The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's NFS41+ subsystem.
    NFS41+ shares mounted in different network namespaces at     the same time can make bc_svc_process() use wrong back-     channel IDs and cause a use-after-free vulnerability.
    Thus a malicious container user can cause a host kernel     memory corruption and a system panic. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out. (CVE-2018-16884)

  - Insufficient input validation in Kernel Mode Driver in     Intel(R) i915 Graphics for Linux before version 5.0 may     allow an authenticated user to potentially enable     escalation of privilege via local access.
    (CVE-2019-11085)

  - A flaw was found in the Linux kernel's NFS     implementation, all versions 3.x and all versions 4.x up     to 4.20. An attacker, who is able to mount an exported     NFS filesystem, is able to trigger a null pointer     dereference by using an invalid NFS sequence. This can     panic the machine and deny access to the NFS server. Any     outstanding disk writes to the NFS server will be lost.
    (CVE-2018-16871)

  - An issue was discovered in the Linux kernel before     5.0.4. There is a use-after-free upon attempted read     access to /proc/ioports after the ipmi_si module is     removed, related to drivers/char/ipmi/ipmi_si_intf.c,     drivers/char/ipmi/ipmi_si_mem_io.c, and     drivers/char/ipmi/ipmi_si_port_io.c. (CVE-2019-11811)

  - A flaw was found in the way Linux kernel KVM hypervisor     before 4.18 emulated instructions such as     sgdt/sidt/fxsave/fxrstor. It did not check current     privilege(CPL) level while emulating unprivileged     instructions. An unprivileged guest user/process could     use this flaw to potentially escalate privileges inside     guest. (CVE-2018-10853)

  - A flaw was found in the Linux Kernel where an attacker     may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between     connect() and close() function may allow an attacker     using the AF_VSOCK protocol to gather a 4 byte     information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients.
    (CVE-2018-14625)

  - drivers/infiniband/core/ucma.c in the Linux kernel     through 4.17.11 allows ucma_leave_multicast to access a     certain data structure after a cleanup step in     ucma_process_join, which allows attackers to cause a     denial of service (use-after-free). (CVE-2018-14734)

  - arch/x86/kernel/paravirt.c in the Linux kernel before     4.18.1 mishandles certain indirect calls, which makes it     easier for attackers to conduct Spectre-v2 attacks     against paravirtual guests. (CVE-2018-15594)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - An issue was discovered in the Linux kernel before     4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain     error case is mishandled. (CVE-2018-20856)

  - In the hidp_process_report in bluetooth, there is an     integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed.
    User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID:
    A-65853588 References: Upstream kernel. (CVE-2018-9363)

  - In pppol2tp_connect, there is possible memory corruption     due to a use after free. This could lead to local     escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation.
    Product: Android. Versions: Android kernel. Android ID:
    A-38159931. (CVE-2018-9517)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other consequences.
    (CVE-2019-10126)

  - An information disclosure vulnerability exists when     certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information     Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - The coredump implementation in the Linux kernel before     5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs,     which allows local users to obtain sensitive     information, cause a denial of service, or possibly have     unspecified other impact by triggering a race condition     with mmget_not_zero or get_task_mm calls. This is     related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and     drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before     5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in     megasas_alloc_cmds() in     drivers/scsi/megaraid/megaraid_sas_base.c. This causes a     Denial of Service, related to a use-after-free.
    (CVE-2019-11810)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does     not zero out the unused memory region in the extent tree     block, which might allow local users to obtain sensitive     information by reading uninitialized data in the     filesystem. (CVE-2019-11833)

  - An out-of-bounds access issue was found in the Linux     kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO     write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write     indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged     host user or process with access to '/dev/kvm' device     could use this flaw to crash the host kernel, resulting     in a denial of service or potentially escalating     privileges on the system. (CVE-2019-14821)

  - A buffer overflow flaw was found, in versions from     2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to IOVs,     logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with     invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the     host. (CVE-2019-14835)

  - A heap address information leak while using     L2CAP_GET_CONF_OPT was discovered in the Linux kernel     before 5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including     L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network. (CVE-2019-3846)

  - A flaw was found in the Linux kernel's vfio interface     implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio     driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it may     cause a system memory exhaustion and thus a denial of     service (DoS). Versions 3.10, 4.14 and 4.18 are     vulnerable. (CVE-2019-3882)

  - An infinite loop issue was found in the vhost_net kernel     module in Linux Kernel up to and including v5.1-rc6,     while handling incoming packets in handle_rx(). It could     occur if one end sends packets faster than the other end     can process them. A guest user, maybe remote one, could     use this flaw to stall the vhost_net kernel thread,     resulting in a DoS scenario. (CVE-2019-3900)

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes on     the same system, potentially allowing sniffing of secret     information. (Fixing this affects the output of the     fincore program.) Limited remote exploitation may be     possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP Server.
    (CVE-2019-5489)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing     the key length negotiation. This allows practical brute-     force attacks (aka KNOB) that can decrypt traffic and     inject arbitrary ciphertext without the victim noticing.
    (CVE-2019-9506)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2043 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * kernel: Buffer overflow in hidp_process_report (CVE-2018-9363)

    * kernel: l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create() (CVE-2018-9517)

    * kernel: kvm: guest userspace to guest kernel write (CVE-2018-10853)

    * kernel: use-after-free Read in vhost_transport_send_pkt (CVE-2018-14625)

    * kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c (CVE-2018-14734)

    * kernel: Mishandling of indirect calls weakens Spectre mitigation for paravirtual guests (CVE-2018-15594)

    * kernel: TLB flush happens too late on mremap (CVE-2018-18281)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: Information exposure in fd_locked_ioctl function in drivers/block/floppy.c (CVE-2018-7755)

    * kernel: Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential     denial of service (CVE-2018-8087)

    * kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c     (CVE-2018-9516)

    * kernel: Integer overflow in the alarm_timer_nsleep function (CVE-2018-13053)

    * kernel: NULL pointer dereference in lookup_slow function (CVE-2018-13093)

    * kernel: NULL pointer dereference in xfs_da_shrink_inode function (CVE-2018-13094)

    * kernel: NULL pointer dereference in fs/xfs/libxfs/xfs_inode_buf.c (CVE-2018-13095)

    * kernel: Information leak in cdrom_ioctl_drive_status (CVE-2018-16658)

    * kernel: out-of-bound read in memcpy_fromiovecend() (CVE-2018-16885)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2029 advisory.

    - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712861]     {CVE-2019-11810}
    - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719915] {CVE-2019-11479}
    - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719915] {CVE-2019-11479}
    - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719595] {CVE-2019-11477}
    - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719595] {CVE-2019-11477}
    - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719850] {CVE-2019-11478}
    - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664199] {CVE-2019-5489}
    - [kernel] alarmtimer: Prevent overflow for relative nanosleep (Artem Savkov) [1653677] {CVE-2018-13053}
    - [fs] ext4: zero out the unused memory region in the extent tree block (Lukas Czerner) [1715280]     {CVE-2019-11833}
    - [vhost] vsock: add weight support (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: fix possible infinite loop (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: introduce vhost_exceeds_weight() (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost_net: use packet weight for rx handler, too (Jason Wang) [1702943] {CVE-2019-3900}
    - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Jason Wang) [1702943] {CVE-2019-3900}
    - [x86] kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access (Paolo Bonzini)     [1657358] {CVE-2018-10853}
    - [x86] kvm: x86: pass kvm_vcpu to kvm_read_guest_virt and kvm_write_guest_virt_system (Paolo Bonzini)     [1657358] {CVE-2018-10853}
    - [x86] kvm: x86: introduce linear_{read,write}_system (Paolo Bonzini) [1657358] {CVE-2018-10853}
    - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714408] {CVE-2019-11811}
    - [fs] sunrpc: make visible processing error in bc_svc_process() ('J. Bruce Fields') [1653675]     {CVE-2018-16884}
    - [fs] sunrpc: remove unused xpo_prep_reply_hdr callback ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: remove svc_tcp_bc_class ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] sunrpc: use-after-free in svc_process_common() ('J. Bruce Fields') [1653675] {CVE-2018-16884}
    - [fs] svcauth_gss: Close connection when dropping an incoming message ('J. Bruce Fields') [1653675]     {CVE-2018-16884}
    - [x86] spectre: Fix an error message (Waiman Long) [1709296 1690335 1690348 1690358] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Fix documentation typo (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] Correct the possible MDS sysfs values (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add 'mitigations=' support for MDS (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] s390/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] powerpc/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation: Support 'mitigations=' cmdline option (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/l1tf: Increase l1tf memory limit for Nehalem+ (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spectre: Simplify spectre_v2 command line parsing (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Properly set/clear mds_idle_clear static key (Waiman Long) [1709296 1690358     1690348 1690335 1707292] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Fix comment (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add SMT warning message (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1709296 1690358     1690348 1690335 1710501 1710498] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] documentation: Add MDS vulnerability documentation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] documentation: Move L1TF to separate directory (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add mitigation control for MDS (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long)     [1709296 1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [documentation] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Consolidate CPU whitelists (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] msr-index: Cleanup bit defines (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] l1tf: Show actual SMT state (Waiman Long) [1709296 1690358 1690348 1690335] {CVE-2018-12126     CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [kernel] x86/speculation: Rework SMT state change (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1709296     1690358 1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1709296 1690358     1690348 1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1709296 1690358 1690348     1690335] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] spec_ctrl: Add casting to fix compilation error (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [tools] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
    - [x86] cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1709296 1690358 1690348 1690335]     {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the Linux Kernel 3.12.74-60_64_96 fixes several issues. The following security issues were fixed :

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system (bsc#1099306).

  - CVE-2018-10853: A flaw was found in kvm. In which     certain instructions such as sgdt/sidt call     segmented_write_std didn't propagate access correctly.
    As such, during userspace induced exception, the guest     can incorrectly assume that the exception happened in     the kernel and panic. (bsc#1097108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-15572: The spectre_v2_select_mitigation     function in arch/x86/kernel/cpu/bugs.c did not always     fill RSB upon a context switch, which made it easier for     attackers to conduct userspace-userspace spectreRSB     attacks (bnc#1102517 bnc#1105296).

  - CVE-2018-10902: It was found that the raw midi kernel     driver did not protect against concurrent access which     leads to a double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation (bnc#1105322).

  - CVE-2018-9363: A buffer overflow in bluetooth HID report     processing could be used by malicious bluetooth devices     to crash the kernel or potentially execute code     (bnc#1105292).

  - CVE-2018-10853: A KVM guest userspace to guest kernel     write was fixed, which could be used by guest users to     crash the guest kernel (bnc#1097104).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_133 fixes several issues.
The following security issues were fixed :

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system (bsc#1099306).

  - CVE-2018-10853: A flaw was found in kvm. In which     certain instructions such as sgdt/sidt call     segmented_write_std didn't propagate access correctly.
    As such, during userspace induced exception, the guest     can incorrectly assume that the exception happened in     the kernel and panic. (bsc#1097108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-14634: Prevent integer overflow in create_elf_tables that allowed a local attacker to exploit this vulnerability via a SUID-root binary and obtain full root privileges (bsc#1108912)

CVE-2018-14617: Prevent NULL pointer dereference and panic in hfsplus_lookup() when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bsc#1102870)

CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in yurex_read allowed local attackers to use user access read/writes to crash the kernel or potentially escalate privileges (bsc#1106095)

CVE-2018-12896: Prevent integer overflow in the POSIX timer code that was caused by the way the overrun accounting works. Depending on interval and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This basically made the accounting values, which are visible to user space via timer_getoverrun(2) and siginfo::si_overrun, random. This allowed a local user to cause a denial of service (signed integer overflow) via crafted mmap, futex, timer_create, and timer_settime system calls (bnc#1099922)

CVE-2018-13093: Prevent NULL pointer dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted xfs image. This occured because of a lack of proper validation that cached inodes are free during allocation (bnc#1100001)

CVE-2018-10940: The cdrom_ioctl_media_changed function allowed local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out kernel memory (bsc#1092903)

CVE-2018-16658: Prevent information leak in cdrom_ioctl_drive_status that could have been used by local attackers to read kernel memory (bnc#1107689)

CVE-2018-6555: The irda_setsockopt function allowed local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket (bnc#1106511)

CVE-2018-6554: Prevent memory leak in the irda_bind function that allowed local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket (bnc#1106509)

CVE-2018-10853: The KVM hypervisor did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could have used this flaw to potentially escalate privileges inside guest (bsc#1097104)

CVE-2018-10902: Protect against concurrent access to prevent double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status(). A malicious local attacker could have used this for privilege escalation (bnc#1105322).

CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact by renaming a file in a crafted ext4 filesystem image (bsc#1099844)

CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863)

CVE-2018-10880: Prevent stack-out-of-bounds write in the ext4 filesystem code when mounting and writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could have used this to cause a system crash and a denial of service (bsc#1099845)

CVE-2018-10882: A local user could have caused an out-of-bound write, a denial of service, and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849)

CVE-2018-10881: A local user could have caused an out-of-bound access in ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864)

CVE-2018-10877: Prevent out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846)

CVE-2018-10876: A use-after-free was possible in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image (bsc#1099811)

CVE-2018-10878: A local user could have caused an out-of-bounds write and a denial of service or unspecified other impact by mounting and operating a crafted ext4 filesystem image (bsc#1099813)

CVE-2018-17182: An issue was discovered in the Linux kernel The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bnc#1108399).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.61-52_125 fixes several issues.
The following security issues were fixed :

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system (bsc#1099306).

  - CVE-2018-10853: A flaw was found in kvm. In which     certain instructions such as sgdt/sidt call     segmented_write_std didn't propagate access correctly.
    As such, during userspace induced exception, the guest     can incorrectly assume that the exception happened in     the kernel and panic. (bsc#1097108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
132495	NewStart CGSL CORE 5.05 / MAIN 5.05 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0253)	Nessus	NewStart CGSL Local Security Checks	12/31/2019	12/5/2022	critical
127655	RHEL 7 : kernel-rt (RHSA-2019:2043)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	high
180763	Oracle Linux 7 : kernel (ELSA-2019-2029)	Nessus	Oracle Linux Local Security Checks	9/7/2023	10/22/2024	high
111828	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2358-1) (Foreshadow)	Nessus	SuSE Local Security Checks	8/17/2018	8/16/2024	high
120088	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2539-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/10/2024	high
111814	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2342-1) (Foreshadow)	Nessus	SuSE Local Security Checks	8/17/2018	8/19/2024	high
118033	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:3083-1)	Nessus	SuSE Local Security Checks	10/10/2018	7/31/2024	high
111813	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2341-1) (Foreshadow)	Nessus	SuSE Local Security Checks	8/17/2018	8/19/2024	high

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

high

high