The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0676 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)

    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

    * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)

    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166,     Important)

    * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)

    * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

    * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)

    * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126,     Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

    * kernel: Incorrect handling in arch/x86/include/asm/mmu_context.h:init_new_context function allowing use-     after-free (CVE-2017-17053, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017, Moderate)

    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of     service (CVE-2017-18203, Moderate)

    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially     allowing KASLR bypass (CVE-2018-5750, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

    * kernel: unlimiting the stack disables ASLR (CVE-2016-3672, Low)

    * kernel: Missing permission check in move_pages system call (CVE-2017-14140, Low)

    * kernel: Null pointer dereference in rngapi_reset function (CVE-2017-15116, Low)

    * kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/hugetlb.c (CVE-2017-15127, Low)

    * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact     (CVE-2018-6927, Low)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Mohamed Ghannam for reporting     CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting     CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting     CVE-2017-15129; Jan H. Schnherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting     CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the     CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).

    Additional Changes:

    See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - drivers/char/mem.c: deny access in open operation when     securelevel is set (Ethan Zhao) [Orabug: 27234850]     [Orabug: 27234850]

  - hugetlb: fix nr_pmds accounting with shared page tables     (Kirill A. Shutemov) [Orabug: 26988581]

  - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky)     [Orabug: 27416198]

  - x86/IBRS: Don't try to change IBRS mode if IBRS is not     available (Boris Ostrovsky) [Orabug: 27416198]

  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode     (Boris Ostrovsky) 

  - x86: Include linux/device.h in bugs_64.c (Boris     Ostrovsky) [Orabug: 27418896]

  - x86/spectre: Drop the warning about ibrs being obsolete.
    (Konrad Rzeszutek Wilk)

  - x86/spec: Don't print the Missing arguments for option     spectre_v2. (Konrad Rzeszutek Wilk)

  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad     Rzeszutek Wilk)

  - x86/IBPB: Provide debugfs interface for changing IBPB     mode (Boris Ostrovsky) [Orabug: 27449065]

  - xen: Make PV Dom0 Linux kernel NUMA aware (Elena     Ufimtseva)

  - net/rds: Fix incorrect error handling (H&aring kon     Bugge) [Orabug: 26848729]

  - net/rds: use multiple sge than buddy allocation in     congestion code (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: fix the sg allocation based on actual     message size' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: avoid large pages for sg allocation for TCP     transport' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'net/rds: Reduce memory footprint in rds_sendmsg'     (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during ib_post_recv in     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during rds_sendmsg with     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: set the rds_ib_init_frag based on supported sge     (Wei Lin Guay) [Orabug: 26848729]

  - bnxt_en: Fix possible corrupted NVRAM parameters from     firmware response. (Michael Chan) [Orabug: 27199588]

  - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y     kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: Fix build failure on !KASAN &&     KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: #undef memset/memcpy/memmove per arch     (Andrey Ryabinin) [Orabug: 27255122]

  - Revert 'Makefile: Build with -Werror=date-time if the     compiler supports it' (Gayatri Vasudevan) [Orabug:
    27255122]

  - dccp: CVE-2017-8824: use-after-free in DCCP code     (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)

  - x86/efi: Initialize and display UEFI secure boot state a     bit later during init (Daniel Kiper) [Orabug: 27309477]

  - x86/espfix: Init espfix on the boot CPU side (Zhu     Guihua) [Orabug: 27344552]

  - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu     Guihua) 

  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)     [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)

  - fs/ocfs2: remove page cache for converted direct write     (Wengang Wang)

  - Revert 'ocfs2: code clean up for direct io' (Wengang     Wang)

  - assoc_array: Fix a buggy node-splitting case (David     Howells) [Orabug: 27364592] (CVE-2017-12193)     (CVE-2017-12193)

  - Sanitize 'move_pages' permission checks (Linus Torvalds)     [Orabug: 27364690] (CVE-2017-14140)

  - pti: compile fix for when PTI is disabled (Pavel     Tatashin) [Orabug: 27383147] (CVE-2017-5754)

  - sctp: do not peel off an assoc from one netns to another     one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)

  - net: ipv4: fix for a race condition in raw_sendmsg     (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)

  - mlx4: add mstflint secure boot access kernel support     (Qing Huang) 

  - x86: Move STUFF_RSB in to the idt macro (Konrad     Rzeszutek Wilk)

  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad     Rzeszutek Wilk)

  - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad     Rzeszutek Wilk)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1130 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166,     Important)

    * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

    * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017, Moderate)

    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Mohamed Ghannam for reporting CVE-2017-8824; Jan H. Schnherr (Amazon) for     reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these     bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3411331

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak

A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. (CVE-2017-17712)

Use-after-free vulnerability in DCCP socket

A use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. This vulnerability could allow an attacker to their escalate privileges. (CVE-2017-8824)

Stack-based out-of-bounds read via vmcall instruction

Linux kernel compiled with the KVM virtualization (CONFIG_KVM) support is vulnerable to an out-of-bounds read access issue. It could occur when emulating vmcall instructions invoked by a guest. A guest user/process could use this flaw to disclose kernel memory bytes.
(CVE-2017-17741)

Unchecked capabilities in net/netfilter/xt_osf.c allows for unprivileged modification to systemwide fingerprint list

net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. (CVE-2017-17450)

Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure

net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. (CVE-2017-17448)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4041 advisory.

    - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Tim Tianyang Chen)     [Orabug: 25757946]  {CVE-2017-6951}
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813391]  {CVE-2017-14106}
    - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug:
    26880520]  {CVE-2017-7482} {CVE-2017-7482}
    - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206839]     {CVE-2017-16525}
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug:
    27206934]  {CVE-2017-16529}
    - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207243]     {CVE-2017-16531}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1062 advisory.

    - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430]     {CVE-2017-13166}
    - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
    - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381]     {CVE-2017-15265}
    - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543088]     {CVE-2017-18017}
    - [sound] alsa: seq: Make ioctls race-free (CVE-2018-1000004) (Jaroslav Kysela) [1537203]     {CVE-2018-1000004}
    - [x86] mm: Fix use-after-free of ldt_struct (Oleg Nesterov) [1543352] {CVE-2017-17053}
    - [net] netlink: Add netns check on taps (William Townsend) [1538738] {CVE-2017-17449}
    - [net] netfilter: xt_osf: Add missing permission checks (Florian Westphal) [1539230] {CVE-2017-17448}
    - [net] netfilter: nfnetlink_cthelper: Add missing permission checks (Florian Westphal) [1539230]     {CVE-2017-17448}
    - [powerpc] kvm: book3s: Provide information about hardware/firmware CVE workarounds (Serhii Popovych)     [1532077] {CVE-2017-5754}
    - [net] Fix double free and memory corruption in get_net_ns_by_id() (Aristeu Rozanski) [1531551]     {CVE-2017-15129}
    - [media] xc2028: avoid use after free (Torez Smith) [1402893] {CVE-2016-7913}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory.

    It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System     (f2fs) in the Linux kernel. An attacker could construct a malicious file system that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0750)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly     validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this     to cause a denial of service (system crash). (CVE-2017-12153)

    Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference     counts when merging buffers. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2017-12190)

    It was discovered that the key management subsystem in the Linux kernel did not properly restrict key     reads on negatively instantiated keys. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-12192)

    It was discovered that an integer overflow existed in the sysfs interface for the QLogic 24xx+ series SCSI     driver in the Linux kernel. A local privileged attacker could use this to cause a denial of service     (system crash). (CVE-2017-14051)

    Otto Ebeling discovered that the memory manager in the Linux kernel did not properly check the effective     UID in some situations. A local attacker could use this to expose sensitive information. (CVE-2017-14140)

    It was discovered that the ATI Radeon framebuffer driver in the Linux kernel did not properly initialize a     data structure returned to user space. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14156)

    ChunYu Wang discovered that the iSCSI transport implementation in the Linux kernel did not properly     validate data structures. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-14489)

    James Patrick-Evans discovered a race condition in the LEGO USB Infrared Tower driver in the Linux kernel.
    A physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15102)

    ChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code, (CVE-2017-15115)

    It was discovered that the key management subsystem in the Linux kernel did not properly handle NULL     payloads with non-zero length values. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-15274)

    It was discovered that the Bluebooth Network Encapsulation Protocol (BNEP) implementation in the Linux     kernel did not validate the type of socket passed in the BNEPCONNADD ioctl(). A local attacker with the     CAP_NET_ADMIN privilege could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-15868)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    Denys Fedoryshchenko discovered a use-after-free vulnerability in the netfilter xt_TCPMSS filter of the     Linux kernel. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-18017)

    Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping     page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)

    It was discovered that an integer overflow vulnerability existing in the IPv6 implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (infinite loop). (CVE-2017-7542)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8824)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    USN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64 architecture in Ubuntu 14.04 LTS. This update     provides the corresponding mitigations for the ppc64el architecture.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
108984	RHEL 7 : kernel-rt (RHSA-2018:0676)	Nessus	Red Hat Local Security Checks	4/11/2018	11/5/2024	critical
106706	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)	Nessus	OracleVM Local Security Checks	2/9/2018	9/27/2019	high
109116	RHEL 7 : kernel (RHSA-2018:1130)	Nessus	Red Hat Local Security Checks	4/18/2018	11/5/2024	critical
106171	Amazon Linux AMI : kernel (ALAS-2018-944)	Nessus	Amazon Linux Local Security Checks	1/19/2018	4/5/2019	high
107052	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4041)	Nessus	Oracle Linux Local Security Checks	2/28/2018	11/1/2024	high
109113	Oracle Linux 7 : kernel (ELSA-2018-1062)	Nessus	Oracle Linux Local Security Checks	4/18/2018	10/22/2024	critical
107003	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)	Nessus	Ubuntu Local Security Checks	2/26/2018	10/29/2024	critical

Detections

Analytics

Plugins Search

critical

high

critical

high

high

critical

critical