リモートの Ubuntu 16.04 LTS ホストには、USN-3696-1のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  -4.12.9までのLinux カーネルのdrivers/acpi/acpica/nseval.cのacpi_ns_evaluate()関数は、オペランドキャッシュをフラッシュせず、カーネルスタックダンプを発生させます。これにより、ローカルユーザーが、細工されたACPIテーブルを介して、カーネルメモリから機密情報を取得し、（4.9までのカーネルで）KASLR保護メカニズムをバイパスする可能性があります。（CVE-2017-13695）

  - 4.11 以前の Linux カーネルの kernel/events/core.c 内の perf_cpu_time_max_percent_handler 関数により、ローカルユーザーが、大きな値を介して、サービス拒否 (整数オーバーフロー) を引き起こしたり、詳細不明なその他の影響を及ぼしたりする可能性がありました。これは、不正なサンプルレートの計算により実証されています。(CVE-2017-18255)

  - 4.11 以前の Linux カーネル内の fs/f2fs/data.c の __get_data_block 関数では、ローカルユーザーが、FS_IOC_FIEMAP ioctl を使用した open システムコールと fallocate システムコールの細工された使用を介して、サービス拒否 (整数オーバーフローおよびループ) を引き起こす可能性があります。(CVE-2017-18257)

  - Linuxカーネルバージョン 3.18 〜 4.16は、dxfer_direct = SG_DXFER_FROM_DEVと空の6バイトのcmdpで、/dev/sg0のSG_IO ioctlを不適切に処理します。これにより、最大 1000 のカーネルヒープページがユーザー空間にコピーされる可能性があります。これは、https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824のUpstreamで既に修正されています。ユーザーは通常 SCSI デバイスにアクセスする権限を持っていないため、この問題の範囲は限定されています。一方で、たとえば、Neroユーザーマニュアルでは、「chmod o+r+w /dev/sg*」を実行してデバイスをアクセス可能にすることが推奨されています。注意:  攻撃者が CAP_SYS_ADMIN と CAP_SYS_RAWIO の機能の両方を必要とするため、悪用が事実上不可能であることに鑑み、サードパーティはこのレポートの関連性をめぐり議論しています。(CVE-2018-1000204)

  - 4.16 より前の Linux カーネル内の drivers/scsi/libsas/sas_scsi_host.c により、ローカルユーザーが、特定の障害状態をトリガーすることにより、サービス拒否 (ATA QC 漏れ) を引き起こす可能性があります。注意:  障害が発生するのは物理的に接近した攻撃者のみであり、SAS Host Bus Adapter ケーブルを抜いた場合にのみ発生するため、サードパーティはこのレポートの関連性について議論しています。(CVE-2018-10021)

  -4.13より前のLinuxカーネルのkernel/exit.cのkernel_wait4関数により、詳細不明なアーキテクチャおよびコンパイラが使用されている場合、ローカルユーザが、-INT_MINの値を使用する試みを発生させることによって、サービス拒否を引き起こす可能性があります。（CVE-2018-10087）

  - 4.13より前のLinuxカーネル内のkernel/signal.cのkill_something_info関数により、詳細不明なアーキテクチャとコンパイラが使用された場合に、ローカルユーザーが、INT_MIN引数を介して、サービス拒否を引き起こす可能性がありました。（CVE-2018-10124）

  -Intel Coreベースのマイクロプロセッサーを使用するシステム上でLazy FP状態の復元技術を利用するシステムソフトウェアにより、ローカルプロセスが、投機的実行サイドチャネルを通じて他のプロセスからデータを推測する可能性があります。（CVE-2018-3665）

  - バージョン 4.16.11、4.14.43、4.9.102、4.4.133 以前の Linux カーネルの複数の競合状態エラーにより、プローブ操作、切断操作、再バインド操作の処理が悪用され、複数の USB over IP パケットを送信することでメモリ解放後使用 (Use After Free) 状態または NULL ポインターデリファレンスが引き起こされる可能性があります。(CVE-2018-5814)

  -4.15.7までのLinuxカーネルのdrivers/block/floppy.cにあるfd_locked_ioctl関数に問題が発見されました。フロッピードライバーがカーネルポインターを FDGETPRM ioctl のユーザーメモリにコピーします。攻撃者が、FDGETPRM ioctlを送信し、取得したカーネルポインターを使用してカーネルコードとデータの場所を検出し、KASLRなどのカーネルセキュリティ保護をバイパスする可能性があります。(CVE-2018-7755)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートの Ubuntu 14.04 LTS ホストには、USN-3696-2のアドバイザリに記載された複数の脆弱性の影響を受けるパッケージがインストールされています。

  -4.12.9までのLinux カーネルのdrivers/acpi/acpica/nseval.cのacpi_ns_evaluate()関数は、オペランドキャッシュをフラッシュせず、カーネルスタックダンプを発生させます。これにより、ローカルユーザーが、細工されたACPIテーブルを介して、カーネルメモリから機密情報を取得し、（4.9までのカーネルで）KASLR保護メカニズムをバイパスする可能性があります。（CVE-2017-13695）

  - 4.11 以前の Linux カーネルの kernel/events/core.c 内の perf_cpu_time_max_percent_handler 関数により、ローカルユーザーが、大きな値を介して、サービス拒否 (整数オーバーフロー) を引き起こしたり、詳細不明なその他の影響を及ぼしたりする可能性がありました。これは、不正なサンプルレートの計算により実証されています。(CVE-2017-18255)

  - 4.11 以前の Linux カーネル内の fs/f2fs/data.c の __get_data_block 関数では、ローカルユーザーが、FS_IOC_FIEMAP ioctl を使用した open システムコールと fallocate システムコールの細工された使用を介して、サービス拒否 (整数オーバーフローおよびループ) を引き起こす可能性があります。(CVE-2017-18257)

  - Linuxカーネルバージョン 3.18 〜 4.16は、dxfer_direct = SG_DXFER_FROM_DEVと空の6バイトのcmdpで、/dev/sg0のSG_IO ioctlを不適切に処理します。これにより、最大 1000 のカーネルヒープページがユーザー空間にコピーされる可能性があります。これは、https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824のUpstreamで既に修正されています。ユーザーは通常 SCSI デバイスにアクセスする権限を持っていないため、この問題の範囲は限定されています。一方で、たとえば、Neroユーザーマニュアルでは、「chmod o+r+w /dev/sg*」を実行してデバイスをアクセス可能にすることが推奨されています。注意:  攻撃者が CAP_SYS_ADMIN と CAP_SYS_RAWIO の機能の両方を必要とするため、悪用が事実上不可能であることに鑑み、サードパーティはこのレポートの関連性をめぐり議論しています。(CVE-2018-1000204)

  - 4.16 より前の Linux カーネル内の drivers/scsi/libsas/sas_scsi_host.c により、ローカルユーザーが、特定の障害状態をトリガーすることにより、サービス拒否 (ATA QC 漏れ) を引き起こす可能性があります。注意:  障害が発生するのは物理的に接近した攻撃者のみであり、SAS Host Bus Adapter ケーブルを抜いた場合にのみ発生するため、サードパーティはこのレポートの関連性について議論しています。(CVE-2018-10021)

  -4.13より前のLinuxカーネルのkernel/exit.cのkernel_wait4関数により、詳細不明なアーキテクチャおよびコンパイラが使用されている場合、ローカルユーザが、-INT_MINの値を使用する試みを発生させることによって、サービス拒否を引き起こす可能性があります。（CVE-2018-10087）

  - 4.13より前のLinuxカーネル内のkernel/signal.cのkill_something_info関数により、詳細不明なアーキテクチャとコンパイラが使用された場合に、ローカルユーザーが、INT_MIN引数を介して、サービス拒否を引き起こす可能性がありました。（CVE-2018-10124）

  -Intel Coreベースのマイクロプロセッサーを使用するシステム上でLazy FP状態の復元技術を利用するシステムソフトウェアにより、ローカルプロセスが、投機的実行サイドチャネルを通じて他のプロセスからデータを推測する可能性があります。（CVE-2018-3665）

  - バージョン 4.16.11、4.14.43、4.9.102、4.4.133 以前の Linux カーネルの複数の競合状態エラーにより、プローブ操作、切断操作、再バインド操作の処理が悪用され、複数の USB over IP パケットを送信することでメモリ解放後使用 (Use After Free) 状態または NULL ポインターデリファレンスが引き起こされる可能性があります。(CVE-2018-5814)

  -4.15.7までのLinuxカーネルのdrivers/block/floppy.cにあるfd_locked_ioctl関数に問題が発見されました。フロッピードライバーがカーネルポインターを FDGETPRM ioctl のユーザーメモリにコピーします。攻撃者が、FDGETPRM ioctlを送信し、取得したカーネルポインターを使用してカーネルコードとデータの場所を検出し、KASLRなどのカーネルセキュリティ保護をバイパスする可能性があります。(CVE-2018-7755)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートのOracle Linux 6/7ホストに、ELSA-2018-4161アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

  -4.10.9までのLinuxカーネル内のmm/mempolicy.cのset_mempolicyとmbind compat syscallsでの不適切なエラー処理により、ローカルユーザーが、特定のビットマップ操作の失敗をトリガーすることによって、初期化されていないスタックデータから秘密情報を取得する可能性があります。（CVE-2017-7616）

  -4.11より前の、および4.9.36より前の4.9.xのLinuxカーネルのnet/netfilter/xt_TCPMSSにおけるtcpmss_mangle_packet関数により、リモート攻撃者が、iptablesアクションでxt_TCPMSSの存在を利用することで、サービス拒否（メモリ解放後使用（use-after-free）およびメモリ破損）を引き起こしたり、詳細不明なその他の影響を与えたりする可能性があります。
    (CVE-2017-18017)

  - バージョン4.15.8、4.14.25、4.9.87、4.4.121、4.1.51および3.2.102の前のLinuxカーネルで、
    SCTPパケットの長さを処理をする場合、_sctp_make_chunk()関数（net/sctp/sm_make_chunk.c）のエラーが悪用されてカーネルクラッシュを引き起こす可能性があります。（CVE-2018-5803）

  - バージョン4.16-rc7より前のLinuxカーネルは、net/dccp/output.cのdccp_write_xmit()関数でのNULLポインター逆参照に対して脆弱であるため、ローカルユーザーが、多数の細工されたシステムコールによりサービス拒否を引き起こす可能性があります。（CVE-2018-1130）

  -4.12.3までのLinuxカーネルのnet/xfrm/xfrm_policy.cは、CONFIG_XFRM_MIGRATEが有効になっている場合、xfrm_userpolicy_idのdir値がXFRM_POLICY_MAXまたはそれ以下であることを保証していないため、XFRM_MSG_MIGRATE xfrmネットリンクメッセージを介してローカルユーザーがサービス拒否（領域外アクセス）を引き起こしたり、詳細不明なその他の影響を与えることが可能です。（CVE-2017-11600）

  -4.13より前のLinuxカーネルのkernel/exit.cのkernel_wait4関数により、詳細不明なアーキテクチャおよびコンパイラが使用されている場合、ローカルユーザが、-INT_MINの値を使用する試みを発生させることによって、サービス拒否を引き起こす可能性があります。（CVE-2018-10087）

  - 4.13より前のLinuxカーネル内のkernel/signal.cのkill_something_info関数により、詳細不明なアーキテクチャとコンパイラが使用された場合に、ローカルユーザーが、INT_MIN引数を介して、サービス拒否を引き起こす可能性がありました。（CVE-2018-10124）

Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

リモートのOracleVMシステムには、重大なセキュリティ更新に対処するために必要なパッチがありません：- dm：dm_get_from_kobjectと__dm_destroyの競合を修正（Hou Tao）（CVE-2017-18203）- drm：udl：フレームバッファのmmapオフセットを正しくチェック（Greg Kroah-Hartman）[Orabug:27986407]（CVE-2018-8781）- kernel/exit.c：wait4を呼び出すときの未定義の動作を回避： wait4（-2147483648, 0x20, 0, 0xdd0000）は次をトリガーします：UBSAN：kernel/exit.c:1651:9の未定義の動作（mridula shastry）[Orabug:27875488]（CVE-2018-10087）- kernel/signal.c：kill_something_infoの未定義の動作を回避：ユーザー空間でkill（72057458746458112、0）を実行しているとき、次の問題が発生しました。（mridula shastry）（CVE-2018-10124）- bluetooth：sco_sock_bindでソケットアドレスの長さを検証します。（mlevatic）[Orabug:28130293]（CVE-2015-8575）- dccp_sendmsgで、ソケットが閉じられた状態かどうかを確認（Alexey Kodanev）[Orabug:28220402]（CVE-2017-8824）（CVE-2018-1130）- sctp：_sctp_make_chunkで新しいチャンクのサイズを確認（Alexey Kodanev）[Orabug:28240075]（CVE-2018-5803）- mm/mempolicy.c：set_mempolicyとmbindのエラー処理を修正します。（Chris Salls）[Orabug:28242478]（CVE-2017-7616）- xfrm：policy：ポリシー方向の値をチェック（Vladis Dronov）[Orabug:28264121]（CVE-2017-11600）（CVE-2017-11600）- x86/fpu：eager FPUをデフォルトに設定（Mihai Carabas）[Orabug:28156176]（CVE-2018-3665）- KVM：write_mmioのstack-out-of-bounds読み取りを修正（Wanpeng Li）[Orabug:27951287]（CVE-2017-17741）（CVE-2017-17741）- xfs：xfs_bmap_extents_to_btreeの場合、形式をエクステントに再設定（Eric Sandeen）[Orabug:27989498]（CVE-2018-10323）- Bluetooth：EFS要素からのスタック情報の漏えいを防止します。（Ben Seri）[Orabug:28030520]（CVE-2017-1000410）（CVE-2017-1000410）- ALSA：hrtimer：hrtimer_cancelによるストールを修正（Takashi Iwai）[Orabug:28058229]（CVE-2016-2549）- ALSA：timer：スレーブタイマーリスト処理の強化（Takashi Iwai）[Orabug:28058229]（CVE-2016-2547）（CVE-2016-2548）- ALSA：timer：active_listの二重リンク解除を修正（Takashi Iwai）[Orabug:28058229]（CVE-2016-2545）- ALSA：seq：remove_events ioctlのNULLチェック欠落を修正（Takashi Iwai）[Orabug:28058229]（CVE-2016-2543）- ALSA：seq：タイマーの設定と終了時の競合を修正（Takashi Iwai）[Orabug:28058229]（CVE-2016-2544）- ALSA：usb-audio：umidiオブジェクトを2回解放しないようにする（Andrey Konovalov）[Orabug:28058229]（CVE-2016-2384）- perf/hwbp：perf-hwbpコードを簡潔化、ドキュメントを修正（Linus Torvalds）[Orabug:27947608]（CVE-2018-1000199）- 「perf/hwbp：perf-hwbpコードを簡潔化、ドキュメントを修正」を元に戻す（Brian Maly）[Orabug:27947608]

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3696-1 advisory.

  - The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does     not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-13695)

  - The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an incorrect sample-rate calculation. (CVE-2017-18255)

  - The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to     cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system     calls with an FS_IOC_FIEMAP ioctl. (CVE-2017-18257)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based     microprocessors may potentially allow a local process to infer data from another process through a     speculative execution side channel. (CVE-2018-3665)

  - In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors     when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free     condition or a NULL pointer dereference by sending multiple USB over IP packets. (CVE-2018-5814)

  - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel     through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM     ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the     location of kernel code and data and bypass kernel security protections such as KASLR. (CVE-2018-7755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3696-2 advisory.

  - The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does     not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-13695)

  - The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an incorrect sample-rate calculation. (CVE-2017-18255)

  - The __get_data_block function in fs/f2fs/data.c in the Linux kernel before 4.11 allows local users to     cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system     calls with an FS_IOC_FIEMAP ioctl. (CVE-2017-18257)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

  - System software utilizing Lazy FP state restore technique on systems using Intel Core-based     microprocessors may potentially allow a local process to infer data from another process through a     speculative execution side channel. (CVE-2018-3665)

  - In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors     when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free     condition or a NULL pointer dereference by sending multiple USB over IP packets. (CVE-2018-5814)

  - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel     through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM     ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the     location of kernel code and data and bypass kernel security protections such as KASLR. (CVE-2018-7755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4161 advisory.

  - Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux     kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by     triggering failure of a certain bitmap operation. (CVE-2017-7616)

  - The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x     before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption)     or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
    (CVE-2017-18017)

  - In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the
    _sctp_make_chunk() function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be     exploited to cause a kernel crash. (CVE-2018-5803)

  - Linux kernel before version 4.16-rc7 is vulnerable to a null pointer dereference in dccp_write_xmit()     function in net/dccp/output.c in that allows a local user to cause a denial of service by a number of     certain crafted system calls. (CVE-2018-1130)

  - net/xfrm/xfrm_policy.c in the Linux kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is enabled, does not     ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allows local users to     cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an     XFRM_MSG_MIGRATE xfrm Netlink message. (CVE-2017-11600)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - dm: fix race between dm_get_from_kobject and
    __dm_destroy (Hou Tao) (CVE-2017-18203)

  - drm: udl: Properly check framebuffer mmap offsets (Greg     Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781)

  - kernel/exit.c: avoid undefined behaviour when calling     wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers:
    UBSAN: Undefined behaviour in kernel/exit.c:1651:9     (mridula shastry) [Orabug: 27875488] (CVE-2018-10087)

  - kernel/signal.c: avoid undefined behaviour in     kill_something_info When running kill(72057458746458112,     0) in userspace I hit the following issue. (mridula     shastry) (CVE-2018-10124)

  - bluetooth: Validate socket address length in     sco_sock_bind. (mlevatic) [Orabug: 28130293]     (CVE-2015-8575)

  - dccp: check sk for closed state in dccp_sendmsg (Alexey     Kodanev) [Orabug: 28220402] (CVE-2017-8824)     (CVE-2018-1130)

  - sctp: verify size of a new chunk in _sctp_make_chunk     (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803)

  - mm/mempolicy.c: fix error handling in set_mempolicy and     mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616)

  - xfrm: policy: check policy direction value (Vladis     Dronov) [Orabug: 28264121] (CVE-2017-11600)     (CVE-2017-11600)

  - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug:
    28156176] (CVE-2018-3665)

  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng     Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741)

  - xfs: set format back to extents if     xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug:
    27989498] (CVE-2018-10323)

  - Bluetooth: Prevent stack info leak from the EFS element.
    (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410)     (CVE-2017-1000410)

  - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2549)

  - ALSA: timer: Harden slave timer list handling (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548)

  - ALSA: timer: Fix double unlink of active_list (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2545)

  - ALSA: seq: Fix missing NULL check at remove_events ioctl     (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543)

  - ALSA: seq: Fix race at timer setup and close (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2544)

  - ALSA: usb-audio: avoid freeing umidi object twice     (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384)

  - perf/hwbp: Simplify the perf-hwbp code, fix     documentation (Linus Torvalds) [Orabug: 27947608]     (CVE-2018-1000199)

  - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix     documentation' (Brian Maly) [Orabug: 27947608]

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly     validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-     of-bounds read and system crash) via a crafted ext4 image. (CVE-2016-10208)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. (CVE-2017-11473)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0. (CVE-2017-14991)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system crash) or possibly have unspecified other impact     via a crafted USB device, related to a missing warm-start check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). (CVE-2017-16538)

  - The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11     allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16643)

  - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (improper error handling and system crash) or possibly     have unspecified other impact via a crafted USB device. (CVE-2017-16644)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an incorrect sample-rate calculation. (CVE-2017-18255)

  - In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands,     setting unwanted defaults or causing a denial of service. (CVE-2017-18270)

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of service (use-after-free) via a crafted application     that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. (CVE-2017-2584)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5     places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which     allows local users to obtain sensitive information by reading the log. (CVE-2017-5549)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds     access. (CVE-2017-5897)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages     lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on     IrDA devices. (CVE-2017-6348)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers     to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

  - The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5     allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified     other impact by changing a certain sequence-number value, aka a double fetch vulnerability.
    (CVE-2017-8831)

  - The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9984)

  - The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9985)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to     cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system     calls. (CVE-2018-10675)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a     root directory with a zero i_links_count, which allows attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. (CVE-2018-1092)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows     local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out     kernel memory. (CVE-2018-10940)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):The walk_hugetlb_range()     function in 'mm/pagewalk.c' file in the Linux kernel     from v4.0-rc1 through v4.15-rc1 mishandles holes in     hugetlb ranges. This allows local users to obtain     sensitive information from uninitialized kernel memory     via crafted use of the mincore() system     call.(CVE-2017-16994)In the Linux kernel before 4.7,     the amd_gpio_remove function in     drivers/pinctrl/pinctrl-amd.c calls the     pinctrl_unregister function, leading to a double     free.(CVE-2017-18174)In the Linux kernel through     4.20.11, af_alg_release() in crypto/af_alg.c neglects     to set a NULL value for a certain structure member,     which leads to a use-after-free in     sockfs_setattr.(CVE-2019-8912)A security flaw was found     in the Linux kernel that an attempt to move page mapped     by AIO ring buffer to the other node triggers NULL     pointer dereference at trace_writeback_dirty_page(),     because aio_fs_backing_dev_info.dev is     0.(CVE-2016-3070)The NFSv4 implementation in the Linux     kernel through 4.11.1 allows local users to cause a     denial of service (resource consumption) by leveraging     improper channel callback shutdown when unmounting an     NFSv4 filesystem, aka a 'module reference and kernel     daemon' leak.(CVE-2017-9059)When creating audit records     for parameters to executed children processes, an     attacker can convince the Linux kernel audit subsystem     can create corrupt records which may allow an attacker     to misrepresent or evade logging of executing     commands.(CVE-2016-6136)A use-after-free vulnerability     was found in a network namespaces code affecting the     Linux kernel since v4.0-rc1 through v4.15-rc5. The     function get_net_ns_by_id() does not check for the     net::count value after it has found a peer network in     netns_ids idr which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)A NULL pointer dereference     flaw was found in the rds_ib_laddr_check() function in     the Linux kernel's implementation of Reliable Datagram     Sockets (RDS). A local, unprivileged user could use     this flaw to crash the system.(CVE-2013-7339)A flaw was     found in the Linux kernel key management subsystem in     which a local attacker could crash the kernel or     corrupt the stack and additional memory (denial of     service) by supplying a specially crafted RSA key. This     flaw panics the machine during the verification of the     RSA key.(CVE-2016-8650)The uio_mmap_physical function     in drivers/uio/uio.c in the Linux kernel before 3.12     does not validate the size of a memory block, which     allows local users to cause a denial of service (memory     corruption) or possibly gain privileges via crafted     mmap operations, a different vulnerability than     CVE-2013-4511.(CVE-2013-6763)In the Linux kernel before     4.20.5, attackers can trigger a     drivers/char/ipmi/ipmi_msghandler.c use-after-free and     OOPS by arranging for certain simultaneous execution of     the code, as demonstrated by a 'service ipmievd     restart' loop.(CVE-2019-9003)An integer overflow flaw     was found in the way the Linux kernel randomized the     stack for processes on certain 64-bit architecture     systems, such as x86-64, causing the stack entropy to     be reduced by four.(CVE-2015-1593)The     compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)The kill_something_info     function in kernel/signal.c in the Linux kernel before     4.13, when an unspecified architecture and compiler is     used, might allow local users to cause a denial of     service via an INT_MIN     argument.(CVE-2018-10124)arch/s390/kernel/head64.S in     the Linux kernel before 3.13.5 on the s390 platform     does not properly handle attempted use of the linkage     stack, which allows local users to cause a denial of     service (system crash) by executing a crafted     instruction.(CVE-2014-2039)A flaw was found in the     Linux kernel in that the aoedisk_debugfs_show()     function in drivers/block/aoe/aoeblk.c allows local     users to obtain some kernel address information by     reading a debugfs file. This address is not useful to     commit a further attack.(CVE-2018-7754)ALSA sequencer     core initializes the event pool on demand by invoking     snd_seq_pool_init() when the first write happens and     the pool is empty. A user can reset the pool size     manually via ioctl concurrently, and this may lead to     UAF or out-of-bound access.(CVE-2018-7566)In the     function wmi_set_ie(), the length validation code does     not handle unsigned integer overflow properly. As a     result, a large value of the 'ie_len' argument can     cause a buffer overflow in all Android releases from     CAF (Android for MSM, Firefox OS for MSM, QRD Android)     using the Linux Kernel.(CVE-2018-5848)The Linux kernel     does not properly initialize memory in messages passed     between virtual guests and the host operating system in     the vhost/vhost.c:vhost_new_msg() function. This can     allow local privileged users to read some kernel memory     contents when reading from the /dev/vhost-net device     file.(CVE-2018-1118)Systems with microprocessors     utilizing speculative execution and speculative     execution of memory reads before the addresses of all     prior memory writes are known may allow unauthorized     disclosure of information to an attacker with local     user access via a side-channel analysis, aka     Speculative Store Bypass (SSB), Variant     4.(CVE-2018-3639)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
110896	Ubuntu 16.04 LTS : Linux カーネル脆弱性 (USN-3696-1)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/1/9	high
110897	Ubuntu 14.04 LTS : Linux カーネル (Xenial HWE) の脆弱性 (USN-3696-2)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/1/9	high
110997	Oracle Linux 6/7：Unbreakable Enterprise Kernel（ELSA-2018-4161）	Nessus	Oracle Linux Local Security Checks	2018/7/11	2021/9/8	critical
111022	OracleVM 3.3：Unbreakable/etc（OVMSA-2018-0237）	Nessus	OracleVM Local Security Checks	2018/7/12	2019/9/27	high
111414	openSUSEセキュリティ更新プログラム：Linuxカーネル（openSUSE-2018-762）（Spectre）	Nessus	SuSE Local Security Checks	2018/7/30	2023/8/24	high
112113	Ubuntu 14.04 LTS : Linux カーネル脆弱性 (USN-3754-1)	Nessus	Ubuntu Local Security Checks	2018/8/24	2024/1/9	critical
110896	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3696-1)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/1/9	high
110897	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3696-2)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/1/9	high
110997	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4161)	Nessus	Oracle Linux Local Security Checks	2018/7/11	2021/9/8	critical
111022	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)	Nessus	OracleVM Local Security Checks	2018/7/12	2019/9/27	high
111414	openSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)	Nessus	SuSE Local Security Checks	2018/7/30	2023/8/24	high
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	2018/8/24	2024/1/9	critical
131845	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)	Nessus	Huawei Local Security Checks	2019/12/10	2024/4/5	critical
124991	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1538)	Nessus	Huawei Local Security Checks	2019/5/14	2021/1/6	critical

偵測

搜尋 Plugin

high

high

critical

high

high

critical

high

high

critical

high

high

critical

critical

critical