Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-0861

Robb Glasser reported a potential use-after-free in the ALSA (sound) PCM core. We believe this was not possible in practice.

CVE-2017-5715

Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using the 'retpoline' compiler feature which allows indirect branches to be isolated from speculative execution.

CVE-2017-13166

A bug in the 32-bit compatibility layer of the v4l2 ioctl handling code has been found. Memory protections ensuring user-provided buffers always point to userland memory were disabled, allowing destination addresses to be in kernel space. On a 64-bit kernel (amd64 flavour) a local user with access to a suitable video device can exploit this to overwrite kernel memory, leading to privilege escalation.

CVE-2017-16526

Andrey Konovalov reported that the UWB subsystem may dereference an invalid pointer in an error case. A local user might be able to use this for denial of service.

CVE-2017-16911

Secunia Research reported that the USB/IP vhci_hcd driver exposed kernel heap addresses to local users. This information could aid the exploitation of other vulnerabilities.

CVE-2017-16912

Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to an out-of-bounds read. A remote user able to connect to the USB/IP server could use this for denial of service.

CVE-2017-16913

Secunia Research reported that the USB/IP stub driver failed to perform a range check on a received packet header field, leading to excessive memory allocation. A remote user able to connect to the USB/IP server could use this for denial of service.

CVE-2017-16914

Secunia Research reported that the USB/IP stub driver failed to check for an invalid combination of fields in a received packet, leading to a NULL pointer dereference. A remote user able to connect to the USB/IP server could use this for denial of service.

CVE-2017-18017

Denys Fedoryshchenko reported that the netfilter xt_TCPMSS module failed to validate TCP header lengths, potentially leading to a use-after-free. If this module is loaded, it could be used by a remote attacker for denial of service or possibly for code execution.

CVE-2017-18203

Hou Tao reported that there was a race condition in creation and deletion of device-mapper (DM) devices. A local user could potentially use this for denial of service.

CVE-2017-18216

Alex Chen reported that the OCFS2 filesystem failed to hold a necessary lock during nodemanager sysfs file operations, potentially leading to a NULL pointer dereference. A local user could use this for denial of service.

CVE-2018-1068

The syzkaller tool found that the 32-bit compatibility layer of ebtables did not sufficiently validate offset values. On a 64-bit kernel (amd64 flavour), a local user with the CAP_NET_ADMIN capability could use this to overwrite kernel memory, possibly leading to privilege escalation.

CVE-2018-1092

Wen Xu reported that a crafted ext4 filesystem image would trigger a null dereference when mounted. A local user able to mount arbitrary filesystems could use this for denial of service.

CVE-2018-5332

Mohamed Ghannam reported that the RDS protocol did not sufficiently validate RDMA requests, leading to an out-of-bounds write. A local attacker on a system with the rds module loaded could use this for denial of service or possibly for privilege escalation.

CVE-2018-5333

Mohamed Ghannam reported that the RDS protocol did not properly handle an error case, leading to a NULL pointer dereference. A local attacker on a system with the rds module loaded could possibly use this for denial of service.

CVE-2018-5750

Wang Qize reported that the ACPI sbshc driver logged a kernel heap address. This information could aid the exploitation of other vulnerabilities.

CVE-2018-5803

Alexey Kodanev reported that the SCTP protocol did not range-check the length of chunks to be created. A local or remote user could use this to cause a denial of service.

CVE-2018-6927

Li Jinyue reported that the FUTEX_REQUEUE operation on futexes did not check for negative parameter values, which might lead to a denial of service or other security impact.

CVE-2018-7492

The syzkaller tool found that the RDS protocol was lacking a NULL pointer check. A local attacker on a system with the rds module loaded could use this for denial of service.

CVE-2018-7566

&#x8303;&#x9F99;&#x98DE; (Fan LongFei) reported a race condition in the ALSA (sound) sequencer core, between write and ioctl operations.
This could lead to an out-of-bounds access or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation.

CVE-2018-7740

Nic Losby reported that the hugetlbfs filesystem's mmap operation did not properly range-check the file offset. A local user with access to files on a hugetlbfs filesystem could use this to cause a denial of service.

CVE-2018-7757

Jason Yan reported a memory leak in the SAS (Serial-Attached SCSI) subsystem. A local user on a system with SAS devices could use this to cause a denial of service.

CVE-2018-7995

Seunghun Han reported a race condition in the x86 MCE (Machine Check Exception) driver. This is unlikely to have any security impact.

CVE-2018-8781

Eyal Itkin reported that the udl (DisplayLink) driver's mmap operation did not properly range-check the file offset. A local user with access to a udl framebuffer device could exploit this to overwrite kernel memory, leading to privilege escalation.

CVE-2018-8822

Dr Silvio Cesare of InfoSect reported that the ncpfs client implementation did not validate reply lengths from the server. An ncpfs server could use this to cause a denial of service or remote code execution in the client.

CVE-2018-1000004

Luo Quan reported a race condition in the ALSA (sound) sequencer core, between multiple ioctl operations. This could lead to a deadlock or use-after-free. A local user with access to a sequencer device could use this for denial of service or possibly for privilege escalation.

CVE-2018-1000199

Andy Lutomirski discovered that the ptrace subsystem did not sufficiently validate hardware breakpoint settings. Local users can use this to cause a denial of service, or possibly for privilege escalation, on x86 (amd64 and i386) and possibly other architectures.

Additionally, some mitigations for CVE-2017-5753 are included in this release :

CVE-2017-5753

Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system.

This specific attack has been named Spectre variant 1 (bounds-check bypass) and is mitigated by identifying vulnerable code sections (array bounds checking followed by array access) and replacing the array access with the speculation-safe array_index_nospec() function.

More use sites will be added over time.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.101-1. This version also includes bug fixes from upstream versions up to and including 3.2.101. It also fixes a regression in the procfs hidepid option in the previous version (Debian bug #887106).

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3654-1 advisory.

    Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read     may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A     local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's client-side     implementation of the cifs protocol. This flaw allows     an attacker controlling the server to kernel panic a     client which has the CIFS server     mounted.(CVE-2018-1066)

  - In the Linux Kernel before version 4.15.8, 4.14.25,     4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the     '_sctp_make_chunk()' function     (net/sctp/sm_make_chunk.c) when handling SCTP packets     length can be exploited to cause a kernel     crash.(CVE-2018-5803)

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757)

  - A race condition in the store_int_with_restart()     function in arch/x86/kernel/cpu/mcheck/mce.c in the     Linux kernel allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck (cpu     number) directory.(CVE-2018-7995)

  - ALSA sequencer core initializes the event pool on     demand by invoking snd_seq_pool_init() when the first     write happens and the pool is empty. A user can reset     the pool size manually via ioctl concurrently, and this     may lead to UAF or out-of-bound access.(CVE-2018-7566)

  - A flaw was found in the Linux kernel's implementation     of 32-bit syscall interface for bridging. This allowed     a privileged user to arbitrarily write to a limited     range of kernel memory.(CVE-2018-1068)

  - A vulnerability was found in the Linux kernel's     kernel/events/core.c:perf_cpu_time_max_percent_handler(     ) function. Local privileged users could exploit this     flaw to cause a denial of service due to integer     overflow or possibly have unspecified other     impact.(CVE-2017-18255)

  - The code in the drivers/scsi/libsas/sas_scsi_host.c     file in the Linux kernel allow a physically proximate     attacker to cause a memory leak in the ATA command     queue and, thus, denial of service by triggering     certain failure conditions.(CVE-2018-10021)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186)

  - The snd_compr_tstamp function in     sound/core/compress_offload.c in the Linux kernel     through 4.7, as used in Android before 2016-08-05 on     Nexus 5 and 7 (2013) devices, does not properly     initialize a timestamp data structure, which allows     attackers to obtain sensitive information via a crafted     application, aka Android internal bug 28770164 and     Qualcomm internal bug CR568717.(CVE-2014-9892)

  - A memory leak in the cx23888_ir_probe() function in     drivers/media/pci/cx23885/cx23888-ir.c in the Linux     kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering     kfifo_alloc() failures, aka     CID-a7b2df76b42b.(CVE-2019-19054)

  - A memory leak in the adis_update_scan_mode() function     in drivers/iio/imu/adis_buffer.c in the Linux kernel     before 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-ab612b1daf41.(CVE-2019-19060)

  - A memory leak in the adis_update_scan_mode_burst()     function in drivers/iio/imu/adis_buffer.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial     of service (memory consumption), aka     CID-9c0530e898f3.(CVE-2019-19061)

  - A memory leak in the crypto_report() function in     crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service     (memory consumption) by triggering crypto_report_alg()     failures, aka CID-ffdde5932042.(CVE-2019-19062)

  - A memory leak in the ccp_run_sha_cmd() function in     drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-128c66429247.(CVE-2019-18808)

  - In ashmem_ioctl of ashmem.c, there is an out-of-bounds     write due to insufficient locking when accessing asma.
    This could lead to a local elevation of privilege     enabling code execution as a privileged process with no     additional execution privileges needed. User     interaction is not needed for exploitation. Product:
    Android. Versions: Android kernel. Android ID:
    A-66954097.(CVE-2017-13216)

  - A certain backport in the TCP Fast Open implementation     for the Linux kernel before 3.18 does not properly     maintain a count value, which allow local users to     cause a denial of service (system crash) via the Fast     Open feature, as demonstrated by visiting the     chrome://flags/#enable-tcp-fast-open URL when using     certain 3.10.x through 3.16.x kernel builds, including     longterm-maintenance releases and ckt (aka Canonical     Kernel Team) builds.(CVE-2015-3332)

  - The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel before 4.5.5     does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory by reading a Netlink     message.(CVE-2016-4486)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the     Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in     an IPv6 packet, which trigger an out-of-bounds     access.(CVE-2017-5897)

  - In the Linux kernel before version 4.12, Kerberos 5     tickets decoded when using the RXRPC keys incorrectly     assumes the size of a field. This could lead to the     size-remaining variable wrapping and the data pointer     going over the end of the buffer. This could possibly     lead to memory corruption and possible privilege     escalation.(CVE-2017-7482)

  - A flaw was found in the Linux Kernel where an attacker     may be able to have an uncontrolled read to     kernel-memory from within a vm guest. A race condition     between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte     information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other     clients.(CVE-2018-14625)

  - drivers/net/usb/asix_devices.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16647)

  - A memory leak in the ql_alloc_large_buffers() function     in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux     kernel before 5.3.5 allows local users to cause a     denial of service (memory consumption) by triggering     pci_dma_mapping_error() failures, aka     CID-1acb8f2a7a9f.(CVE-2019-18806)

  - An issue was discovered in the fd_locked_ioctl function     in drivers/block/floppy.c in the Linux kernel through     4.15.7. The floppy driver will copy a kernel pointer to     user memory in response to the FDGETPRM ioctl. An     attacker can send the FDGETPRM ioctl and use the     obtained kernel pointer to discover the location of     kernel code and data and bypass kernel security     protections such as KASLR.(CVE-2018-7755)

  - The usbvision driver in the Linux kernel package     3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red     Hat Enterprise Linux (RHEL) 7.1 allows physically     proximate attackers to cause a denial of service     (panic) via a nonzero bInterfaceNumber value in a USB     device descriptor.(CVE-2015-7833)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network.(CVE-2019-3846)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the     Linux kernel 5.2.14 does not check the alloc_workqueue     return value, leading to a NULL pointer     dereference.(CVE-2019-16232)

  - drivers/net/wireless/intel/iwlwifi/pcie/trans.c in the     Linux kernel 5.2.14 does not check the alloc_workqueue     return value, leading to a NULL pointer     dereference.(CVE-2019-16234)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14     does not check the alloc_workqueue return value,     leading to a NULL pointer dereference.(CVE-2019-16231)

  - Insufficient access control in the Intel(R)     PROSet/Wireless WiFi Software driver before version     21.10 may allow an unauthenticated user to potentially     enable denial of service via adjacent     access.(CVE-2019-0136)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other     consequences.(CVE-2019-10126)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from     influencing the key length negotiation. This allows     practical brute-force attacks (aka 'KNOB') that can     decrypt traffic and inject arbitrary ciphertext without     the victim noticing.(CVE-2019-9506)

  - An issue was discovered in net/wireless/nl80211.c in     the Linux kernel through 5.2.17. It does not check the     length of variable elements in a beacon head, leading     to a buffer overflow.(CVE-2019-16746)

  - In the hidp_process_report in bluetooth, there is an     integer overflow. This could lead to an out of bounds     write with no additional execution privileges needed.
    User interaction is not needed for exploitation.
    Product: Android Versions: Android kernel Android ID:
    A-65853588 References: Upstream kernel.(CVE-2018-9363)

  - An issue was discovered in write_tpt_entry in     drivers/infiniband/hw/cxgb4/mem.c in the Linux kernel     through 5.3.2. The cxgb4 driver is directly calling     dma_map_single (a DMA function) from a stack variable.
    This could allow an attacker to trigger a Denial of     Service, exploitable if this driver is used on an     architecture for which this stack/DMA interaction has     security relevance.(CVE-2019-17075)

  - rtl_p2p_noa_ie in     drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux     kernel through 5.3.6 lacks a certain upper-bound check,     leading to a buffer overflow.(CVE-2019-17666)

  - arch/arm/mm/dma-mapping.c in the Linux kernel before     3.13 on ARM platforms, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     prevent executable DMA mappings, which might allow     local users to gain privileges via a crafted     application, aka Android internal bug 28803642 and     Qualcomm internal bug CR642735.(CVE-2014-9888)

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c     in the Linux kernel before 4.14.15. There is an out of     bounds write in the function     i2c_smbus_xfer_emulated.(CVE-2017-18551)

  - The rds_ib_xmit function in net/rds/ib_send.c in the     Reliable Datagram Sockets (RDS) protocol implementation     in the Linux kernel 3.7.4 and earlier allows local     users to cause a denial of service (BUG_ON and kernel     panic) by establishing an RDS connection with the     source IP address equal to the IPoIB interface's own IP     address, as demonstrated by rds-ping.(CVE-2012-2372)

  - In the Linux kernel through 5.3.2,     cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c     does not reject a long SSID IE, leading to a Buffer     Overflow.(CVE-2019-17133)

  - A memory leak in the bfad_im_get_stats() function in     drivers/scsi/bfa/bfad_attr.c in the Linux kernel     through 5.3.11 allows attackers to cause a denial of     service (memory consumption) by triggering     bfa_port_get_stats() failures, aka     CID-0e62395da2bd.(CVE-2019-19066)

  - The kernel in Android before 2016-08-05 on Nexus 7     (2013) devices allows attackers to gain privileges via     a crafted application, aka internal bug     28522518.(CVE-2016-3857)

  - arch/arm64/kernel/sys.c in the Linux kernel before 4.0     allows local users to bypass the 'strict page     permissions' protection mechanism and modify the     system-call table, and consequently gain privileges, by     leveraging write access.(CVE-2015-8967)

  - arch/arm64/kernel/perf_event.c in the Linux kernel     before 4.1 on arm64 platforms allows local users to     gain privileges or cause a denial of service (invalid     pointer dereference) via vectors involving events that     are mishandled during a span of multiple HW     PMUs.(CVE-2015-8955)

  - The __clear_user function in     arch/arm64/lib/clear_user.S in the Linux kernel before     3.17.4 on the ARM64 platform allows local users to     cause a denial of service (system crash) by reading one     byte beyond a /dev/zero page boundary.(CVE-2014-7843)

  - The x86/fpu (Floating Point Unit) subsystem in the     Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not     correctly handle attempts to set reserved bits in the     xstate header via the ptrace() or rt_sigreturn() system     call, allowing local users to read the FPU registers of     other processes on the system, related to     arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c.(CVE-2017-15537)

  - The Linux kernel before 3.11 on ARM platforms, as used     in Android before 2016-08-05 on Nexus 5 and 7 (2013)     devices, does not properly consider user-space access     to the TPIDRURW register, which allows local users to     gain privileges via a crafted application, aka Android     internal bug 28749743 and Qualcomm internal bug     CR561044.(CVE-2014-9870)

  - ** DISPUTED ** Race condition in the     store_int_with_restart() function in     arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel     through 4.15.7 allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck     directory. NOTE: a third party has indicated that this     report is not security relevant.(CVE-2018-7995)

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing     is enabled and the sep CPU feature flag is set, allows     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000.(CVE-2014-4508)

  - arch/x86/kernel/tls.c in the Thread Local Storage (TLS)     implementation in the Linux kernel through 3.18.1     allows local users to bypass the espfix protection     mechanism, and consequently makes it easier for local     users to bypass the ASLR protection mechanism, via a     crafted application that makes a set_thread_area system     call and later reads a 16-bit value.(CVE-2014-8133)

  - arch/mips/include/asm/thread_info.h in the Linux kernel     before 3.14.8 on the MIPS platform does not configure
    _TIF_SECCOMP checks on the fast system-call path, which     allows local users to bypass intended PR_SET_SECCOMP     restrictions by executing a crafted application without     invoking a trace or audit subsystem.(CVE-2014-4157)

  - Integer signedness error in the oz_hcd_get_desc_cnf     function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows     remote attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via a crafted     packet.(CVE-2015-4001)

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 does not ensure that     certain length values are sufficiently large, which     allows remote attackers to cause a denial of service     (system crash or large loop) or possibly execute     arbitrary code via a crafted packet, related to the (1)     oz_usb_rx and (2) oz_usb_handle_ep_data     functions.(CVE-2015-4002)

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003)

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004)

  - Race condition in the sclp_ctl_ioctl_sccb function in     drivers/s390/char/sclp_ctl.c in the Linux kernel before     4.6 allows local users to obtain sensitive information     from kernel memory by changing a certain length value,     aka a 'double fetch' vulnerability.(CVE-2016-6130)

  - The print_binder_transaction_ilocked function in     drivers/android/binder.c in the Linux kernel 4.14.90     allows local users to obtain sensitive address     information by reading '*from *code *flags' lines in a     debugfs file.(CVE-2018-20510)

  - In the Linux kernel before 4.1.4, a buffer overflow     occurs when checking userspace params in     drivers/media/dvb-frontends/cx24116.c. The maximum size     for a DiSEqC command is 6, according to the userspace     API. However, the code allows larger values such as     23.(CVE-2015-9289)

  - The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel through 4.11.5 allows local users to cause a     denial of service (out-of-bounds array access) or     possibly have unspecified other impact by changing a     certain sequence-number value, aka a 'double fetch'     vulnerability.(CVE-2017-8831)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A race condition in the store_int_with_restart()     function in arch/x86/kernel/cpu/mcheck/mce.c in the     Linux kernel allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinechecki1/4^cpu     numberi1/4%0 directory.(CVE-2018-7995i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。- CVE-2015-9016 Ming Lei 报告多队列块层 (blk-mq) 中存在一个争用条件。在具有使用 blk-mq（mtip32xx、null_blk 或 virtio_blk）的驱动程序的系统上，本地用户可利用此问题导致拒绝服务或权限升级。- CVE-2017-0861 Robb Glasser 报告 ALSA（音频）PCM 核心中可能存在释放后使用。我们认为实践中不可能出现此问题。- CVE-2017-5715 多名研究人员在多个支持推测执行的处理器中发现一个漏洞，攻击者可通过该漏洞控制非特权进程从任意地址读取内存，包括从内核和系统上运行的所有其他进程读取内存。这种特定的攻击称为 Spectre 变体 2（分支目标注入），针对 x86 架构（amd64 和 i386），通过使用“retpoline”编译器功能予以缓解，该功能可实现间接分支与推测执行之间的隔离。- CVE-2017-5753 多名研究人员在多个支持推测执行的处理器中发现一个漏洞，攻击者可通过该漏洞控制非特权进程从任意地址读取内存，包括从内核和系统上运行的所有其他进程读取内存。这种特定的攻击称为 Spectre 变体 1（边界检查绕过），通过识别易受攻击的代码段（先检查数组边界，再访问数组），然后使用推测安全的 array_index_nospec() 函数替换数组访问来予以缓解。随着时间的推移，将会增加更多的使用站点。- CVE-2017-13166 在 v4l2 ioctl 处理代码的 32 位兼容性层中发现一个错误。确保用户提供的缓冲区始终指向用户空间内存的内存保护遭到禁用，从而允许目的地位于内核空间中。在 64 位内核上，有权访问合适视频设备的本地用户可利用此错误覆盖内核内存，从而导致权限提升。- CVE-2017-13220 Al Viro 报告蓝牙 HIDP 实现可能在执行必要的类型检查之前取消引用指针。本地用户可利用此问题导致拒绝服务。- CVE-2017-16526 Andrey Konovalov 报告 UWB 子系统可能在错误情况下取消引用无效指针。本地用户可利用此问题导致拒绝服务。- CVE-2017-16911 Secunia Research 报告 USB/IP vhci_hcd 驱动程序将内核堆地址泄露给本地用户。此信息可能有助于利用其他漏洞。- CVE-2017-16912 Secunia Research 报告 USB/IP stub 驱动程序未对接收到的数据包标头字段执行范围检查，从而导致越界读取。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。- CVE-2017-16913 Secunia Research 报告 USB/IP stub 驱动程序未对接收到的数据包标头字段执行范围检查，从而导致过量内存分配。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。- CVE-2017-16914 Secunia Research 报告 USB/IP stub 驱动程序未检查接收到的数据包中是否有无效字段组合，从而导致空指针取消引用。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。- CVE-2017-18017 Denys Fedoryshchenko 报告 netfilter xt_TCPMSS 模块未验证 TCP 标头长度，可导致释放后使用。如果加载此模块，远程攻击者可利用其导致拒绝服务或可能导致代码执行。- CVE-2017-18203 Hou Tao 报告创建和删除设备映射器 (DM) 设备时存在一个争用条件。本地用户可利用此问题导致拒绝服务。- CVE-2017-18216 Alex Chen 报告 OCFS2 文件系统在 nodemanager sysfs 文件操作期间未保持必要的锁定，可能导致空指针取消引用。本地用户可利用此问题导致拒绝服务。- CVE-2017-18232 Jason Yan 报告 SAS (Serial-Attached SCSI) 子系统中探测和销毁端口之间存在一个争用条件。这可导致死锁。实际存在攻击者可利用此问题导致拒绝服务。- CVE-2017-18241 Yunlei He 报告使用“noflush_merge”挂载选项时 f2fs 实现未正确初始化其状态。有权访问挂载此选项的文件系统的本地用户可利用此问题造成拒绝服务。- CVE-2018-1066 Dan Aloni 向 Red Hat 报告称，如果在 NTLMSSP 设置协商的过程中，服务器发送了无效的响应，则CIFS 客户端实现可能会取消引用空指针。恶意服务器可利用此问题导致拒绝服务。- CVE-2018-1068 syzkaller 工具发现 ebtables 的 32 位兼容层未充分验证偏移量值。在 64 位内核上，（在任何用户命名空间中）具有 CAP_NET_ADMIN 能力的本地用户可利用此错误覆盖内核内存，可能导致权限升级。Debian 在默认情况下禁用非特权用户命名空间。- CVE-2018-1092 Wen Xu 报告特制的 ext4 文件系统图像在挂载时可触发空指针取消引用。能够挂载任意文件系统的本地用户可利用此问题造成拒绝服务。- CVE-2018-5332 Mohamed Ghannam 报告 RDS 协议未充分验证 RDMA 请求，可导致越界写入。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务或可能升级权限。- CVE-2018-5333 Mohamed Ghannam 报告 RDS 协议未充分处理错误情况，可导致空指针取消引用。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务。- CVE-2018-5750 Wang Qize 报告 ACPI sbshc 驱动程序记录内核堆地址。此信息可能有助于利用其他漏洞。- CVE-2018-5803 Alexey Kodanev 报告 SCTP 协议未对要创建的区块长度进行范围检查。本地或远程用户可利用此问题导致拒绝服务。- CVE-2018-6927 Li Jinyue 报告对 futex 进行的 FUTEX_REQUEUE 操作未检查负参数值，可导致拒绝服务或其他安全影响。- CVE-2018-7492 syzkaller 工具发现 RDS 协议缺少空指针检查。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务。- CVE-2018-7566 Fan LongFei 报告 ALSA（音频）音序器核心中写入和 ioctl 操作之间存在一个争用条件。此问题可导致越界访问或释放后使用。有权访问音序器设备的本地用户可利用此问题造成拒绝服务或者可能造成权限升级。- CVE-2018-7740 Nic Losby 报告 hugetlbfs 文件系统的 mmap 操作未正确对文件偏移量进行范围检查。有权访问 hugetlbfs 文件系统上文件的本地用户可利用此问题造成拒绝服务。- CVE-2018-7757 Jason Yan 报告了 SAS (Serial-Attached SCSI) 子系统中存在内存泄露。具有 SAS 设备的系统上的本地用户可利用此问题造成拒绝服务。- CVE-2018-7995 Seunghun Han 报告 x86 MCE (Machine Check Exception) 驱动程序中存在一个争用条件。这不太可能对安全产生任何影响。- CVE-2018-8781 Eyal Itkin 报告 udl (DisplayLink) 驱动程序的 mmap 操作未正确对文件偏移量进行范围检查。有权访问 udl 帧缓冲设备的本地用户可利用此错误覆盖内核内存，从而导致权限提升。- CVE-2018-8822 InfoSect 的 Silvio Cesare 博士报告 ncpfs 客户端实现未验证服务器的回复长度。ncpfs 服务器可利用此问题导致客户端中拒绝服务或远程代码执行。- CVE-2018-1000004 Luo Quan 报告 ALSA（音频）音序器核心中多个 ioctl 操作之间存在一个争用条件。此问题可导致死锁或释放后使用。有权访问音序器设备的本地用户可利用此问题造成拒绝服务或者可能造成权限升级。- CVE-2018-1000199 Andy Lutomirski 报告 ptrace 子系统未充分验证硬件断点设置。本地攻击者可利用此问题在 x86（amd64 和 i386）以及可能在其他架构上造成拒绝服务，或可能实现权限升级。

在 Linux 内核中发现多个可能导致权限升级、拒绝服务或信息泄漏的漏洞。

CVE-2017-0861

Robb Glasser 报告了 ALSA (音频) PCM 核心中可能出现的释放后使用问题。我们认为实际不可能出现此问题。

CVE-2017-5715

多名研究人员在多个支持推测执行的处理器中发现一个漏洞，攻击者可通过该漏洞控制非特权进程从任意地址读取内存，包括从内核和系统上运行的所有其他进程读取内存。

这种特定的攻击称为 Spectre 变体 2（分支目标注入），针对 x86 架构（amd64 和 i386），通过使用“retpoline”编译器功能予以缓解，该功能可实现间接分支与推测执行之间的隔离。

CVE-2017-13166

在 v4l2 ioctl 处理代码的 32 位兼容性层中发现一个故障。确保用户提供的缓冲区始终指向用户空间内存的内存保护遭到禁用，从而允许目的地位于内核空间中。在 64 位内核（amd64 风格）上，有权访问合适视频设备的本地用户可利用此错误覆盖内核内存，从而导致权限提升。

CVE-2017-16526

Andrey Konovalov 报告了 UWB 子系统可能在错误情况下取消引用无效指针。本地用户可利用此问题导致拒绝服务。

CVE-2017-16911

Secunia Research 报告了 USB/IP vhci_hcd 驱动程序将内核堆地址泄露给本地用户。此信息可能有助于利用其他漏洞。

CVE-2017-16912

Secunia Research 报告了 USB/IP stub 驱动程序未对接收到的数据包标头字段执行范围检查，从而导致越界读取。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。

CVE-2017-16913

Secunia Research 报告了 USB/IP stub 驱动程序未对接收到的数据包标头字段执行范围检查，从而导致过量内存分配。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。

CVE-2017-16914

Secunia Research 报告了 USB/IP stub 驱动程序未检查接收到的数据包中是否有无效字段组合，从而导致空指针取消引用。能够连接到 USB/IP 服务器的远程用户可利用此问题造成拒绝服务。

CVE-2017-18017

Denys Fedoryshchenko 报告了 netfilter xt_TCPMSS 模块未验证 TCP 标头长度，可导致释放后使用。如果加载此模块，远程攻击者可利用其导致拒绝服务或可能导致代码执行。

CVE-2017-18203

Hou Tao 报告了创建和删除设备映射器 (DM) 设备时存在一个争用条件。本地用户可利用此问题导致拒绝服务。

CVE-2017-18216

Alex Chen 报告了 OCFS2 文件系统在 nodemanager sysfs 文件操作期间未保持必要的锁定，可能导致空指针取消引用。本地用户可利用此问题导致拒绝服务。

CVE-2018-1068

Syzkaller 工具发现 ebtables 的 32 位兼容层未充分验证偏移量值。在 64 位内核（amd64 风格）上，具有 CAP_NET_ADMIN 能力的本地用户可利用此错误覆盖内核内存，可能导致权限升级。

CVE-2018-1092

Wen Xu 报告了特制的 ext4 文件系统图像在挂载时可触发空指针取消引用。能够挂载任意文件系统的本地用户可利用此问题造成拒绝服务。

CVE-2018-5332

Mohamed Ghannam 报告了 RDS 协议未充分验证 RDMA 请求，可导致越界写入。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务或可能升级权限。

CVE-2018-5333

Mohamed Ghannam 报告了 RDS 协议未充分处理错误情况，可导致空指针取消引用。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务。

CVE-2018-5750

Wang Qize 报告了 ACPI sbshc 驱动程序记录内核堆地址。此信息可能有助于利用其他漏洞。

CVE-2018-5803

Alexey Kodanev 报告了 SCTP 协议未对要创建的区块长度进行范围检查。本地或远程用户可利用此问题导致拒绝服务。

CVE-2018-6927

Li Jinyue 报告了对 futex 进行的 FUTEX_REQUEUE 操作未检查负参数值，可导致拒绝服务或其他安全问题。

CVE-2018-7492

Syzkaller 工具发现 RDS 协议缺少空指针检查。加载 rds 模块的系统上的本地攻击者可利用此问题造成拒绝服务。

CVE-2018-7566

范龙飞 (Fan LongFei) 报告了 ALSA（音频）音序器核心中写入和 ioctl 操作之间存在一个争用条件。
此问题可导致越界访问或释放后使用。有权访问音序器设备的本地用户可利用此问题造成拒绝服务或者可能造成权限升级。

CVE-2018-7740

Nic Losby 报告 hugetlbfs 文件系统的 mmap 操作未正确对文件偏移量进行范围检查。有权访问 hugetlbfs 文件系统上文件的本地用户可利用此问题造成拒绝服务。

CVE-2018-7757

Jason Yan 报告了 SAS (Serial-Attached SCSI) 子系统中存在内存泄露。具有 SAS 设备的系统上的本地用户可利用此问题造成拒绝服务。

CVE-2018-7995

Seunghun Han 报告了 x86 MCE (Machine Check Exception) 驱动程序中存在一个争用条件。这不太可能对安全产生任何影响。

CVE-2018-8781

Eyal Itkin 报告了 udl (DisplayLink) 驱动程序的 mmap 操作未正确对文件偏移量进行范围检查。有权访问 udl 帧缓冲设备的本地用户可利用此错误覆盖内核内存，从而导致权限提升。

CVE-2018-8822

InfoSect 的 Silvio Cesare 博士报告了 ncpfs 客户端实现未验证服务器的回复长度。ncpfs 服务器可利用此问题导致客户端中拒绝服务或远程代码执行。

CVE-2018-1000004

Luo Quan 报告了 ALSA（音频）音序器核心中多个 ioctl 操作之间存在一个争用条件。此问题可导致死锁或释放后使用。有权访问音序器设备的本地用户可利用此问题造成拒绝服务或者可能造成权限升级。

CVE-2018-1000199

Andy Lutomirski 报告了 ptrace 子系统未充分验证硬件断点设置。本地攻击者可利用此问题在 x86（amd64 和 i386）以及可能在其他架构上造成拒绝服务，或可能实现权限升级。

此外，此版本中还包含一些针对 CVE-2017-5753 的缓解措施。

CVE-2017-5753

多名研究人员在多个支持推测执行的处理器中发现一个漏洞，攻击者可通过该漏洞控制非特权进程从任意地址读取内存，包括从内核和系统上运行的所有其他进程读取内存。

这种特定的攻击称为 Spectre 变体 1（边界检查绕过），通过识别易受攻击的代码段（先检查数组边界，再访问数组），然后使用推测安全的 array_index_nospec() 函数替换数组访问来予以缓解。

随着时间的推移，将会增加更多的使用站点。

对于 Debian 7“Wheezy”，这些问题已在 3.2.101-1 版本中修复。此版本还包括 3.2.101 及之前上游版本的错误修复。此版本还修复了之前版本 procfs hidepid 选项中的回归（Debian 错误 #887106 ）。

建议您升级 linux 程序包。

注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

远程 Ubuntu 16.04 LTS 主机上安装的一个程序包受到 USN-3654-1 公告中提及的多个漏洞影响。

  - 在 4.14.10 及之前的 Linux 内核中，drivers/media/usb/usbtv/usbtv-core.c 中的 usbtv_probe 函数存在释放后使用漏洞，导致攻击者可以通过触发音频注册失败造成拒绝服务或其他不明影响，这是因为 usbtv 数据结构的 kfree 发生在 usbtv_video_free 调用期间，但 usbtv_video_fail 标签的代码尝试访问和释放此数据结构。(CVE-2017-17975)

  - 在 4.13 之前的 Linux 内核中，fs/f2fs/extent_cache.c 处理范围树不当，导致本地用户可以通过含有多个线程的应用程序造成拒绝服务（错误）。(CVE-2017-18193)

  - 在 4.12 之前的 Linux 内核中，Hisilicon Network Subsystem (HNS) 在检索 sset_count 数据时未考虑 ETH_SS_PRIV_FLAGS 情况，导致本地用户造成拒绝服务（缓冲区溢出和内存损坏）或造成其他不明影响，hns_get_sset_count 与 ethtool_get_strings 之间不兼容即为一例。(CVE-2017-18222)

  - 在 4.15.7 及之前的 Linux 内核中，netfilter 子系统未正确处理包含跳转但缺少用户定义链的规则 blob 的情况，导致本地用户可以通过利用 CAP_NET_RAW 或 CAP_NET_ADMIN 功能造成拒绝服务，此问题与 net/ipv4/netfilter/arp_tables.c 中的 arpt_do_table、net/ipv4/netfilter/ip_tables.c 中的 ipt_do_table 和 net/ipv6/netfilter/ip6_tables.c 中的 ip6t_do_table 相关。(CVE-2018-1065)

  - 在 Linux 4.x 内核用于桥接的 32 位系统调用接口实现中发现一个缺陷。特权用户可利用此缺陷，在有限范围的内核内存中任意写入数据。(CVE-2018-1068)

  - net/dccp/output.c 的 dccp_write_xmit() 函数中存在空指针取消引用，本地用户可利用此漏洞，通过大量构建的特定系统调用，造成拒绝服务，版本低于 4.16-rc7 的 Linux 内核容易受到此漏洞的影响。(CVE-2018-1130)

  - 在不知道之前所有内存写入地址的情况下，使用推测执行和内存读取推测执行的微处理器所在的系统在未经授权的情况下，可通过边信道分析，向具有本地用户访问权限的攻击者泄露信息，亦即推测存储绕过 (SSB) 变体 4。(CVE-2018-3639)

  - 在版本低于 4.15.8、4.14.25、4.9.87、4.4.121、4.1.51 和 3.2.102 的 Linux 内核中，
    处理 SCTP 数据包长度时，_sctp_make_chunk() 函数 (net/sctp/sm_make_chunk.c) 中存在错误，攻击者可利用此漏洞，造成内核崩溃。(CVE-2018-5803)

  - 在 4.11 之前的 Linux 内核中，block/blk-cgroup.c 中的 blkcg_init_queue 函数允许本地用户通过触发创建失败造成拒绝服务（双重释放），或者造成其他不明影响。(CVE-2018-7480)

  - 在 Linux 内核 4.15.7 及之前版本中，drivers/scsi/libsas/sas_expander.c 的 sas_smp_get_phy_events 函数中存在内存泄露，本地用户可利用此漏洞，通过对 /sys/class/sas_phy 目录中的文件多次读取访问，造成拒绝服务（内存消耗），/sys/class/sas_phy/phy-1: 0: 12/invalid_dword_count 文件即为一例。(CVE-2018-7757)

  - 在 4.15.7 及之前的 Linux 内核中，arch/x86/kernel/cpu/mcheck/mce.c 中的 store_int_with_restart() 函数存在争用条件问题，导致本地用户可以利用写入 /sys/devices/system/machinecheck/machinecheck<cpu number> 目录中 check_interval 文件的根访问权限，造成拒绝服务（错误）。
    注意：第三方已表示此报告与安全无关 (CVE-2018-7995)

  - 在 Linux 内核 3.4 至 4.15（包括）版本中，drivers/gpu/drm/udl/udl_fb.c 中的 udl_fb_mmap 函数中存在整数溢出漏洞，具有 udldrmfb 驱动程序访问权限的本地用户可利用此漏洞，获取内核物理页的完整读写权限，在内核空间中执行代码。(CVE-2018-8781)

  - 在 4.15.11 及之前的 Linux 内核中的 fs/ncpfs/ncplib_kernel.c 中以及在 4.16-rc 至 4.16-rc6 的 Linux 内核的 drivers/staging/ncpfs/ncplib_kernel.c 中，ncp_read_kernel 函数存在缓冲区长度处理不正确漏洞，恶意 NCPFS 服务器可借此造成内核崩溃或执行代码。
    (CVE-2018-8822)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 6 / 7 主机上安装的程序包受到 ELSA-2019-4316 公告中提及的多个漏洞的影响。- 当用于 Red Hat Enterprise Linux 7、kernel-rt 和 Enterprise MRG 2 时，并且在启用 UEFI 安全启动的情况下启动时，本地用户可利用 Linux 内核，通过在 kexec 重新启动时不正确处理 secure_boot 标记，绕过预期 securelevel/secureboot 限制。(CVE-2015-7837) - 在低于 4.3.3 的 Linux 内核版本中，IPv6 堆栈未正确处理选项数据，本地用户可利用此漏洞，通过构建的 sendmsg 系统调用，获取权限，或造成拒绝服务（释放后使用和系统崩溃）。(CVE-2016-3841) - 在低于 4.11 的 Linux 内核版本以及低于 4.9.36 的 4.9.x 版本中，远程攻击者可利用 net/netfilter/xt_TCPMSS.c 中的 tcpmss_mangle_packet 函数，通过在 iptables 操作中使用存在的 xt_TCPMSS，造成拒绝服务（释放后使用和内存损坏），或可能造成其他不明影响。(CVE-2017-18017) - 在 Linux 内核 4.12、3.10、2.6 及更低版本中，声音系统中存在争用条件漏洞，可造成死锁和拒绝服务情况。(CVE-2018-1000004) - 在低于 4.14.8 的 Linux 内核版本中，Salsa20 加密算法未正确处理零长度输入，本地攻击者可利用此漏洞使用基于 AF_ALG 的 skcipher 接口 (CONFIG_CRYPTO_USER_API_SKCIPHER)，通过执行使用 blkcipher_walk API 的构建系统调用序列，造成拒绝服务（未初始化内存释放和内核崩溃），或造成其他不明影响。Salsa20 的通用实现 (crypto/salsa20_generic.c) 和 x86 实现 (arch/x86/crypto/salsa20_glue.c) 都容易受到漏洞的影响。(CVE-2017-17805) - 在 Linux 内核 4.15.15 及之前版本中，fs/ext4/inode.c 中的 ext4_iget 函数未正确处理 i_links_count 为零时的根目录情况，攻击者可利用此漏洞，通过构建的 ext4 映像，造成拒绝服务（ext4_process_freed_data 空指针取消引用和 OOPS）。(CVE-2018-1092) - 在 wmi_set_ie() 函数中，长度验证码未正确处理无符号整数溢出。因此，在 CAF 中发布的使用 Linux 内核的所有 Android 版本（Android for MSM、Firefox OS for MSM、QRD Android）中，较大“ie_len”参数值可造成缓冲区溢出。(CVE-2018-5848) - 在 Linux 内核 4.15.7 及之前版本中，drivers/scsi/libsas/sas_expander.c 的 sas_smp_get_phy_events 函数中存在内存泄漏，本地用户可利用此漏洞，通过对 /sys/class/sas_phy 目录中的文件多次读取访问，造成拒绝服务（内存消耗），/sys/class/sas_phy/phy-1: 0: 12/invalid_dword_count 文件即为一例。(CVE-2018-7757) - 发现原始 midi 内核驱动程序未防御并发访问，导致 rawmidi.c 文件内 snd_rawmidi_ioctl() 处理程序中的 snd_rawmidi_input_params() 和 snd_rawmidi_output_status() 中出现双重 realloc（双重释放）。本地恶意攻击者可能利用此问题，提升权限。(CVE-2018-10902) - 内核 scsi 驱动程序中存在权限提升漏洞。产品：Android。版本：Android 内核。
Android ID A-65023233。(CVE-2017-13168) - **存在争议** Linux 内核 3.18 至 4.16 版本未正确使用 dxfer_direction=SG_DXFER_FROM_DEV 和 6 字节空 cmdp 来处理 /dev/sg0 中的 SG_IO ioctl。此漏洞可导致最多将 1000 个内核堆页面复制到用户空间。此问题已在 http://www.nessus.org/u?5d4e77b1 中的上游版本中修复。此问题影响的范围有限，因为用户通常无权访问 SCSI 设备。此外，Nero 用户手册建议通过执行“chmod o+r+w /dev/sg*”访问这些设备。注意：第三方对此报告的相关内容存在争议，并指出攻击者必须使用 CAP_SYS_ADMIN 和 CAP_SYS_RAWIO 功能，因此很难利用此漏洞。(CVE-2018-1000204) - 在 Linux 内核 4.19 及之前版本中发现一个问题。本地攻击者可利用 drivers/cdrom/cdrom.c 的 cdrom_ioctl_select_disc 中的信息泄露读取内核内存，因为从未签名的 long 转换到 int 会干扰边界检查。此问题类似于 CVE-2018-10940 和 CVE-2018-16658。(CVE-2018-18710) - 在低于 3.18.2 的 Linux 内核版本中，UDF 文件系统实现未验证某些长度，本地用户可利用此漏洞，通过构建的文件系统映像，造成拒绝服务（缓冲区过度读取和系统崩溃），此问题与 fs/udf/inode.c 和 fs/udf/symlink.c 相关。(CVE-2014-9728) - 在低于 4.6.1 的 Linux 内核版本中，arch/x86/kvm/mtrr.c 中的 msr_mtrr_valid 函数支持 MSR 0x2f8，客户机操作系统用户可利用此漏洞在 kvm_arch_vcpu 数据结构中读取或写入数据，从而通过构建的 ioctl 调用，获取敏感信息或造成拒绝服务（系统崩溃）。(CVE-2016-3713) - 在低于 4.14.8 的 Linux 内核版本中，HMAC 实现 (crypto/hmac.c) 未验证底层加密哈希算法是否未加密，本地攻击者可利用此漏洞使用基于 AF_ALG 的哈希接口 (CONFIG_CRYPTO_USER_API_HASH) 和 SHA-3 哈希算法 (CONFIG_CRYPTO_SHA3)，通过执行缺少 SHA-3 初始化的构建系统调用序列，造成内核堆栈缓冲区溢出。(CVE-2017-17806) -  在 Linux 内核 4.15.7 及之前版本的 drivers/block/floppy.c 中的 fd_locked_ioctl 函数中发现一个问题。软盘驱动程序将内核指针复制到用户内存，可响应 FDGETPRM ioctl。攻击者可发送 FDGETPRM ioctl 并使用已获取的内核指针，发现内核代码和数据的位置，并绕过内核安全保护机制，例如 KASLR。(CVE-2018-7755) - **存在争议
** 在低于 4.16 的 Linux 内核版本中，本地用户可利用 drivers/scsi/libsas/sas_scsi_host.c，通过触发某些失败情形，造成拒绝服务（ata qc 泄露）。注意：第三方对此报告的相关内容存在争议，因为只有在物理邻近攻击者拔出 SAS 主机总线适配器电缆时才会造成失败。
(CVE-2018-10021) - 在低于 4.12.4 的 Linux 内核版本中，攻击者可利用 drivers/input/serio/i8042.c，造成拒绝服务（空指针取消引用和系统崩溃），或可能造成其他不明影响，这是经过验证后 port->exists 值会更改所致。(CVE-2017-18079) - 在 Linux 内核 4.12.10 及之前版本中，drivers/scsi/qla2xxx/qla_attr.c 中的 qla2x00_sysfs_write_optrom_ctl 函数中存在整数溢出，本地用户可利用此漏洞，通过使用根访问权，造成拒绝服务（内存损坏和系统崩溃）。
(CVE-2017-14051) - 在 Linux 内核 4.14.4 及之前版本中，对于 add_callback 和 remove_callback 操作，net/netfilter/xt_osf.c 不需要使用 CAP_NET_ADMIN 功能，本地用户可利用此漏洞，绕过预期访问限制，这是跨所有网络命名空间共享 xt_osf_fingers 数据结构所致。(CVE-2017-17450) - **存在争议** 在 Linux 内核 4.15.7 及之前版本中，arch/x86/kernel/cpu/mcheck/mce.c 中的 store_int_with_restart() 函数中存在争用条件，本地用户可利用此漏洞，通过使用根访问权限在 /sys/devices/system/machinecheck/machinecheck 目录中的 check_interval 文件中写入数据，造成拒绝服务（错误）。注意：第三方指出此报告与安全无关。(CVE-2018-7995) - 在 drivers/hid/hid-debug.c 的 hid_debug_events_read 中，可能存在越界写入，这是缺少边界检查所致。这可能会导致本地权限提升，并需要系统执行权限。不需用户交互即可恶意利用。产品：Android 版本：Android 内核 Android ID：A-71361580。(CVE-2018-9516) 请注意，Nessus 没有测试此问题，而仅依赖于应用程序自我报告的版本号。

ID	名稱	產品	系列	已發布	已更新	嚴重性
109531	Debian DLA-1369-1 : linux security update (Spectre)	Nessus	Debian Local Security Checks	2018/5/3	2025/3/19	critical
110048	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3654-1)	Nessus	Ubuntu Local Security Checks	2018/5/23	2024/8/27	high
117569	EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1260)	Nessus	Huawei Local Security Checks	2018/9/18	2024/8/6	high
131805	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-2531)	Nessus	Huawei Local Security Checks	2019/12/9	2022/5/18	critical
124820	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1497)	Nessus	Huawei Local Security Checks	2019/5/13	2025/3/20	medium
109517	Debian DSA-4187-1：linux - 安全更新 (Spectre)	Nessus	Debian Local Security Checks	2018/5/2	2024/10/15	critical
109531	Debian DLA-1369-1: Linux 安全更新 (Spectre)	Nessus	Debian Local Security Checks	2018/5/3	2025/3/19	critical
110048	Ubuntu 16.04 LTS：Linux 内核漏洞 (USN-3654-1)	Nessus	Ubuntu Local Security Checks	2018/5/23	2024/8/27	high
120977	Oracle Linux 6 / 7：Unbreakable Enterprise 内核 (ELSA-2019-4316)	Nessus	Oracle Linux Local Security Checks	2019/1/7	2024/10/23	critical

偵測

搜尋 Plugin

critical

high

high

critical

medium

critical

critical

high

critical