OracleVM 3.4 : kernel-uek (OVMSA-2024-0016)

high Nessus Plugin ID 212214

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address security updates:

[4.1.12-124.92.3]- memcg_write_event_control(): fix a user-triggerable oops (Al Viro) [Orabug: 37070674] {CVE-2024-45021}- ocfs2: fix races between hole punching and AIO+DIO (Su Yue) [Orabug: 36835819] {CVE-2024-40943}[4.1.12-124.92.2]- fbdev: savage: Handle err return when savagefb_check_var failed (Cai Xinchen) [Orabug: 36984058] {CVE-2024-39475}- bnx2x: Fix multiple UBSAN array-index-out-of-bounds (Ghadi Elie Rahme) [Orabug: 36897888] {CVE-2024-42148}- vmci: prevent speculation leaks by sanitizing event in event_deliver() (Hagar Gamal Halim Hemdan) [Orabug: 36835584] {CVE-2024-39499}- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts (Chun-Yi Lee) [Orabug: 36544953] {CVE-2024-26898}[4.1.12-124.92.1]- Input: MT - limit max slots (Tetsuo Handa) [Orabug: 37029139] {CVE-2024-45008}- drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes (Ma Ke) [Orabug: 36897642] {CVE-2024-42101}- wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (Remi Pommarel) [Orabug: 36835737] {CVE-2024-40912}- USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (Alan Stern) [Orabug: 36835711] {CVE-2024-40904}- bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (Sam Sun) [Orabug: 36825250] {CVE-2024-39487}- jffs2: prevent xattr node from overflowing the eraseblock (Ilya Denisyev) [Orabug: 36753653] {CVE-2024-38599}- scsi: bfa:
Ensure the copied buf is NUL terminated (Bui Quang Minh) [Orabug: 36753475] {CVE-2024-38560}- ALSA: usb- audio: Stop parsing channels bits when all channels are found. (Johan Carlsson) [Orabug: 36642150] {CVE-2024-27436}- USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Alan Stern) [Orabug:
36598221] {CVE-2024-27059}- fat: fix uninitialized field in nostale filehandles (Jan Kara) [Orabug:
36597870] {CVE-2024-26973}- ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Armin Wolf) [Orabug: 36544941] {CVE-2024-26894}

Tenable has extracted the preceding description block directly from the OracleVM security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected kernel-uek / kernel-uek-firmware packages.

Plugin Details

Severity: High

ID: 212214

File Name: oraclevm_OVMSA-2024-0016.nasl

Version: 1.1

Type: local

Family: OracleVM Local Security Checks

Published: 12/10/2024

Updated: 12/10/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-42148

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:oracle:vm_server:3.4, p-cpe:/a:oracle:vm:kernel-uek, p-cpe:/a:oracle:vm:kernel-uek-firmware

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 12/3/2024

Vulnerability Publication Date: 4/17/2024

Reference Information

CVE: CVE-2024-26894, CVE-2024-26898, CVE-2024-26973, CVE-2024-27059, CVE-2024-27436, CVE-2024-38560, CVE-2024-38599, CVE-2024-39475, CVE-2024-39487, CVE-2024-39499, CVE-2024-40904, CVE-2024-40912, CVE-2024-40943, CVE-2024-42101, CVE-2024-42148, CVE-2024-45008, CVE-2024-45021

Detections

Analytics