libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.

An update of the libseccomp package has been released.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3624 advisory.

    [2.4.1-1]
    - rebase to 2.4.1

    [2.3.3-4]
    - spec: make the check phase conditional

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3624 advisory.

  - libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libcomps packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free flaw has been discovered in libcomps     before version 0.1.10 in the way ObjMRTrees are merged.
    An attacker, who is able to make an application read a     crafted comps XML file, may be able to crash the     application or execute malicious code.(CVE-2019-3817)

  - libseccomp before 2.4.0 did not correctly generate     64-bit syscall argument comparisons using the     arithmetic operators (LT, GT, LE, GE), which might able     to lead to bypassing seccomp filters and potential     privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations. (CVE-2019-9893)

This update for libseccomp fixes the following issues :

Update to new upstream release 2.4.1 :

Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks.

Updated to 2.4.0 (bsc#1128828 CVE-2019-9893): Update the syscall table for Linux v5.0-rc5

Added support for the SCMP_ACT_KILL_PROCESS action

Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute

Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension

Added support for the parisc and parisc64 architectures

Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3)

Return -EDOM on an endian mismatch when adding an architecture to a filter

Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run()

Fix PFC generation when a syscall is prioritized, but no rule exists

Numerous fixes to the seccomp-bpf filter generation code

Switch our internal hashing function to jhash/Lookup3 to MurmurHash3

Numerous tests added to the included test suite, coverage now at ~92%

Update our Travis CI configuration to use Ubuntu 16.04

Numerous documentation fixes and updates

Update to release 2.3.3: Updated the syscall table for Linux v4.15-rc7

Update to release 2.3.2: Achieved full compliance with the CII Best Practices program

Added Travis CI builds to the GitHub repository

Added code coverage reporting with the '--enable-code-coverage' configure flag and added Coveralls to the GitHub repository

Updated the syscall tables to match Linux v4.10-rc6+

Support for building with Python v3.x

Allow rules with the -1 syscall if the SCMP\_FLTATR\_API\_TSKIP attribute is set to true

Several small documentation fixes

ignore make check error for ppc64/ppc64le, bypass bsc#1142614

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:3624 advisory.

    The libseccomp library provides an interface to the Linux Kernel's syscall filtering mechanism, seccomp.
    The libseccomp API allows an application to specify which system calls or system call arguments the     application is allowed to execute, all of which are then enforced by the Linux Kernel.

    The following packages have been upgraded to a later upstream version: libseccomp (2.4.1). (BZ#1688938)

    Security Fix(es):

    * libseccomp: incorrect generation of syscall filters in libseccomp (CVE-2019-9893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libseccomp fixes the following issues :

Security issues fixed :

  - CVE-2019-9893: An incorrect generation of syscall     filters in libseccomp was fixed (bsc#1128828)

libseccomp was updated to new upstream release 2.4.1 :

  - Fix a BPF generation bug where the optimizer mistakenly     identified duplicate BPF code blocks.

libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893) :

  - Update the syscall table for Linux v5.0-rc5

  - Added support for the SCMP_ACT_KILL_PROCESS action

  - Added support for the SCMP_ACT_LOG action and     SCMP_FLTATR_CTL_LOG attribute

  - Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit     (SCMP_AX_64(...)) argument comparison macros to help     protect against unexpected sign extension

  - Added support for the parisc and parisc64 architectures

  - Added the ability to query and set the libseccomp API     level via seccomp_api_get(3) and seccomp_api_set(3)

  - Return -EDOM on an endian mismatch when adding an     architecture to a filter

  - Renumber the pseudo syscall number for subpage_prot() so     it no longer conflicts with spu_run()

  - Fix PFC generation when a syscall is prioritized, but no     rule exists

  - Numerous fixes to the seccomp-bpf filter generation code

  - Switch our internal hashing function to jhash/Lookup3 to     MurmurHash3

  - Numerous tests added to the included test suite,     coverage now at ~92%

  - Update our Travis CI configuration to use Ubuntu 16.04

  - Numerous documentation fixes and updates

libseccomp was updated to release 2.3.3 :

  - Updated the syscall table for Linux v4.15-rc7

This update was imported from the SUSE:SLE-15:Update update project.

This update for libseccomp fixes the following issues :

Security issues fixed :

CVE-2019-9893: An incorrect generation of syscall filters in libseccomp was fixed (bsc#1128828)

libseccomp was updated to new upstream release 2.4.1: Fix a BPF generation bug where the optimizer mistakenly identified duplicate BPF code blocks.

libseccomp was updated to 2.4.0 (bsc#1128828 CVE-2019-9893): Update the syscall table for Linux v5.0-rc5

Added support for the SCMP_ACT_KILL_PROCESS action

Added support for the SCMP_ACT_LOG action and SCMP_FLTATR_CTL_LOG attribute

Added explicit 32-bit (SCMP_AX_32(...)) and 64-bit (SCMP_AX_64(...)) argument comparison macros to help protect against unexpected sign extension

Added support for the parisc and parisc64 architectures

Added the ability to query and set the libseccomp API level via seccomp_api_get(3) and seccomp_api_set(3)

Return -EDOM on an endian mismatch when adding an architecture to a filter

Renumber the pseudo syscall number for subpage_prot() so it no longer conflicts with spu_run()

Fix PFC generation when a syscall is prioritized, but no rule exists

Numerous fixes to the seccomp-bpf filter generation code

Switch our internal hashing function to jhash/Lookup3 to MurmurHash3

Numerous tests added to the included test suite, coverage now at ~92%

Update our Travis CI configuration to use Ubuntu 16.04

Numerous documentation fixes and updates

libseccomp was updated to release 2.3.3: Updated the syscall table for Linux v4.15-rc7

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libseccomp package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - libseccomp before 2.4.0 did not correctly generate     64-bit syscall argument comparisons using the     arithmetic operators (LT, GT, LE, GE), which might able     to lead to bypassing seccomp filters and potential     privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libseccomp package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - libseccomp before 2.4.0 did not correctly generate     64-bit syscall argument comparisons using the     arithmetic operators (LT, GT, LE, GE), which might able     to lead to bypassing seccomp filters and potential     privilege escalations.(CVE-2019-9893)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-4001-1 fixed a vulnerability in libseccomp. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details :

Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with arithmetic operators (LT, GT, LE, GE). An attacker could use this to bypass intended access restrictions for argument-filtered system calls.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4001-1 advisory.

    Jann Horn discovered that libseccomp did not correctly generate 64-bit syscall argument comparisons with     arithmetic operators (LT, GT, LE, GE). An attacker could use this to bypass intended access restrictions     for argument-filtered system calls.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201904-18 (libseccomp: Privilege escalation)

    Please review the CVE identifier referenced below for details.
  Impact :

    Please review the referenced CVE identifier for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
202798	Photon OS 2.0: Libseccomp PHSA-2019-2.0-0149	Nessus	PhotonOS Local Security Checks	critical
199888	RHEL 7 : libseccomp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195848	RHEL 7 : libseccomp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
180655	Oracle Linux 8 : libseccomp (ELSA-2019-3624)	Nessus	Oracle Linux Local Security Checks	critical
145686	CentOS 8 : libseccomp (CESA-2019:3624)	Nessus	CentOS Local Security Checks	critical
134785	EulerOS 2.0 SP8 : libcomps (EulerOS-SA-2020-1293)	Nessus	Huawei Local Security Checks	critical
131028	Amazon Linux 2 : libseccomp (ALAS-2019-1360)	Nessus	Amazon Linux Local Security Checks	critical
130945	SUSE SLED12 / SLES12 Security Update : libseccomp (SUSE-SU-2019:2941-1)	Nessus	SuSE Local Security Checks	critical
130560	RHEL 8 : libseccomp (RHSA-2019:3624)	Nessus	Red Hat Local Security Checks	critical
129711	openSUSE Security Update : libseccomp (openSUSE-2019-2283)	Nessus	SuSE Local Security Checks	critical
129708	openSUSE Security Update : libseccomp (openSUSE-2019-2280)	Nessus	SuSE Local Security Checks	critical
129555	SUSE SLED15 / SLES15 Security Update : libseccomp (SUSE-SU-2019:2517-1)	Nessus	SuSE Local Security Checks	critical
129218	EulerOS 2.0 SP3 : libseccomp (EulerOS-SA-2019-2025)	Nessus	Huawei Local Security Checks	critical
128959	EulerOS Virtualization for ARM 64 3.0.2.0 : libseccomp (EulerOS-SA-2019-1956)	Nessus	Huawei Local Security Checks	critical
128908	EulerOS 2.0 SP2 : libseccomp (EulerOS-SA-2019-1856)	Nessus	Huawei Local Security Checks	critical
128086	EulerOS 2.0 SP5 : libseccomp (EulerOS-SA-2019-1794)	Nessus	Huawei Local Security Checks	critical
126376	Photon OS 3.0: Libseccomp PHSA-2019-3.0-0009	Nessus	PhotonOS Local Security Checks	critical
125625	Ubuntu 14.04 LTS : libseccomp vulnerability (USN-4001-2)	Nessus	Ubuntu Local Security Checks	critical
125624	Ubuntu 16.04 LTS / 18.04 LTS : libseccomp vulnerability (USN-4001-1)	Nessus	Ubuntu Local Security Checks	critical
124865	Photon OS 1.0: Libseccomp PHSA-2019-1.0-0228	Nessus	PhotonOS Local Security Checks	critical
124131	GLSA-201904-18 : libseccomp: Privilege escalation	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2019-9893

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical