The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3843 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: NULL pointer dereference in af_netlink.c:__netlink_ns_capable() allows for denial of service     (CVE-2018-14646)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Christian Brauner for reporting this issue.

    Bug Fix(es):

    * Previously, the kernel architectures for IBM z Systems were missing support to display the status of the     Spectre v2 mitigations. As a consequence, the /sys/devices/system/cpu/vulnerabilities/spectre_v2 file did     not exist. With this update, the kernel now shows the status in the above mentioned file and as a result,     the file now reports either Vulnerable or Mitigation: execute trampolines message. (BZ#1636884)

    * Previously, under certain conditions, the page direct reclaim code was occasionally stuck in a loop when     waiting for the reclaim to finish. As a consequence, affected applications became unresponsive with no     progress possible. This update fixes the bug by modifying the page direct reclaim code to bound the     waiting time for the reclaim to finish. As a consequence, the affected applications no longer hang in the     described scenario. (BZ#1635132)

    * Previously, a packet was missing the User Datagram Protocol (UDP) payload checksum during a full     checksum computation, if the hardware checksum was not applied. As a consequence, a packet with an     incorrect checksum was dropped by a peer. With this update, the kernel includes the UDP payload checksum     during the full checksum computation. As a result, the checksum is computed correctly and the packet can     be received by the peer. (BZ#1635796)

    * Previously, on user setups running a mixed workload, the scheduler did not pick up tasks because the     runqueues were throttled for a long time. As a consequence, the system became partially unresponsive. To     fix this bug, the kernel now sets a flag in the cfs_bandwidth struct to secure better task distribution.
    As a result, the system no longer becomes unresponsive in the described scenario. (BZ#1640676)

    * Previously, clearing a CPU mask with the cgroups feature triggered the following warning:

        kernel: WARNING: CPU: 422 PID: 364940 at kernel/cpuset.c:955 update_cpumasks_hier+0x3af/0x410

    As a consequence, the user's log file was flooded with similar warning messages as above. This update     fixes the bug and the warning message no longer appears in the described scenario. (BZ#1644237)

    * Previously, a lot of CPU time was occasionally spent in the kernel during a teardown of a container with     a lot of memory assigned. As a consequence, an increased risk of CPU soft lockups could occur due to     higher latency of a CPU scheduler for other processes during the container teardown. To fix the problem,     the kernel now adds a reschedule to the tight kernel loop. As a result, the CPU scheduler latency is not     increased by the container teardown and there is not the increased risk of CPU soft lockups in the     described scenario. (BZ#1644672)

    * When a user created a VLAN device, the kernel set the wanted_features set of the VLAN to the current     features of the base device. As a consequence, when the base device got new features, the features were     not propagated to the VLAN device. This update fixes the bug and the VLAN device receives the new features     in the described scenario.

    Note that this only affects TCP Segmentation Offload (TSO). (BZ#1644674)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : kernel (RHSA-2018:3843)

medium Nessus Plugin ID 119758

Version 1.10

Version 1.9

Version 1.10 Nov 5, 2024, 12:50 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Reference Plugin Feed: 202411051250
Version 1.9 Jul 15, 2024, 7:53 AM CVSSv2 score source (set to "CVE-2018-14646") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202407150753