The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - net/llc/sysctl_net_llc.c in the Linux kernel before 3.19     uses an incorrect data type in a sysctl table, which     allows local users to obtain potentially sensitive     information from kernel memory or possibly have     unspecified other impact by accessing a sysctl entry.
    (CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses an     incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry. (CVE-2015-2042)

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service (out-of-     bounds access) or possibly have unspecified other impact     by sending a XFRM_MSG_MIGRATE netlink message. This flaw     is present in the Linux kernel since an introduction of     XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3.
    (CVE-2017-11600)

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a privilege     escalation. (CVE-2017-13215)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system. (CVE-2017-16939)

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-8890)

  - An address corruption flaw was discovered in the Linux     kernel built with hardware breakpoint     (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a     h/w breakpoint via 'modify_user_hw_breakpoint' routine,     an unprivileged user/process could use this flaw to     crash the system kernel resulting in DoS OR to     potentially escalate privileges on a the system.
    (CVE-2018-1000199)

  - The do_get_mempolicy() function in mm/mempolicy.c in the     Linux kernel allows local users to hit a use-after-free     bug via crafted system calls and thus cause a denial of     service (DoS) or possibly have unspecified other impact.
    Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2018-10675)

  - A flaw was found in the Linux kernel's implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory. (CVE-2018-1068)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.
    (CVE-2018-8897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in network     namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in     net/core/net_namespace.c does not check for the     net::count value after it has found a peer network in     netns_ids idr, which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact     by leveraging the presence of xt_TCPMSS in an iptables     action.(CVE-2017-18017)

  - A flaw was found in the upstream kernel Skcipher     component. This vulnerability affects the     skcipher_recvmsg function of the component Skcipher.
    The manipulation with an unknown input leads to a     privilege escalation vulnerability.(CVE-2017-13215)

  - In the Linux kernel through 4.14.13, the     rds_message_alloc_sgs() function does not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size() function in 'net/rds/rdma.c') and     thus to a system panic. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the     rds_cmsg_atomic() function in 'net/rds/rdma.c'     mishandles cases where page pinning fails or an invalid     address is supplied by a user. This can lead to a NULL     pointer dereference in rds_atomic_free_op() and thus to     a system panic.(CVE-2018-5333)

  - drivers/input/serio/i8042.c in the Linux kernel before     4.12.4 allows attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact because the     port-i1/4zexists value can change after it is     validated.(CVE-2017-18079)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003289 advisory.

    A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions:
    Android kernel. Android ID: A-64386293. References: Upstream kernel.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000995 advisory.

    A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions:
    Android kernel. Android ID: A-64386293. References: Upstream kernel.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-2384 advisory.

    - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3693}
    - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369]     {CVE-2018-5390}
    - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369]     {CVE-2018-5390}
    - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369]     {CVE-2018-5390}
    - [net] net: add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369]     {CVE-2018-5390}
    - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
    - [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio)     [1589033 1589035] {CVE-2018-3693}
    - [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf)     [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - Revert 'x86/apic: Ignore secondary threads if nosmt=force' (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383     1593384] {CVE-2018-3620}
    - [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
    - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384]     {CVE-2018-3620}
    - [spectre] update Spectre v1 mitigation string (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [spectre] fix hiddev nospec issues (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] syscall: clarify clobbered registers in entry code (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [powerpc] add missing barrier_nospec() in __get_user64_nocheck() (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [spectre] fix gadgets found by smatch scanner (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] hdspm: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] asihpi: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [alsa] seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [kernel] time: Protect posix clock array access against speculation (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [sched] autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589033     1589035] {CVE-2018-3690}
    - [perf] core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [sysvipc] sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [alsa] control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [usbip] vhci_sysfs: fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] kvm: Update spectre-v1 mitigation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] kvm: Add memory barrier on vmcs field lookup (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] perf/msr: Fix possible Spectre-v1 indexing in the MSR driver (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589033     1589035] {CVE-2018-3690}
    - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589033     1589035] {CVE-2018-3690}
    - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf)     [1589033 1589035] {CVE-2018-3690}
    - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}     dependency (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf)     [1589033 1589035] {CVE-2018-3690}
    - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589033     1589035] {CVE-2018-3690}
    - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] usercopy: Replace open coded stac/clac with __uaccess_{begin, end} (Josh Poimboeuf) [1589033     1589035] {CVE-2018-3690}
    - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589033 1589035]     {CVE-2018-3690}
    - [x86] uaccess: fix sparse errors (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
    - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576759 1576755]     {CVE-2018-10675}
    - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550171 1593586 1550169 1535427]     {CVE-2018-7566}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimisation) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3620, CVE-2018-3646)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the fact     that memory writes occur to an address which depends on     the untrusted value. Such writes cause an update into     the microprocessor's data cache even for speculatively     executed instructions that never actually commit     (retire). As a result, an unprivileged attacker could     use this flaw to influence speculative execution and/or     read privileged memory by conducting targeted cache     side- channel attacks. (CVE-2018-3693)

  - A flaw named SegmentSmack was found in the way the Linux     kernel handled specially crafted TCP packets. A remote     attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending specially     modified packets within ongoing TCP sessions which could     lead to a CPU saturation and hence a denial of service     on the system. Maintaining the denial of service     condition requires continuous two-way TCP sessions to a     reachable open port, thus the attacks cannot be     performed using spoofed IP addresses. (CVE-2018-5390)

  - kernel: crypto: privilege escalation in skcipher_recvmsg     function (CVE-2017-13215)

  - kernel: mm: use-after-free in do_get_mempolicy function     allows local DoS or other unspecified impact     (CVE-2018-10675)

  - kernel: race condition in snd_seq_write() may lead to     UAF or OOB access (CVE-2018-7566)

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

A flaw was found in the Linux kernel's skcipher component, which affects the skcipher_recvmsg function. Attackers using a specific input can lead to a privilege escalation.(CVE-2017-13215)

The do_get_mempolicy() function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service (DoS) or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(CVE-2018-10675)

A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.(CVE-2018-10901)

A race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval file in a /sys/devices/system/machinecheck/machinecheck<cpu number> directory.
(CVE-2018-7995)

ID	名稱	產品	系列	已發布	已更新	嚴重性
127192	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0028)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
117543	EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1234)	Nessus	Huawei Local Security Checks	2018/9/18	2024/8/7	critical
287174	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003289)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
291221	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000995)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
111723	Oracle Linux 7 : kernel (ELSA-2018-2384)	Nessus	Oracle Linux Local Security Checks	2018/8/15	2026/2/9	high
111778	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180814) (Foreshadow)	Nessus	Scientific Linux Local Security Checks	2018/8/16	2024/8/21	high
110197	Amazon Linux AMI : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	2018/5/30	2024/9/30	high

偵測

搜尋 Plugin

high

critical

high

high

high

high

high