The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4118-1 advisory.

    It was discovered that the alarmtimer implementation in the Linux kernel contained an integer overflow     vulnerability. A local attacker could use this to cause a denial of service. (CVE-2018-13053)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly track inode     validations. An attacker could use this to construct a malicious XFS image that, when mounted, could cause     a denial of service (system crash). (CVE-2018-13093)

    Wen Xu discovered that the f2fs file system implementation in the Linux kernel did not properly validate     metadata. An attacker could use this to construct a malicious f2fs image that, when mounted, could cause a     denial of service (system crash). (CVE-2018-13096, CVE-2018-13097, CVE-2018-13098, CVE-2018-13099,     CVE-2018-13100, CVE-2018-14614, CVE-2018-14615, CVE-2018-14616)

    Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation in the Linux kernel did not     properly validate metadata. An attacker could use this to construct a malicious btrfs image that, when     mounted, could cause a denial of service (system crash). (CVE-2018-14609, CVE-2018-14610, CVE-2018-14611,     CVE-2018-14612, CVE-2018-14613)

    Wen Xu discovered that the HFS+ filesystem implementation in the Linux kernel did not properly handle     malformed catalog data in some situations. An attacker could use this to construct a malicious HFS+ image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-14617)

    Vasily Averin and Pavel Tikhomirov discovered that the cleancache subsystem of the Linux kernel did not     properly initialize new files in some situations. A local attacker could use this to expose sensitive     information. (CVE-2018-16862)

    Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not     properly validate metadata received from the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2018-19985)

    Hui Peng and Mathias Payer discovered that the USB subsystem in the Linux kernel did not properly handle     size checks when handling an extra USB descriptor. A physically proximate attacker could use this to cause     a denial of service (system crash). (CVE-2018-20169)

    Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kernel process scheduler.
    A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)

    It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel     when certain failure conditions occurred. A local attacker could possibly use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2018-20856)

    Eli Biham and Lior Neumann discovered that the Bluetooth implementation in the Linux kernel did not     properly validate elliptic curve parameters during Diffie-Hellman key exchange in some situations. An     attacker could use this to expose sensitive information. (CVE-2018-5383)

    It was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain     Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of     service (Wi-Fi disconnect). (CVE-2019-0136)

    It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the     Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2019-10126)

    It was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for     missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)

    Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values     generated for connectionless networking protocols. A remote attacker could use this to track particular     Linux devices. (CVE-2019-10638)

    Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the     implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly     use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)

    Adam Zabrocki discovered that the Intel i915 kernel mode graphics driver in the Linux kernel did not     properly restrict mmap() ranges in some situations. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-11085)

    It was discovered that an integer overflow existed in the Linux kernel when reference counting pages,     leading to potential use-after-free issues. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-11487)

    Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local     attacker could use this to cause a denial of service (system crash) or expose sensitive information.
    (CVE-2019-11599)

    It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-11810)

    It was discovered that a race condition leading to a use-after-free existed in the Reliable Datagram     Sockets (RDS) protocol implementation in the Linux kernel. The RDS protocol is disabled via blocklist by     default in Ubuntu.

    If enabled, a local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-11815)

    It was discovered that the ext4 file system implementation in the Linux kernel did not properly zero out     memory in some situations. A local attacker could use this to expose sensitive information (kernel     memory). (CVE-2019-11833)

    It was discovered that the Bluetooth Human Interface Device Protocol (HIDP) implementation in the Linux     kernel did not properly verify strings were NULL terminated in certain situations. A local attacker could     use this to expose sensitive information (kernel memory). (CVE-2019-11884)

    It was discovered that a NULL pointer dereference vulnerabilty existed in the Near-field communication     (NFC) implementation in the Linux kernel. An attacker could use this to cause a denial of service (system     crash). (CVE-2019-12818)

    It was discovered that the MDIO bus devices subsystem in the Linux kernel improperly dropped a device     reference in an error condition, leading to a use-after-free. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-12819)

    It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication     (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service     (system crash). (CVE-2019-12984)

    Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some     situations. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2019-13233)

    Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record     credentials in some situations. A local attacker could use this to cause a denial of service (system     crash) or possibly gain administrative privileges. (CVE-2019-13272)

    It was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the     initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)

    It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading     to a buffer overread. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-14283)

    It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls,     leading to a division-by-zero. A local attacker could use this to cause a denial of service (system     crash). (CVE-2019-14284)

    Tuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in     the Linux kernel. A physically proximate attacker could use this to cause a denial of service.
    (CVE-2019-14763)

    It was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the     Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2019-15090)

    It was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly     allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2019-15211)

    It was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)

    It was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem     of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)

    It was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux     kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)

    It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15220)

    It was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux     kernel if an error occurs during initialization. A local attacker could use this to cause a denial of     service (system crash). (CVE-2019-15292)

    It was discovered that the Empia EM28xx DVB USB device driver implementation in the Linux kernel contained     a use-after-free vulnerability when disconnecting the device. An attacker could use this to cause a denial     of service (system crash). (CVE-2019-2024)

    It was discovered that the USB video device class implementation in the Linux kernel did not properly     validate control bits, resulting in an out of bounds buffer read. A local attacker could use this to     possibly expose sensitive information (kernel memory). (CVE-2019-2101)

    It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly     validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2019-3846)

    Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux     kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host     system. (CVE-2019-3900)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol     BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically     proximate attacker could use this to expose sensitive information. (CVE-2019-9506)

    It was discovered that the Appletalk IP encapsulation driver in the Linux kernel did not properly prevent     kernel addresses from being copied to user space. A local attacker with the CAP_NET_ADMIN capability could     use this to expose sensitive information. (CVE-2018-20511)

    It was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper     assumptions about the device characteristics. A physically proximate attacker could use this cause a     denial of service (system crash). (CVE-2019-15218)

    It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data     size information from the device. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2019-15221)

    Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly     restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges     could use this to execute arbitrary code. (CVE-2019-3701)

    Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly     validate passed parameters in some situations. A local privileged attacker could use this to cause a     denial of service (infinite loop). (CVE-2019-3819)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.16.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.16.0.1 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing the key length negotiation. This allows practical     brute-force attacks (aka KNOB) that can decrypt traffic and inject arbitrary ciphertext without the     victim noticing. (CVE-2019-9506)

  - An information disclosure vulnerability exists when certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable     to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event     frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This     vulnerability can be exploited with compromised chipsets to compromise the host, or when used in     combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-     crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a     vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
    (CVE-2019-9500)

  - Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to potentially enable denial of service of the host system via     local access. (CVE-2018-12207)

  - Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2019-0154)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost     functionality that translates virtqueue buffers to IOVs, logged the buffer descriptors during migration. A     privileged guest user able to pass descriptors with invalid length to the host when migration is underway,     could use this flaw to increase their privileges on the host. (CVE-2019-14835)

  - Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R)     Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077     (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11,     4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of     privilege via local access. (CVE-2019-0155)

  - A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as     sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged     instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges     inside guest. (CVE-2018-10853)

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

  - An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer     dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted     xfs image. This occurs because of a lack of proper validation that cached inodes are free during     allocation. (CVE-2018-13093)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of     service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is     in extent format, but has more extents than fit in the inode fork. (CVE-2018-13095)

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a     certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial     of service (use-after-free). (CVE-2018-14734)

  - arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which     makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. (CVE-2018-15594)

  - An issue was discovered in the Linux kernel before 4.18.6. An information leak in cdrom_ioctl_drive_status     in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from     unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940. (CVE-2018-16658)

  - A flaw was found in the Linux kernel that allows the userspace to call memcpy_fromiovecend() and similar     functions with a zero offset and buffer length which causes the read beyond the buffer boundaries, in     certain cases causing a memory access fault and a system halt by accessing invalid memory address. This     issue only affects kernel version 3.10.x as shipped with Red Hat Enterprise Linux 7. (CVE-2018-16885)

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel     through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM     ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the     location of kernel code and data and bypass kernel security protections such as KASLR. (CVE-2018-7755)

  - Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c in the Linux     kernel through 4.15.9 allows local users to cause a denial of service (memory consumption) by triggering     an out-of-array error case. (CVE-2018-8087)

  - In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed. User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID: A-65853588 References: Upstream kernel.
    (CVE-2018-9363)

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

  - In pppol2tp_connect, there is possible memory corruption due to a use after free. This could lead to local     escalation of privilege with System execution privileges needed. User interaction is not needed for     exploitation. Product: Android. Versions: Android kernel. Android ID: A-38159931. (CVE-2018-9517)

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c.
    This causes a Denial of Service, related to a use-after-free. (CVE-2019-11810)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the     extent tree block, which might allow local users to obtain sensitive information by reading uninitialized     data in the filesystem. (CVE-2019-11833)

  - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before     5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it may cause a system memory exhaustion and thus a     denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable. (CVE-2019-3882)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers     to observe page cache access patterns of other processes on the same system, potentially allowing sniffing     of secret information. (Fixing this affects the output of the fincore program.) Limited remote     exploitation may be possible, as demonstrated by latency differences in accessing public files from an     Apache HTTP Server. (CVE-2019-5489)

  - The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak. (CVE-2019-7222)

  - A buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi.c of GNU     FriBidi through 1.0.7 allows an attacker to cause a denial of service or possibly execute arbitrary code     by delivering crafted text content to a user, when this content is then rendered by an application that     uses FriBidi for text layout calculations. Examples include any GNOME or GTK+ based application that uses     Pango for text layout, as this internally uses FriBidi for bidirectional text layout. For example, the     attacker can construct a crafted text file to be opened in GEdit, or a crafted IRC message to be viewed in     HexChat. (CVE-2019-18397)

  - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm'     device could use this flaw to crash the host kernel, resulting in a denial of service or potentially     escalating privileges on the system. (CVE-2019-14821)

  - In the Linux kernel, a certain net/ipv4/tcp_output.c change, which was properly incorporated into 4.16.12,     was incorrectly backported to the earlier longterm kernels, introducing a new vulnerability that was     potentially more severe than the issue that was intended to be fixed by backporting. Specifically, by     adding to a write queue between disconnection and re-connection, a local attacker can trigger multiple     use-after-free conditions. This can result in a kernel crash, or potentially in privilege escalation.
    NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or     4.14.x longterm kernels before 4.14.139. (CVE-2019-15239)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Rebase to the v5.1 kernel series

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to v5.1.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2019-3846, CVE-2019-10126     huangwen reported multiple buffer overflows in the     Marvell wifi (mwifiex) driver, which a local user could     use to cause denial of service or the execution of     arbitrary code.

  - CVE-2019-5489     Daniel Gruss, Erik Kraft, Trishita Tiwari, Michael     Schwarz, Ari Trachtenberg, Jason Hennessey, Alex     Ionescu, and Anders Fogh discovered that local users     could use the mincore() system call to obtain sensitive     information from other processes that access the same     memory-mapped file.

  - CVE-2019-9500, CVE-2019-9503     Hugues Anguelkov discovered a buffer overflow and     missing access validation in the Broadcom FullMAC wifi     driver (brcmfmac), which a attacker on the same wifi     network could use to cause denial of service or the     execution of arbitrary code.

  - CVE-2019-11477     Jonathan Looney reported that a specially crafted     sequence of TCP selective acknowledgements (SACKs)     allows a remotely triggerable kernel panic.

  - CVE-2019-11478     Jonathan Looney reported that a specially crafted     sequence of TCP selective acknowledgements (SACKs) will     fragment the TCP retransmission queue, allowing an     attacker to cause excessive resource usage.

  - CVE-2019-11479     Jonathan Looney reported that an attacker could force     the Linux kernel to segment its responses into multiple     TCP segments, each of which contains only 8 bytes of     data, drastically increasing the bandwidth required to     deliver the same amount of data.

  This update introduces a new sysctl value to control the minimal MSS   (net.ipv4.tcp_min_snd_mss), which by default uses the formerly hard   coded value of 48. We recommend raising this to 536 unless you know   that your network requires a lower value.

  - CVE-2019-11486     Jann Horn of Google reported numerous race conditions in     the Siemens R3964 line discipline. A local user could     use these to cause unspecified security impact. This     module has therefore been disabled.

  - CVE-2019-11599     Jann Horn of Google reported a race condition in the     core dump implementation which could lead to a     use-after-free. A local user could use this to read     sensitive information, to cause a denial of service     (memory corruption), or for privilege escalation.

  - CVE-2019-11815     It was discovered that a use-after-free in the Reliable     Datagram Sockets protocol could result in denial of     service and potentially privilege escalation. This     protocol module (rds) is not auto loaded on Debian     systems, so this issue only affects systems where it is     explicitly loaded.

  - CVE-2019-11833     It was discovered that the ext4 filesystem     implementation writes uninitialised data from kernel     memory to new extent blocks. A local user able to write     to an ext4 filesystem and then read the filesystem     image, for example using a removable drive, might be     able to use this to obtain sensitive information.

  - CVE-2019-11884     It was discovered that the Bluetooth HIDP implementation     did not ensure that new connection names were     null-terminated. A local user with CAP_NET_ADMIN     capability might be able to use this to obtain sensitive     information from the kernel stack.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - Microarchitectural Store Buffer Data Sampling (MSBDS):
    Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here: https://www.intel.com/content/dam/www     /public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2018-12126)

  - Microarchitectural Load Port Data Sampling (MLPDS): Load     ports on some microprocessors utilizing speculative     execution may allow an authenticated user to potentially     enable information disclosure via a side channel with     local access. A list of impacted products can be found     here: https://www.intel.com/content/dam/www/public/us/en     /documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2018-12127)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS):
    Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here: https://www.intel.com/content/dam/www     /public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2018-12130)

  - An issue was discovered in the Linux kernel before     4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain     error case is mishandled. (CVE-2018-20856)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other consequences.
    (CVE-2019-10126)

  - A vulnerability was found in Linux kernel's, versions up     to 3.10, implementation of overlayfs. An attacker with     local access can create a denial of service situation     via NULL pointer dereference in ovl_posix_acl_create     function in fs/overlayfs/dir.c. This can allow attackers     with ability to create directories on overlayfs to crash     the kernel creating a denial of service (DOS).
    (CVE-2019-10140)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an     authenticated user to potentially enable information     disclosure via a side channel with local access. A list     of impacted products can be found here: https://www.inte     l.com/content/dam/www/public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2019-11091)

  - An out-of-bounds access issue was found in the Linux     kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO     write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write     indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged     host user or process with access to '/dev/kvm' device     could use this flaw to crash the host kernel, resulting     in a denial of service or potentially escalating     privileges on the system. (CVE-2019-14821)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network. (CVE-2019-3846)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing     the key length negotiation. This allows practical brute-     force attacks (aka KNOB) that can decrypt traffic and     inject arbitrary ciphertext without the victim noticing.
    (CVE-2019-9506)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128478	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-4118-1)	Nessus	Ubuntu Local Security Checks	9/3/2019	8/27/2024	critical
164561	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.17)	Nessus	Misc.	9/1/2022	2/23/2024	critical
164593	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16.0.1)	Nessus	Misc.	9/1/2022	3/8/2024	critical
125746	Fedora 29 : kernel / kernel-headers / kernel-tools (2019-7ec378191e)	Nessus	Fedora Local Security Checks	6/7/2019	5/16/2024	high
125790	Fedora 30 : kernel / kernel-headers (2019-f40bd7826f)	Nessus	Fedora Local Security Checks	6/10/2019	5/16/2024	high
125959	Debian DSA-4465-1 : linux - security update (SACK Panic) (SACK Slowness)	Nessus	Debian Local Security Checks	6/18/2019	5/15/2024	critical
131421	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0222)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/9/2024	critical
126033	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1570) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	6/19/2019	5/15/2024	high
126040	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1579) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	6/19/2019	5/15/2024	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

high

critical

critical

high

high