An update of the linux package has been released.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-3 advisory.

    It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating     and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-15265)

    Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict     adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys     in a negative state. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-15951)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-     bounds error when handling alternative settings. A physically proximate attacker could use to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate CDC     metadata. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16534)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.61-52_122 fixes several issues.
The following security issue was fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bsc#1064392)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0151 advisory.

  - kernel: local privesc in key management (CVE-2015-8539)

  - hw: cpu: speculative execution bounds-check bypass (CVE-2017-5753)

  - kernel: keyctl_set_reqkey_keyring() leaks thread keyrings (CVE-2017-7472)

  - kernel: NULL pointer dereference due to KEYCTL_READ on negative key (CVE-2017-12192)

  - kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation     (CVE-2017-12193)

  - kernel: Use-after-free in the af_packet.c (CVE-2017-15649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The openSUSE Leap 42.2 kernel was updated to 4.4.92 to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bnc#1064388).

The following non-security bugs were fixed :

  - alsa: au88x0: avoid theoretical uninitialized access     (bnc#1012382).

  - alsa: compress: Remove unused variable (bnc#1012382).

  - alsa: usb-audio: Check out-of-bounds access by corrupted     buffer descriptor (bnc#1012382).

  - alsa: usx2y: Suppress kernel warning at page allocation     failures (bnc#1012382).

  - arm: 8635/1: nommu: allow enabling REMAP_VECTORS_TO_RAM     (bnc#1012382).

  - arm: dts: r8a7790: Use R-Car Gen 2 fallback binding for     msiof nodes (bnc#1012382).

  - arm: remove duplicate 'const' annotations'     (bnc#1012382).

  - asoc: dapm: fix some pointer error handling     (bnc#1012382).

  - asoc: dapm: handle probe deferrals (bnc#1012382).

  - audit: log 32-bit socketcalls (bnc#1012382).

  - blacklist 0e7736c6b806 powerpc/powernv: Fix data type     for @r in pnv_ioda_parse_m64_window()

  - blacklist.conf: not fitting cleanup patch

  - brcmfmac: setup passive scan if requested by user-space     (bnc#1012382).

  - bridge: netlink: register netdevice before executing     changelink (bnc#1012382).

  - ceph: avoid panic in create_session_open_msg() if     utsname() returns NULL (bsc#1061451).

  - ceph: check negative offsets in ceph_llseek()     (bsc#1061451).

  - driver core: platform: Do not read past the end of     'driver_override' buffer (bnc#1012382).

  - drivers: firmware: psci: drop duplicate const from     psci_of_match (bnc#1012382).

  - drivers: hv: fcopy: restore correct transfer length     (bnc#1012382).

  - drm/amdkfd: fix improper return value on error     (bnc#1012382).

  - drm: bridge: add DT bindings for TI ths8135     (bnc#1012382).

  - drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR #define     (bnc#1012382).

  - drm/i915/bios: ignore HDMI on port A (bnc#1012382).

  - ext4: do not allow encrypted operations without keys     (bnc#1012382).

  - extcon: axp288: Use vbus-valid instead of -present to     determine cable presence (bnc#1012382).

  - exynos-gsc: Do not swap cb/cr for semi planar formats     (bnc#1012382).

  - fix whitespace according to upstream commit

  - fs/epoll: cache leftmost node (bsc#1056427).

  - ftrace: Fix kmemleak in unregister_ftrace_graph     (bnc#1012382).

  - gfs2: Fix reference to ERR_PTR in gfs2_glock_iter_next     (bnc#1012382).

  - hid: i2c-hid: allocate hid buffers for real worst case     (bnc#1012382).

  - hpsa: correct lun data caching bitmap definition     (bsc#1028971).

  - hwmon: (gl520sm) Fix overflows and crash seen when     writing into limit attributes (bnc#1012382).

  - i2c: meson: fix wrong variable usage in     meson_i2c_put_data (bnc#1012382).

  - i40e: Initialize 64-bit statistics TX ring seqcount     (bsc#969476 FATE#319648 bsc#969477 FATE#319816).

  - i40iw: Add missing memory barriers (bsc#969476     FATE#319648 bsc#969477 FATE#319816).

  - i40iw: Fix port number for query QP (bsc#969476     FATE#319648 bsc#969477 FATE#319816).

  - ib/core: Fix for core panic (bsc#1022595 FATE#322350).

  - ib/core: Fix the validations of a multicast LID in     attach or detach operations (bsc#1022595 FATE#322350).

  - ib/i40iw: Fix error code in i40iw_create_cq()     (bsc#969476 FATE#319648 bsc#969477 FATE#319816).

  - ib/ipoib: Fix deadlock over vlan_mutex (bnc#1012382).

  - ib/ipoib: Replace list_del of the neigh->list with     list_del_init (bnc#1012382).

  - ib/ipoib: rtnl_unlock can not come after free_netdev     (bnc#1012382).

  - ib/mlx5: Fix Raw Packet QP event handler assignment     (bsc#966170 FATE#320225 bsc#966172 FATE#320226).

  - ibmvnic: Set state UP (bsc#1062962).

  - ib/qib: fix false-postive maybe-uninitialized warning     (bnc#1012382).

  - igb: re-assign hw address pointer on reset after PCI     error (bnc#1012382).

  - iio: ad7793: Fix the serial interface reset     (bnc#1012382).

  - iio: adc: axp288: Drop bogus AXP288_ADC_TS_PIN_CTRL     register modifications (bnc#1012382).

  - iio: adc: hx711: Add DT binding for avia,hx711     (bnc#1012382).

  - iio: adc: mcp320x: Fix oops on module unload     (bnc#1012382).

  - iio: adc: mcp320x: Fix readout of negative voltages     (bnc#1012382).

  - iio: adc: twl4030: Disable the vusb3v1 rugulator in the     error handling path of 'twl4030_madc_probe()'     (bnc#1012382).

  - iio: adc: twl4030: Fix an error handling path in     'twl4030_madc_probe()' (bnc#1012382).

  - iio: ad_sigma_delta: Implement a dedicated reset     function (bnc#1012382).

  - iio: core: Return error for failed read_reg     (bnc#1012382).

  - iommu/io-pgtable-arm: Check for leaf entry before     dereferencing it (bnc#1012382).

  - iwlwifi: add workaround to disable wide channels in 5GHz     (bnc#1012382).

  - ixgbe: Fix incorrect bitwise operations of PTP Rx     timestamp flags (bsc#969474 FATE#319812 bsc#969475     FATE#319814).

  - kABI: protect struct rm_data_op (kabi).

  - kABI: protect struct sdio_func (kabi).

  - libata: transport: Remove circular dependency at free     time (bnc#1012382).

  - lsm: fix smack_inode_removexattr and xattr_getsecurity     memleak (bnc#1012382).

  - md/raid10: submit bio directly to replacement disk     (bnc#1012382).

  - mips: Ensure bss section ends on a long-aligned address     (bnc#1012382).

  - mips: Fix minimum alignment requirement of IRQ stack     (git-fixes).

  - mips: IRQ Stack: Unwind IRQ stack onto task stack     (bnc#1012382).

  - mips: Lantiq: Fix another request_mem_region() return     code check (bnc#1012382).

  - mips: ralink: Fix incorrect assignment on ralink_soc     (bnc#1012382).

  - mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms     array (bsc#966170 FATE#320225 bsc#966172 FATE#320226).

  - mm/backing-dev.c: fix an error handling path in     'cgwb_create()' (bnc#1063475).

  - mm,compaction: serialize waitqueue_active() checks (for     real) (bsc#971975).

  - mmc: sdio: fix alignment issue in struct sdio_func     (bnc#1012382).

  - mm: discard memblock data later (bnc#1063460).

  - mm/memblock.c: reversed logic in memblock_discard()     (bnc#1063460).

  - mm: meminit: mark init_reserved_page as __meminit     (bnc#1063509).

  - mm/memory_hotplug: change     pfn_to_section_nr/section_nr_to_pfn macro to inline     function (bnc#1063501).

  - mm/memory_hotplug: define     find_(smallest|biggest)_section_pfn as unsigned long     (bnc#1063520).

  - net: core: Prevent from dereferencing NULL pointer when     releasing SKB (bnc#1012382).

  - netfilter: invoke synchronize_rcu after set the _hook_     to NULL (bnc#1012382).

  - netfilter: nfnl_cthelper: fix incorrect     helper->expect_class_max (bnc#1012382).

  - net/mlx4_core: Enable 4K UAR if SRIOV module parameter     is not enabled (bsc#966191 FATE#320230 bsc#966186     FATE#320228).

  - net/mlx5e: Fix wrong delay calculation for overflow     check scheduling (bsc#966170 FATE#320225 bsc#966172     FATE#320226).

  - net/mlx5e: Schedule overflow check work to mlx5e     workqueue (bsc#966170 FATE#320225 bsc#966172     FATE#320226).

  - net/mlx5: Skip mlx5_unload_one if mlx5_load_one fails     (bsc#966170 FATE#320225 bsc#966172 FATE#320226).

  - net/packet: check length in getsockopt() called with     PACKET_HDRLEN (bnc#1012382).

  - nvme: protect against simultaneous shutdown invocations     (FATE#319965 bnc#1012382 bsc#964944).

  - parisc: perf: Fix potential NULL pointer dereference     (bnc#1012382).

  - partitions/efi: Fix integer overflow in GPT size     calculation (bnc#1012382).

  - qed: Fix stack corruption on probe (bsc#966318     FATE#320158 bsc#966316 FATE#320159).

  - rds: ib: add error handle (bnc#1012382).

  - rds: RDMA: Fix the composite message user notification     (bnc#1012382).

  - README.BRANCH: Add Michal and Johannes as     co-maintainers.

  - sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs     (bnc#1012382).

  - scsi: hpsa: add 'ctlr_num' sysfs attribute     (bsc#1028971).

  - scsi: hpsa: bump driver version (bsc#1022600     fate#321928).

  - scsi: hpsa: change driver version (bsc#1022600     bsc#1028971 fate#321928).

  - scsi: hpsa: Check for null device pointers     (bsc#1028971).

  - scsi: hpsa: Check for null devices in ioaccel     (bsc#1028971).

  - scsi: hpsa: Check for vpd support before sending     (bsc#1028971).

  - scsi: hpsa: cleanup reset handler (bsc#1022600     fate#321928).

  - scsi: hpsa: correct call to hpsa_do_reset (bsc#1028971).

  - scsi: hpsa: correct logical resets (bsc#1028971).

  - scsi: hpsa: correct queue depth for externals     (bsc#1022600 fate#321928).

  - scsi: hpsa: correct resets on retried commands     (bsc#1022600 fate#321928).

  - scsi: hpsa: correct scsi 6byte lba calculation     (bsc#1028971).

  - scsi: hpsa: Determine device external status earlier     (bsc#1028971).

  - scsi: hpsa: do not get enclosure info for external     devices (bsc#1022600 fate#321928).

  - scsi: hpsa: do not reset enclosures (bsc#1022600     fate#321928).

  - scsi: hpsa: do not timeout reset operations (bsc#1022600     bsc#1028971 fate#321928).

  - scsi: hpsa: fallback to use legacy REPORT PHYS command     (bsc#1028971).

  - scsi: hpsa: fix volume offline state (bsc#1022600     bsc#1028971 fate#321928).

  - scsi: hpsa: limit outstanding rescans (bsc#1022600     bsc#1028971 fate#321928).

  - scsi: hpsa: Prevent sending bmic commands to externals     (bsc#1028971).

  - scsi: hpsa: remove abort handler (bsc#1022600     fate#321928).

  - scsi: hpsa: remove coalescing settings for ioaccel2     (bsc#1028971).

  - scsi: hpsa: remove memory allocate failure message     (bsc#1028971).

  - scsi: hpsa: Remove unneeded void pointer cast     (bsc#1028971).

  - scsi: hpsa: rescan later if reset in progress     (bsc#1022600 fate#321928).

  - scsi: hpsa: send ioaccel requests with 0 length down     raid path (bsc#1022600 fate#321928).

  - scsi: hpsa: separate monitor events from rescan worker     (bsc#1022600 fate#321928).

  - scsi: hpsa: update check for logical volume status     (bsc#1022600 bsc#1028971 fate#321928).

  - scsi: hpsa: update identify physical device structure     (bsc#1022600 fate#321928).

  - scsi: hpsa: update pci ids (bsc#1022600 bsc#1028971     fate#321928).

  - scsi: hpsa: update reset handler (bsc#1022600     fate#321928).

  - scsi: hpsa: use designated initializers (bsc#1028971).

  - scsi: hpsa: use %phN for short hex dumps (bsc#1028971).

  - scsi: libfc: fix a deadlock in fc_rport_work     (bsc#1063695).

  - scsi: sd: Do not override max_sectors_kb sysfs setting     (bsc#1025461).

  - scsi: sd: Remove LBPRZ dependency for discards     (bsc#1060985). This patch is originally part of a larger     series which can't be easily backported to SLE-12. For a     reasoning why we think it's safe to apply, see     bsc#1060985, comment 20.

  - scsi: sg: close race condition in     sg_remove_sfp_usercontext() (bsc#1064206).

  - sh_eth: use correct name for ECMR_MPDE bit     (bnc#1012382).

  - staging: iio: ad7192: Fix - use the dedicated reset     function avoiding dma from stack (bnc#1012382).

  - stm class: Fix a use-after-free (bnc#1012382).

  - supported.conf: mark hid-multitouch as supported     (FATE#323670)

  - team: call netdev_change_features out of team lock     (bsc#1055567).

  - team: fix memory leaks (bnc#1012382).

  - tpm_tis: Do not fall back to a hardcoded address for     TPM2 (bsc#1020645, fate#321435, fate#321507,     fate#321600, bsc#1034048).

  - ttpci: address stringop overflow warning (bnc#1012382).

  - tty: goldfish: Fix a parameter of a call to free_irq     (bnc#1012382).

  - usb: chipidea: vbus event may exist before starting     gadget (bnc#1012382).

  - usb: core: harden cdc_parse_cdc_header (bnc#1012382).

  - usb: devio: Do not corrupt user memory (bnc#1012382).

  - usb: dummy-hcd: fix connection failures (wrong speed)     (bnc#1012382).

  - usb: dummy-hcd: Fix erroneous synchronization change     (bnc#1012382).

  - usb: dummy-hcd: fix infinite-loop resubmission bug     (bnc#1012382).

  - usb: fix out-of-bounds in usb_set_configuration     (bnc#1012382).

  - usb: gadgetfs: fix copy_to_user while holding spinlock     (bnc#1012382).

  - usb: gadgetfs: Fix crash caused by inadequate     synchronization (bnc#1012382).

  - usb: gadget: inode.c: fix unbalanced spin_lock in     ep0_write (bnc#1012382).

  - usb: gadget: mass_storage: set msg_registered after msg     registered (bnc#1012382).

  - usb: gadget: udc: atmel: set vbus irqflags explicitly     (bnc#1012382).

  - usb: g_mass_storage: Fix deadlock when driver is unbound     (bnc#1012382).

  - usb: Increase quirk delay for USB devices (bnc#1012382).

  - usb: pci-quirks.c: Corrected timeout values used in     handshake (bnc#1012382).

  - usb: plusb: Add support for PL-27A1 (bnc#1012382).

  - usb: renesas_usbhs: fix the BCLR setting condition for     non-DCP pipe (bnc#1012382).

  - usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX     direction (bnc#1012382).

  - usb: serial: mos7720: fix control-message error handling     (bnc#1012382).

  - usb: serial: mos7840: fix control-message error handling     (bnc#1012382).

  - usb-storage: unusual_devs entry to fix write-access     regression for Seagate external drives (bnc#1012382).

  - usb: uas: fix bug in handling of alternate settings     (bnc#1012382).

  - uwb: ensure that endpoint is interrupt (bnc#1012382).

  - uwb: properly check kthread_run return value     (bnc#1012382).

  - xfs: handle error if xfs_btree_get_bufs fails     (bsc#1059863).

  - xfs: remove kmem_zalloc_greedy (bnc#1012382).

  - xhci: fix finding correct bus_state structure for USB     3.1 hosts (bnc#1012382).

This update for the Linux Kernel 3.12.61-52_80 fixes several issues.
The following security issues were fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bsc#1064392)

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bsc#1063671, bsc#1066472, bsc#1066471)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_60 fixes several issues.
The following security issues were fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bsc#1064392)

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bsc#1063671, bsc#1066472, bsc#1066471)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_77 fixes several issues.
The following security issues were fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bsc#1064392)

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bsc#1063671, bsc#1066472, bsc#1066471)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.74-60_64_45 fixes several issues. The following security issues were fixed :

  - CVE-2017-15649: net/packet/af_packet.c in the Linux     kernel allowed local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free, a different vulnerability     than CVE-2017-6346 (bsc#1064392)

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bsc#1063671, bsc#1066472, bsc#1066471)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - mm, thp: Do not make page table dirty unconditionally in     follow_trans_huge_pmd (Kirill A. Shutemov) [Orabug:
    27200879] (CVE-2017-1000405)

  - NFS: Add static NFS I/O tracepoints (Chuck Lever)

  - storvsc: don't assume SG list is contiguous (Aruna     Ramakrishna) 

  - fix unbalanced page refcounting in bio_map_user_iov     (Vitaly Mayatskikh) [Orabug: 27069038] (CVE-2017-12190)

  - more bio_map_user_iov leak fixes (Al Viro) [Orabug:
    27069038] (CVE-2017-12190)

  - packet: in packet_do_bind, test fanout with bind_lock     held (Willem de Bruijn) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: hold bind lock when rebinding to fanout hook     (Willem de Bruijn) [Orabug: 27069065] (CVE-2017-15649)

  - net: convert packet_fanout.sk_ref from atomic_t to     refcount_t (Reshetova, Elena) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: fix races in fanout_add (Eric Dumazet) [Orabug:
    27069065] (CVE-2017-15649)

  - refcount_t: Introduce a special purpose refcount type     (Peter Zijlstra) [Orabug: 27069065] (CVE-2017-15649)

  - locking/atomics: Add _[acquire|release|relaxed] variants     of some atomic operations (Will Deacon) [Orabug:
    27069065] (CVE-2017-15649)

  - net: qmi_wwan: fix divide by 0 on bad descriptors     (Bj&oslash rn Mork) [Orabug: 27215225] (CVE-2017-16650)

  - ALSA: usb-audio: Kill stray URB at exiting (Takashi     Iwai) [Orabug: 27148276] (CVE-2017-16527)

  - scsi: Add STARGET_CREATED_REMOVE state to     scsi_target_state (Ewan D. Milne) [Orabug: 27187217]

  - ocfs2: fix posix_acl_create deadlock (Junxiao Bi)     [Orabug: 27126129]

  - scsi: Don't abort scsi_scan due to unexpected response     (John Sobecki) 

  - ocfs2: code clean up for direct io (Ryan Ding)

  - xscore: add dma address check (Zhu Yanjun) [Orabug:
    27076919]

  - KVM: nVMX: Fix loss of L2's NMI blocking state (Wanpeng     Li) [Orabug: 27062498]

  - KVM: nVMX: track NMI blocking state separately for each     VMCS (Paolo Bonzini) [Orabug: 27062498]

  - KVM: VMX: require virtual NMI support (Paolo Bonzini)     [Orabug: 27062498]

  - KVM: nVMX: Fix the NMI IDT-vectoring handling (Wanpeng     Li) [Orabug: 27062498]

  - uek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED     (Fred Herard) 

  - thp: run vma_adjust_trans_huge outside i_mmap_rwsem     (Kirill A. Shutemov) [Orabug: 27026180]

  - selinux: fix off-by-one in setprocattr (Stephen Smalley)     [Orabug: 27001717] (CVE-2017-2618) (CVE-2017-2618)     (CVE-2017-2618)

  - sysctl: Drop reference added by grab_header in     proc_sys_readdir (Zhou Chengming) [Orabug: 27036903]     (CVE-2016-9191) (CVE-2016-9191) (CVE-2016-9191)

  - KEYS: prevent KEYCTL_READ on negative key (Eric Biggers)     [Orabug: 27050248] (CVE-2017-12192)

  - IB/ipoib: For sendonly join free the multicast group on     leave (Christoph Lameter) [Orabug: 27077718]

  - IB/ipoib: increase the max mcast backlog queue (Doug     Ledford) 

  - IB/ipoib: Make sendonly multicast joins create the mcast     group (Doug Ledford) [Orabug: 27077718]

  - IB/ipoib: Expire sendonly multicast joins (Christoph     Lameter) 

  - IB/ipoib: Suppress warning for send only join failures     (Jason Gunthorpe) [Orabug: 27077718]

  - IB/ipoib: Clean up send-only multicast joins (Doug     Ledford) [Orabug: 27077718]

  - netlink: allow to listen 'all' netns (Nicolas Dichtel)     [Orabug: 27077944]

  - netlink: rename private flags and states (Nicolas     Dichtel) [Orabug: 27077944]

  - netns: use a spin_lock to protect nsid management     (Nicolas Dichtel) 

  - netns: notify new nsid outside __peernet2id (Nicolas     Dichtel) 

  - netns: rename peernet2id to peernet2id_alloc (Nicolas     Dichtel) 

  - netns: always provide the id to rtnl_net_fill (Nicolas     Dichtel) 

  - netns: returns always an id in __peernet2id (Nicolas     Dichtel) 

  - Hang/soft lockup in d_invalidate with simultaneous calls     (Al Viro) 

  - Revert 'drivers/char/mem.c: deny access in open     operation when securelevel is set' (Brian Maly) [Orabug:
    27037811]

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5,     when nested virtualisation is used, does not properly     traverse guest pagetable entries to resolve a guest     virtual address, which allows L1 guest OS users to     execute arbitrary code on the host OS or cause a denial     of service (incorrect index during page walking, and     host OS crash), aka an MMU potential stack buffer     overrun.(CVE-2017-12188)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - security/keys/keyctl.c in the Linux kernel before     4.11.5 does not consider the case of a NULL payload in     conjunction with a nonzero length value, which allows     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192.(CVE-2017-15274)

  - Linux kernel: heap out-of-bounds in AF_PACKET sockets.
    This new issue is analogous to previously disclosed     CVE-2016-8655. In both cases, a socket option that     changes socket state may race with safety checks in     packet_set_ring. Previously with PACKET_VERSION. This     time with PACKET_RESERVE. The solution is similar: lock     the socket for the update. This issue may be     exploitable, we did not investigate further. As this     issue affects PF_PACKET sockets, it requires     CAP_NET_RAW in the process namespace. But note that     with user namespaces enabled, any process can create a     namespace in which it has     CAP_NET_RAW.(CVE-2017-1000111)

  - Use-after-free vulnerability in the Linux kernel before     4.14-rc5 allows local users to have unspecified impact     via vectors related to /dev/snd/seq.(CVE-2017-15265)

  - net/packet/af_packet.c in the Linux kernel before     4.13.6 allows local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free, a different     vulnerability than CVE-2017-6346.(CVE-2017-15649)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel     heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0.(CVE-2017-14991)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact.

In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided.

* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)

* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)

* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
(CVE-2017-5754, Important)

Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754.

This update also fixes the following security issues and bugs :

Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article:
https://access.redhat.com/articles/ 3327131.

ID	Name	Product	Family	Published	Updated	Severity
121752	Photon OS 1.0: Linux PHSA-2017-0042	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	high
104735	Ubuntu 14.04 LTS : Linux kernel (AWS) vulnerabilities (USN-3485-3)	Nessus	Ubuntu Local Security Checks	11/22/2017	8/27/2024	high
108511	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0664-1)	Nessus	SuSE Local Security Checks	3/21/2018	12/19/2024	high
106330	RHEL 7 : kernel (RHSA-2018:0151)	Nessus	Red Hat Local Security Checks	1/25/2018	4/27/2024	high
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	4/19/2018	10/30/2024	high
104246	openSUSE Security Update : the Linux Kernel (openSUSE-2017-1224) (KRACK)	Nessus	SuSE Local Security Checks	10/30/2017	1/19/2021	high
104805	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3103-1) (KRACK)	Nessus	SuSE Local Security Checks	11/28/2017	1/6/2021	high
104871	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3117-1) (KRACK)	Nessus	SuSE Local Security Checks	11/30/2017	1/6/2021	high
104953	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3146-1) (KRACK)	Nessus	SuSE Local Security Checks	12/1/2017	1/6/2021	high
104960	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3153-1) (KRACK)	Nessus	SuSE Local Security Checks	12/1/2017	1/6/2021	high
105146	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0172) (Dirty COW)	Nessus	OracleVM Local Security Checks	12/11/2017	1/4/2021	high
104296	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1271)	Nessus	Huawei Local Security Checks	11/1/2017	1/6/2021	high
106353	CentOS 7 : kernel (CESA-2018:0151) (Meltdown) (Spectre)	Nessus	CentOS Local Security Checks	1/26/2018	12/31/2019	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high

high

high

high