The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

    Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta     block groups. An attacker with physical access could use this to specially craft an ext4 image that causes     a denial of service (system crash). (CVE-2016-10208)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a buffer overflow existed in the ACPI table parsing implementation in the Linux     kernel. A local attacker could use this to construct a malicious ACPI table that, when loaded, caused a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-11473)

    It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data     returned to user space in some situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14991)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    It was discovered that the DM04/QQBOX USB driver in the Linux kernel did not properly handle device     attachment and warm-start. A physically proximate attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16538)

    Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16643)

    Andrey Konovalov discovered that the video4linux driver for Hauppauge HD PVR USB devices in the Linux     kernel did not properly handle some error conditions. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16644)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18255)

    It was discovered that the keyring subsystem in the Linux kernel did not properly prevent a user from     creating keyrings for other users. A local attacker could use this cause a denial of service or expose     sensitive information. (CVE-2017-18270)

    Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not     properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine     could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in     the guest OS. (CVE-2017-2583)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel improperly emulated certain     instructions. A local attacker could use this to obtain sensitive information (kernel memory).
    (CVE-2017-2584)

    It was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in the Linux kernel did not     properly initialize memory related to logging. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2017-5549)

    Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE)     tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive     information. (CVE-2017-5897)

    Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor     in certain situations. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-6345)

    Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local     attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Pengfei Wang discovered that a race condition existed in the NXP SAA7164 TV Decoder driver for the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8831)

    Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained     race conditions when fetching from the ring-buffer. A local attacker could use this to cause a denial of     service (infinite loop). (CVE-2017-9984, CVE-2017-9985)

    It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments     in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10087)

    It was discovered that the kill() system call implementation in the Linux kernel did not properly validate     its arguments in some situations. A local attacker could possibly use this to cause a denial of service.
    (CVE-2018-10124)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly validate     meta-data information. An attacker could use this to construct a malicious xfs image that, when mounted,     could cause a denial of service (system crash). (CVE-2018-10323)

    Zhong Jiang discovered that a use-after-free vulnerability existed in the NUMA memory policy     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-10675)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1092)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle     corrupted meta data in some situations. An attacker could use this to specially craft an ext4 filesystem     that caused a denial of service (system crash) when mounted. (CVE-2018-1093)

    It was discovered that the cdrom driver in the Linux kernel contained an incorrect bounds check. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-10940)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local     attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204)

    It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion).
    (CVE-2018-10021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.69-60_64_29 fixes several issues. The following security bugs were fixed :

  - CVE-2017-7533: A bug in inotify code allowed local users     to escalate privilege (bsc#1050751).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191).

  - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (double free) by setting     the HDLC line discipline (bsc#1027575).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bsc#1042892).

  - CVE-2017-8890: The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allowed attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call (bsc#1038564).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_57 fixes several issues.
The following security bugs were fixed :

  - CVE-2017-7533: A bug in inotify code allowed local users     to escalate privilege (bsc#1050751).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191).

  - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (double free) by setting     the HDLC line discipline (bsc#1027575).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bsc#1042892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1647 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were adjacent to each other, an attacker could use this     flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1 MiB to make successful exploitation of this issue     more difficult. (CVE-2017-1000364, Important)

    * The NFS2/3 RPC client could send long arguments to the NFS server. These encoded arguments are stored in     an array of memory pages, and accessed using pointer variables. Arbitrarily long arguments could make     these pointers point outside the array and cause an out-of-bounds memory access. A remote user or program     could use this flaw to crash the kernel, resulting in denial of service. (CVE-2017-7645, Important)

    * The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lacked certain checks for     the end of a buffer. A remote attacker could trigger a pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895, Important)

    * A flaw was found in the Linux kernel's handling of packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could allow a remote attacker to force the kernel to enter a     condition in which it could loop indefinitely. (CVE-2017-6214, Moderate)

    Red Hat would like to thank Qualys Research Labs for reporting CVE-2017-1000364 and Ari Kauppi for     reporting CVE-2017-7895.

    Bug Fix(es):

    * kernel-rt packages have been upgraded to the 3.10.0-514 source tree, which provides a number of bug     fixes over the previous version. (BZ#1452745)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3361-1 advisory.

    USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04     LTS. Please note that this update changes the Linux HWE kernel to the 4.10 based kernel from Ubuntu 17.04,     superseding the 4.8 based HWE kernel from Ubuntu 16.10.

    Ben Harris discovered that the Linux kernel would strip extended privilege attributes of files when     performing a failed unprivileged system call. A local attacker could use this to cause a denial of     service. (CVE-2015-1350)

    Ralf Spenneberg discovered that the ext4 implementation in the Linux kernel did not properly validate meta     block groups. An attacker with physical access could use this to specially craft an ext4 image that causes     a denial of service (system crash). (CVE-2016-10208)

    Peter Pi discovered that the colormap handling for frame buffer devices in the Linux kernel contained an     integer overflow. A local attacker could use this to disclose sensitive information (kernel memory).
    (CVE-2016-8405)

    It was discovered that an integer overflow existed in the InfiniBand RDMA over ethernet (RXE) transport     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-8636)

    Vlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO PCI driver for the Linux kernel.
    A local attacker with access to a vfio PCI device file could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)

    CAI Qian discovered that the sysctl implementation in the Linux kernel did not properly perform reference     counting in some situations. An unprivileged attacker could use this to cause a denial of service (system     hang). (CVE-2016-9191)

    It was discovered that the keyring implementation in the Linux kernel in some situations did not prevent     special internal keyrings from being joined by userspace keyrings. A privileged local attacker could use     this to bypass module verification. (CVE-2016-9604)

    Dmitry Vyukov, Andrey Konovalov, Florian Westphal, and Eric Dumazet discovered that the netfiler subsystem     in the Linux kernel mishandled IPv6 packet reassembly. A local user could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2016-9755)

    Andy Lutomirski and Willy Tarreau discovered that the KVM implementation in the Linux kernel did not     properly emulate instructions on the SS segment register. A local attacker in a guest virtual machine     could use this to cause a denial of service (guest OS crash) or possibly gain administrative privileges in     the guest OS. (CVE-2017-2583)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel improperly emulated certain     instructions. A local attacker could use this to obtain sensitive information (kernel memory).
    (CVE-2017-2584)

    Dmitry Vyukov discovered that KVM implementation in the Linux kernel improperly emulated the VMXON     instruction. A local attacker in a guest OS could use this to cause a denial of service (memory     consumption) in the host OS. (CVE-2017-2596)

    It was discovered that SELinux in the Linux kernel did not properly handle empty writes to /proc/pid/attr.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2017-2618)

    Daniel Jiang discovered that a race condition existed in the ipv4 ping socket implementation in the Linux     kernel. A local privileged attacker could use this to cause a denial of service (system crash).
    (CVE-2017-2671)

    It was discovered that the freelist-randomization in the SLAB memory allocator allowed duplicate freelist     entries. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-5546)

    It was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in the Linux kernel did not     properly initialize memory related to logging. A local attacker could use this to expose sensitive     information (kernel memory). (CVE-2017-5549)

    It was discovered that a fencepost error existed in the pipe_advance() function in the Linux kernel. A     local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-5550)

    It was discovered that the Linux kernel did not clear the setgid bit during a setxattr call on a tmpfs     filesystem. A local attacker could use this to gain elevated group privileges. (CVE-2017-5551)

    Murray McAllister discovered that an integer overflow existed in the VideoCore DRM driver of the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-5576)

    Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping     page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)

    Andrey Konovalov discovered an out-of-bounds access in the IPv6 Generic Routing Encapsulation (GRE)     tunneling implementation in the Linux kernel. An attacker could use this to possibly expose sensitive     information. (CVE-2017-5897)

    Andrey Konovalov discovered that the IPv4 implementation in the Linux kernel did not properly handle     invalid IP options in some situations. An attacker could use this to cause a denial of service or possibly     execute arbitrary code. (CVE-2017-5970)

    Di Shen discovered that a race condition existed in the perf subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service or possibly gain administrative privileges.
    (CVE-2017-6001)

    Dmitry Vyukov discovered that the Linux kernel did not properly handle TCP packets with the URG flag. A     remote attacker could use this to cause a denial of service. (CVE-2017-6214)

    Andrey Konovalov discovered that the LLC subsytem in the Linux kernel did not properly set up a destructor     in certain situations. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-6345)

    It was discovered that a race condition existed in the AF_PACKET handling code in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-6346)

    Andrey Konovalov discovered that the IP layer in the Linux kernel made improper assumptions about internal     data layout when performing checksums. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-6347)

    Dmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem in the Linux kernel. A local     attacker could use this to cause a denial of service (deadlock). (CVE-2017-6348)

    Dmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux kernel contained a stack-based     buffer overflow. A local attacker with access to an sg device could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-7187)

    It was discovered that a NULL pointer dereference existed in the Direct Rendering Manager (DRM) driver for     VMWare devices in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-7261)

    It was discovered that the USB Cypress HID drivers for the Linux kernel did not properly validate reported     information from the device. An attacker with physical access could use this to expose sensitive     information (kernel memory). (CVE-2017-7273)

    Eric Biggers discovered a memory leak in the keyring implementation in the Linux kernel. A local attacker     could use this to cause a denial of service (memory consumption). (CVE-2017-7472)

    It was discovered that an information leak existed in the set_mempolicy and mbind compat syscalls in the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory).
    (CVE-2017-7616)

    Sabrina Dubroca discovered that the asynchronous cryptographic hash (ahash) implementation in the Linux     kernel did not properly handle a full request queue. A local attacker could use this to cause a denial of     service (infinite recursion). (CVE-2017-7618)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly handle certain long RPC replies. A remote attacker could use this to cause a     denial of service (system crash). (CVE-2017-7645)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Tuomas Haanp and Ari Kauppi discovered that the NFSv2 and NFSv3 server implementations in the Linux     kernel did not properly check for the end of buffer. A remote attacker could use this to craft requests     that cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-7895)

    It was discovered that an integer underflow existed in the Edgeport USB Serial Converter device driver of     the Linux kernel. An attacker with physical access could use this to expose sensitive information (kernel     memory). (CVE-2017-8924)

    It was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux kernel did not properly perform     reference counting. A local attacker could use this to cause a denial of service (tty exhaustion).
    (CVE-2017-8925)

    Jann Horn discovered that bpf in Linux kernel does not restrict the output of the print_bpf_insn function.
    A local attacker could use this to obtain sensitive address information. (CVE-2017-9150)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 4.10.13 stable kernel update contains a number of important fixes across the tree.

----

The 4.10.12 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1319 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, x86 32-bit)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)

    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)

    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166)

    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754; Nick Peterson (Everdox Tech     LLC) and Andy Lutomirski for reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and     Armis Labs for reporting CVE-2017-1000410.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these     bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3431591

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.60-52_60 fixes several issues.
The following security bugs were fixed :

  - CVE-2017-7533: A bug in inotify code allowed local users     to escalate privilege (bsc#1050751).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191).

  - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (double free) by setting     the HDLC line discipline (bsc#1027575).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bsc#1042892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.60-52_63 fixes several issues.
The following security bugs were fixed :

  - CVE-2017-7533: A bug in inotify code allowed local users     to escalate privilege (bsc#1050751).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191).

  - CVE-2017-2636: Race condition in drivers/tty/n_hdlc.c in     the Linux kernel allowed local users to gain privileges     or cause a denial of service (double free) by setting     the HDLC line discipline (bsc#1027575).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bsc#1042892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_83 fixes several issues.
The following security bugs were fixed :

  - CVE-2017-1000112: Prevent a race condition in net-packet     code that could have been exploited by unprivileged     users to gain root access (bsc#1052368).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply (bsc#1046191).

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel was too late     in checking whether an overwrite of an skb data     structure may occur, which allowed local users to cause     a denial of service (system crash) via crafted system     calls (bsc#1042892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_69 fixes several issues.
The following security bugs were fixed :

  - CVE-2017-7533: A bug in inotify code allowed local users     to escalate privilege (bsc#1050751).

  - CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd     subsystem in the Linux kernel allowed remote attackers     to cause a denial of service (system crash) via a long     RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c (bsc#1046191).

  - A SUSE Linux Enterprise specific regression in tearing     down network namespaces was fixed (bsc#1044878)

  - CVE-2017-9242: The __ip6_append_data function in     net/ipv6/ip6_output.c in the Linux kernel is too late in     checking whether an overwrite of an skb data structure     may occur, which allowed local users to cause a denial     of service (system crash) via crafted system calls     (bsc#1042892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1319 advisory.

    - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
    - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562]     {CVE-2017-5754}
    - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long)     [1553283 1550599] {CVE-2017-5754}
    - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283     1550599] {CVE-2017-5754}
    - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long)     [1553283 1550599] {CVE-2017-5754}
    - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283     1550599] {CVE-2017-5754}
    - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
    - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
    - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432]     {CVE-2017-13166}
    - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432]     {CVE-2017-13166}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091]     {CVE-2017-18017}
    - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089     1543091] {CVE-2017-18017}
    - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091]     {CVE-2017-18017}
    - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	8/24/2018	8/27/2024	critical
102219	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2049-1)	Nessus	SuSE Local Security Checks	8/7/2017	1/6/2021	high
102317	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2099-1)	Nessus	SuSE Local Security Checks	8/9/2017	1/6/2021	high
101103	RHEL 6 : kernel-rt (RHSA-2017:1647)	Nessus	Red Hat Local Security Checks	6/29/2017	11/4/2024	critical
101929	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3361-1)	Nessus	Ubuntu Local Security Checks	7/24/2017	8/27/2024	critical
99987	Fedora 24 : kernel (2017-0aa0f69e0c)	Nessus	Fedora Local Security Checks	5/5/2017	1/11/2021	high
109634	RHEL 6 : kernel (RHSA-2018:1319)	Nessus	Red Hat Local Security Checks	5/9/2018	11/5/2024	critical
102312	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2093-1)	Nessus	SuSE Local Security Checks	8/9/2017	1/6/2021	high
102314	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2095-1)	Nessus	SuSE Local Security Checks	8/9/2017	1/6/2021	high
103293	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2497-1)	Nessus	SuSE Local Security Checks	9/18/2017	1/6/2021	high
102320	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:2103-1)	Nessus	SuSE Local Security Checks	8/9/2017	1/6/2021	high
109629	Oracle Linux 6 : kernel (ELSA-2018-1319)	Nessus	Oracle Linux Local Security Checks	5/9/2018	10/24/2024	critical

Detections

Analytics

Plugins Search

critical

high

high

critical

critical

high

critical

high

high

high

high

critical