ubuntu 19.04 : Linux kernel vulnerabilities (USN-3979-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Ubuntu Local Security Checks	critical
124520	Fedora 30 : kernel / kernel-headers / kernel-tools (2019-982b97f553)	Nessus	Fedora Local Security Checks	medium
124044	Fedora 28 : kernel / kernel-headers / kernel-tools (2019-ce2933b003)	Nessus	Fedora Local Security Checks	medium
124043	Fedora 29 : kernel / kernel-headers / kernel-tools (2019-94dc902948)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2019-3887

medium

Tenable Plugins

high

high

high

high

high

critical

high

high

critical

medium

medium

medium