RHEL 7 : kernel-rt (RHSA-2018:0676)

critical Nessus Plugin ID 108984

Language:

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0676 advisory.

- kernel: unlimiting the stack disables ASLR (CVE-2016-3672)

- kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913)

- kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633)

- kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294)

- kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)

- kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725)

- Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154)

- kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190)

- kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166)

- kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker (CVE-2017-13305)

- kernel: Missing permission check in move_pages system call (CVE-2017-14140)

- kernel: Null pointer dereference in rngapi_reset function (CVE-2017-15116)

- kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121)

- kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126)

- kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c (CVE-2017-15127)

- kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129)

- kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265)

- kernel: dereferencing NULL payload with nonzero length (CVE-2017-15274)

- kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448)

- kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449)

- kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558)

- kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017)

- kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203)

- kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252)

- Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407)

- kernel: Stack information leak in the EFS element (CVE-2017-1000410)

- kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750)

- kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact (CVE-2018-6927)

- kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 108984

File Name: redhat-RHSA-2018-0676.nasl

Version: 1.14

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 4/11/2018

Updated: 4/27/2024

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2017-18017

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:kernel-rt, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-debug-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-rt-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-doc, p-cpe:/a:redhat:enterprise_linux:kernel-rt-kvm, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-devel, p-cpe:/a:redhat:enterprise_linux:kernel-rt-trace-kvm, cpe:/o:redhat:enterprise_linux:7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/10/2018

Vulnerability Publication Date: 4/27/2016

Reference Information

CVE: CVE-2016-3672, CVE-2016-7913, CVE-2016-8633, CVE-2017-1000252, CVE-2017-1000407, CVE-2017-1000410, CVE-2017-12154, CVE-2017-12190, CVE-2017-13166, CVE-2017-13305, CVE-2017-14140, CVE-2017-15116, CVE-2017-15121, CVE-2017-15126, CVE-2017-15127, CVE-2017-15129, CVE-2017-15265, CVE-2017-15274, CVE-2017-17448, CVE-2017-17449, CVE-2017-17558, CVE-2017-18017, CVE-2017-18203, CVE-2017-7294, CVE-2017-8824, CVE-2017-9725, CVE-2018-1000004, CVE-2018-5750, CVE-2018-6927

CWE: 119, 125, 190, 20, 200, 248, 266, 284, 341, 362, 400, 416, 460, 476, 617, 681, 787, 863

RHSA: 2018:0676

Detections

Analytics