According to the versions of the OVMF / crit / criu / criu-devel / ksm-vz / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a     privilege escalation.

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimisation) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the     fact that memory writes occur to an address which     depends on the untrusted value. Such writes cause an     update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to influence speculative execution     and/or read privileged memory by conducting targeted     cache side-channel attacks.

  - A flaw named SegmentSmack was found in the way the     Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending     specially modified packets within ongoing TCP sessions     which could lead to a CPU saturation and hence a denial     of service on the system. Maintaining the denial of     service condition requires continuous two-way TCP     sessions to a reachable open port, thus the attacks     cannot be performed using spoofed IP addresses.

  - ALSA sequencer core initializes the event pool on     demand by invoking snd_seq_pool_init() when the first     write happens and the pool is empty. A user can reset     the pool size manually via ioctl concurrently, and this     may lead to UAF or out-of-bound access.

  - The do_get_mempolicy() function in mm/mempolicy.c in     the Linux kernel allows local users to hit a     use-after-free bug via crafted system calls and thus     cause a denial of service (DoS) or possibly have     unspecified other impact. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service (out-of-     bounds access) or possibly have unspecified other impact     by sending a XFRM_MSG_MIGRATE netlink message. This flaw     is present in the Linux kernel since an introduction of     XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3.
    (CVE-2017-11600)

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a privilege     escalation. (CVE-2017-13215)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system. (CVE-2017-16939)

  - An address corruption flaw was discovered in the Linux     kernel built with hardware breakpoint     (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a     h/w breakpoint via 'modify_user_hw_breakpoint' routine,     an unprivileged user/process could use this flaw to     crash the system kernel resulting in DoS OR to     potentially escalate privileges on a the system.
    (CVE-2018-1000199)

  - The do_get_mempolicy() function in mm/mempolicy.c in the     Linux kernel allows local users to hit a use-after-free     bug via crafted system calls and thus cause a denial of     service (DoS) or possibly have unspecified other impact.
    Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2018-10675)

  - A flaw was found in the Linux kernel's implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory. (CVE-2018-1068)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.
    (CVE-2018-8897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-18079: drivers/input/serio/i8042.c allowed     attackers to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact because the port->exists value     can change after it is validated (bnc#1077922)

  - CVE-2015-1142857: Prevent guests from sending ethernet     flow control pause frames via the PF (bnc#1077355)

  - CVE-2017-17741: KVM allowed attackers to obtain     potentially sensitive information from kernel memory,     aka a write_mmio stack-based out-of-bounds read     (bnc#1073311)

  - CVE-2017-13215: Prevent elevation of privilege     (bnc#1075908)

  - CVE-2018-1000004: Prevent race condition in the sound     system, this could have lead a deadlock and denial of     service condition (bnc#1076017)

  - CVE-2017-17806: The HMAC implementation did not validate     that the underlying cryptographic hash algorithm is     unkeyed, allowing a local attacker able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874)

  - CVE-2017-17805: The Salsa20 encryption algorithm did not     correctly handle zero-length inputs, allowing a local     attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2018-5332: In the Linux kernel the     rds_message_alloc_sgs() function did not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c)     (bnc#1075621).

  - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic     function in net/rds/rdma.c mishandled cases where page     pinning fails or an invalid address is supplied, leading     to an rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel allowed     remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

  - CVE-2017-18079: drivers/input/serio/i8042.c in the Linux     kernel allowed attackers to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact because the port->exists     value can change after it is validated (bnc#1077922).

  - CVE-2017-17741: The KVM implementation in the Linux     kernel allowed attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio     stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h     (bnc#1073311).

  - CVE-2017-13215: A elevation of privilege vulnerability     in the Upstream kernel skcipher. (bnc#1075908).

  - CVE-2018-1000004: In the Linux kernel a race condition     vulnerability exists in the sound system, this can lead     to a deadlock and denial of service condition     (bnc#1076017).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
112206	Virtuozzo 7 : OVMF / crit / criu / criu-devel / ksm-vz / etc (VZA-2018-063)	Nessus	Virtuozzo Local Security Checks	2018/8/31	2024/8/13	high
127185	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0025)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
106815	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0437-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/2/14	2019/9/10	high
108279	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0660-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/3/13	2025/2/4	critical

偵測

搜尋 Plugin

high

high

high

critical