SUSE Linux Enterprise 12 SP4カーネルが更新され、さまざまなセキュリティとバグの修正が行われています。

以下のセキュリティバグが修正されました。

CVE-2018-20669：情報漏洩を引き起こす可能性があった、gpu/drm/i915ドライバーのioctlにおけるアクセス制御チェックの欠落が修正されました。
（bnc#1122971）。

CVE-2019-3459, CVE-2019-3460：Bluetoothスタックは、着信L2cap構成パケットを処理するコードにある2つのリモート情報漏洩の脆弱性の影響を受けていました（bsc#1120758）。

CVE-2019-3819：drivers/hid/hid-debug.cファイル内のhid_debug_events_read()関数に欠陥が見つかりました。この関数は、ユーザー空間から渡された特定のパラメーターで無限ループに入る可能性があります。ローカルの特権ユーザー（「root」）が、システムのロックアップやサービス拒否を引き起こす可能性があります（bnc#1123161）。

CVE-2019-6974：virt/kvm/kvm_main.c内のkvm_ioctl_create_deviceは、競合状態が発生するために参照カウントを誤って処理し、メモリ解放後使用（Use After Free）を引き起こします（bnc#1124728）。

CVE-2019-7221：プリエンプションタイマーのエミュレーションに関連するKVMハイパーバイザーのメモリ解放後使用（Use After Free）の脆弱性を修正しました。この脆弱性によりゲストユーザー/プロセスがホストカーネルをクラッシュできる可能性がありました（bsc#1124732）。

CVE-2019-7222：ページフォールト例外の処理に関連するKVMハイパーバイザーの情報漏洩を修正しました。この問題により、ゲストユーザー/プロセスがこの欠陥を利用して、ホストのスタックメモリの内容をゲストに漏洩することが可能でした（bsc#1124735）。

CVE-2019-7308：kernel/bpf/verifier.cは、状態が異なるさまざまな分岐の場合やサニタイズする制限がある場合など、さまざまな状況でポインター計算に対して望ましくない領域外の投機を実行し、サイドチャネル攻撃を引き起こす可能性があります（bnc#1124055）。

CVE-2019-8912：crypto af_alg.cのaf_alg_release()は特定の構成メンバーにNULL値を設定することをしないため、sockfs_setattrでUse After Freeが発生します（bnc#1125907）。

CVE-2019-8980：fs/exec.cのkernel_read_file関数でのメモリリークにより、攻撃者がvfs_readの失敗を発生させることで、サービス拒否（メモリ消費）を引き起こすことが可能でした（bnc#1126209）。

CVE-2019-9213：mm/mmap.c内のexpand_downwardsにmmapの最小アドレスのチェックがないため、攻撃者がSMAP以外のプラットフォームでカーネルNULLポインターデリファレンスを悪用しやすくなっています。これは、間違ったタスクの機能チェックに関連しています。（bnc#1128166）

CVE-2019-2024：ソースの接続を解除するときに、ソースのクラッシュを引き起こす可能性のあるメモリ解放後使用（Use After Free）が修正されました。（bnc#1129179）

更新パッケージには、セキュリティ関連以外の修正も含まれています。詳細については、アドバイザリを参照してください。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

The SUSE Linux Enterprise Server 12 SP4 Azure kernel was updated to fix various issues.

The following security bugs were fixed :

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166 1128378 1129016).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglected to set a NULL value for a certain structure member, which led to a use-after-free in sockfs_setattr (bnc#1125907 1126284).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728).

CVE-2018-20669: An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c where a local attacker can craft a malicious IOCTL function call to overwrite arbitrary kernel memory, resulting in a Denial of Service or privilege escalation (bnc#1122971).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2018-14625

A use-after-free bug was found in the vhost driver for the Virtual Socket protocol. If this driver is used to communicate with a malicious virtual machine guest, the guest could read sensitive information from the host kernel.

CVE-2018-16884

A flaw was found in the NFS 4.1 client implementation. Mounting NFS shares in multiple network namespaces at the same time could lead to a user-after-free. Local users might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.

This can be mitigated by disabling unprivileged users from creating user namespaces, which is the default in Debian.

CVE-2018-19824

Hui Peng and Mathias Payer discovered a use-after-free bug in the USB audio driver. A physically present attacker able to attach a specially designed USB device could use this for privilege escalation.

CVE-2018-19985

Hui Peng and Mathias Payer discovered a missing bounds check in the hso USB serial driver. A physically present user able to attach a specially designed USB device could use this to read sensitive information from the kernel or to cause a denial of service (crash).

CVE-2018-20169

Hui Peng and Mathias Payer discovered missing bounds checks in the USB core. A physically present attacker able to attach a specially designed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2018-1000026

It was discovered that Linux could forward aggregated network packets with a segmentation size too large for the output device. In the specific case of Broadcom NetXtremeII 10Gb adapters, this would result in a denial of service (firmware crash). This update adds a mitigation to the bnx2x driver for this hardware.

CVE-2019-3459, CVE-2019-3460

Shlomi Oberman, Yuli Shapiro and Karamba Security Ltd. research team discovered missing range checks in the Bluetooth L2CAP implementation.
If Bluetooth is enabled, a nearby attacker could use these to read sensitive information from the kernel.

CVE-2019-3701

Muyu Yu and Marcus Meissner reported that the CAN gateway implementation allowed the frame length to be modified, typically resulting in out-of-bounds memory-mapped I/O writes. On a system with CAN devices present, a local user with CAP_NET_ADMIN capability in the initial net namespace could use this to cause a crash (oops) or other hardware-dependent impact.

CVE-2019-3819

A potential infinite loop was discovered in the HID debugfs interface exposed under /sys/kernel/debug/hid. A user with access to these files could use this for denial of service.

This interface is only accessible to root by default, which fully mitigates the issue.

CVE-2019-6974

Jann Horn reported a use-after-free bug in KVM. A local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-7221

Jim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's nested VMX implementation. On systems with Intel CPUs, a local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

Nested VMX is disabled by default, which fully mitigates the issue.

CVE-2019-7222

Felix Wilhelm reported an information leak in KVM for x86. A local user with access to /dev/kvm could use this to read sensitive information from the kernel.

CVE-2019-8980

A bug was discovered in the kernel_read_file() function used to load firmware files. In certain error conditions it could leak memory, which might lead to a denial of service. This is probbaly not exploitable in a Debian system.

CVE-2019-9213

Jann Horn reported that privileged tasks could cause stack segments, including those in other processes, to grow downward to address 0. On systems lacking SMAP (x86) or PAN (ARM), this exacerbated other vulnerabilities: a NULL pointer dereference could be exploited for privilege escalation rather than only for denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.168-1~deb8u1. This version also includes fixes for Debian bugs #904385, #918103, and #922306; and other fixes included in upstream stable updates.

We recommend that you upgrade your linux-4.9 and linux-latest-4.9 packages. You will need to use 'apt-get upgrade --with-new-pkgs' or 'apt upgrade' as the binary package names have changed.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):An issue was discovered in     rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel     before 5.0.8. There is a race condition leading to a     use-after-free, related to net namespace     cleanup.(CVE-2019-11815)A flaw was found in the Linux     kernel's handle_rx() function in the vhost_net driver.
    A malicious virtual guest, under specific conditions,     can trigger an out-of-bounds write in a kmalloc-8 slab     on a virtual host which may lead to a kernel memory     corruption and a system panic. Due to the nature of the     flaw, privilege escalation cannot be fully ruled     out.(CVE-2018-16880)A NULL pointer dereference security     flaw was found in the Linux kernel in kvm_pv_send_ipi()     in arch/x86/kvm/lapic.c. This allows local users with     certain privileges to cause a denial of service via a     crafted system call to the KVM     subsystem.(CVE-2018-19406)The function     hso_get_config_data in driverset/usb/hso.c in the Linux     kernel through 4.19.8 reads if_num from the USB device     (as a u8) and uses it to index a small array, resulting     in an object out-of-bounds (OOB) read that potentially     allows arbitrary read in the kernel address     space.(CVE-2018-19985)** RESERVED ** This candidate has     been reserved by an organization or individual that     will use it when announcing a new security problem.
    When the candidate has been publicized, the details for     this candidate will be provided.(CVE-2019-3459)**     RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2019-3460)A flaw was found in the     Linux kernel in the function hid_debug_events_read() in     the drivers/hid/hid-debug.c file which may enter an     infinite loop with certain parameters passed from a     userspace. A local privileged user ('root') can cause a     system lock up and a denial of     service.(CVE-2019-3819)In the Linux kernel before     4.20.14, expand_downwards in mm/mmap.c lacks a check     for the mmap minimum address, which makes it easier for     attackers to exploit kernel NULL pointer dereferences     on non-SMAP platforms. This is related to a capability     check for the wrong task.(CVE-2019-9213)A flaw was     found in the Linux kernel's vfio interface     implementation that permits violation of the user's     locked memory limit. If a device is bound to a vfio     driver, such as vfio-pci, and the local attacker is     administratively granted ownership of the device, it     may cause a system memory exhaustion and thus a denial     of service (DoS). Versions 3.10, 4.14 and 4.18 are     vulnerable.(CVE-2019-3882)An infinite loop issue was     found in the vhost_net kernel module in Linux Kernel up     to and including v5.1-rc6, while handling incoming     packets in handle_rx(). It could occur if one end sends     packets faster than the other end can process them. A     guest user, maybe remote one, could use this flaw to     stall the vhost_net kernel thread, resulting in a DoS     scenario.(CVE-2019-3900)It was found that the net_dma     code in tcp_recvmsg() in the 2.6.32 kernel as shipped     in RHEL6 is thread-unsafe. So an unprivileged     multi-threaded userspace application calling recvmsg()     for the same network socket in parallel executed on     ioatdma-enabled hardware with net_dma enabled can leak     the memory, crash the host leading to a     denial-of-service or cause a random memory     corruption.(CVE-2019-3837)A race condition in     perf_event_open() allows local attackers to leak     sensitive data from setuid programs. As no relevant     locks (in particular the cred_guard_mutex) are held     during the ptrace_may_access() call, it is possible for     the specified target task to perform an execve()     syscall with setuid execution before perf_event_alloc()     actually attaches to it, allowing an attacker to bypass     the ptrace_may_access() check and the     perf_event_exit_task(current) call that is performed in     install_exec_creds() during privileged execve() calls.
    This issue affects kernel versions before 4.8.
    (CVE-2019-3901)** RESERVED ** This candidate has been     reserved by an organization or individual that will use     it when announcing a new security problem. When the     candidate has been publicized, the details for this     candidate will be     provided.(CVE-2019-8956)cipso_v4_validate in     includeet/cipso_ipv4.h in the Linux kernel before     3.11.7, when CONFIG_NETLABEL is disabled, allows     attackers to cause a denial of service (infinite loop     and crash), as demonstrated by icmpsic, a different     vulnerability than CVE-2013-0310.(CVE-2013-7470)Note1:
    kernel-4.19.36-vhulk1907.1.0.h529 and earlier versions     in EulerOS Virtualization for ARM 64 3.0.2.0 return     incorrect time information when executing the uname -a     command.Note2: The kernel version number naming format     has been changed after 4.19.36-1.2.184.aarch64, the new     version format is 4.19.36-vhulk1907.1.0.hxxx.aarch64,     which may lead to false positives of this security     advisory.

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - hugetlbfs: don't retry when pool page allocations start     to fail (Mike Kravetz) [Orabug: 29324267]

  - x86/speculation: RSB stuffing with retpoline on Skylake+     cpus (William Roche) [Orabug: 29660924]

  - x86/speculation: reformatting RSB overwrite macro     (William Roche) [Orabug: 29660924]

  - x86/speculation: Dynamic enable and disable of RSB     stuffing with IBRS&!SMEP (William Roche) [Orabug:
    29660924]

  - x86/speculation: STUFF_RSB dynamic enable (William     Roche) [Orabug: 29660924]

  - int3 handler better address space detection on     interrupts (William Roche) [Orabug: 29660924]

  - repairing out-of-tree build functionality (Mark     Nicholson) [Orabug: 29755100]

  - ext4: fix false negatives*and* false positives in     ext4_check_descriptors (Shuning Zhang) [Orabug:
    29797007]

  - ocfs2: fix ocfs2 read inode data panic in ocfs2_iget     (Shuning Zhang) [Orabug: 29233739]

  - Bluetooth: Verify that l2cap_get_conf_opt provides large     enough buffer (Marcel Holtmann) [Orabug: 29526426]     (CVE-2019-3459)

  - Bluetooth: Check L2CAP option sizes returned from     l2cap_get_conf_opt (Marcel Holtmann) [Orabug: 29526426]     (CVE-2019-3459)

  - HID: debug: fix the ring buffer implementation (Vladis     Dronov) [Orabug: 29629481] (CVE-2019-3819)     (CVE-2019-3819)

  - scsi: target: iscsi: Use hex2bin instead of a     re-implementation (Vincent Pelletier) [Orabug: 29778875]     (CVE-2018-14633) (CVE-2018-14633)

  - scsi: libsas: fix a race condition when smp task timeout     (Jason Yan) [Orabug: 29783225] (CVE-2018-20836)

  - scsi: megaraid_sas: return error when create DMA pool     failed (Jason Yan) [Orabug: 29783254] (CVE-2019-11810)

  - Bluetooth: hidp: fix buffer overflow (Young Xiao)     [Orabug: 29786786] (CVE-2011-1079) (CVE-2019-11884)

  - x86/speculation/mds: Add 'mitigations=' support for MDS     (Kanth Ghatraju) [Orabug: 29791046]

  - net: rds: force to destroy connection if t_sock is NULL     in rds_tcp_kill_sock. (Mao Wenan) [Orabug: 29802785]     (CVE-2019-11815)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4670 advisory.

    - Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer (Marcel Holtmann)  [Orabug:
    29526426]  {CVE-2019-3459}
    - Bluetooth: Check L2CAP option sizes returned from l2cap_get_conf_opt (Marcel Holtmann)  [Orabug:
    29526426]  {CVE-2019-3459}
    - HID: debug: fix the ring buffer implementation (Vladis Dronov)  [Orabug: 29629481]  {CVE-2019-3819}     {CVE-2019-3819}
    - scsi: target: iscsi: Use hex2bin instead of a re-implementation (Vincent Pelletier)  [Orabug: 29778875]     {CVE-2018-14633} {CVE-2018-14633}
    - scsi: libsas: fix a race condition when smp task timeout (Jason Yan)  [Orabug: 29783225]     {CVE-2018-20836}
    - scsi: megaraid_sas: return error when create DMA pool failed (Jason Yan)  [Orabug: 29783254]     {CVE-2019-11810}
    - Bluetooth: hidp: fix buffer overflow (Young Xiao)  [Orabug: 29786786]  {CVE-2011-1079} {CVE-2019-11884}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4115-1 advisory.

    Hui Peng and Mathias Payer discovered that the Option USB High Speed driver in the Linux kernel did not     properly validate metadata received from the device. A physically proximate attacker could use this to     cause a denial of service (system crash). (CVE-2018-19985)

    Zhipeng Xie discovered that an infinite loop could be triggered in the CFS Linux kernel process scheduler.
    A local attacker could possibly use this to cause a denial of service. (CVE-2018-20784)

    It was discovered that the Intel Wi-Fi device driver in the Linux kernel did not properly validate certain     Tunneled Direct Link Setup (TDLS). A physically proximate attacker could use this to cause a denial of     service (Wi-Fi disconnect). (CVE-2019-0136)

    It was discovered that the Bluetooth UART implementation in the Linux kernel did not properly check for     missing tty operations. A local attacker could use this to cause a denial of service. (CVE-2019-10207)

    Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values     generated for connectionless networking protocols. A remote attacker could use this to track particular     Linux devices. (CVE-2019-10638)

    Amit Klein and Benny Pinkas discovered that the location of kernel addresses could be exposed by the     implementation of connection-less network protocols in the Linux kernel. A remote attacker could possibly     use this to assist in the exploitation of another vulnerability in the Linux kernel. (CVE-2019-10639)

    It was discovered that an integer overflow existed in the Linux kernel when reference counting pages,     leading to potential use-after-free issues. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2019-11487)

    Jann Horn discovered that a race condition existed in the Linux kernel when performing core dumps. A local     attacker could use this to cause a denial of service (system crash) or expose sensitive information.
    (CVE-2019-11599)

    It was discovered that a null pointer dereference vulnerability existed in the LSI Logic MegaRAID driver     in the Linux kernel. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-11810)

    It was discovered that the GTCO tablet input driver in the Linux kernel did not properly bounds check the     initial HID report sent by the device. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-13631)

    Praveen Pandey discovered that the Linux kernel did not properly validate sent signals in some situations     on PowerPC systems with transactional memory disabled. A local attacker could use this to cause a denial     of service. (CVE-2019-13648)

    It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading     to a buffer overread. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2019-14283)

    It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls,     leading to a division-by-zero. A local attacker could use this to cause a denial of service (system     crash). (CVE-2019-14284)

    Tuba Yavuz discovered that a race condition existed in the DesignWare USB3 DRD Controller device driver in     the Linux kernel. A physically proximate attacker could use this to cause a denial of service.
    (CVE-2019-14763)

    It was discovered that an out-of-bounds read existed in the QLogic QEDI iSCSI Initiator Driver in the     Linux kernel. A local attacker could possibly use this to expose sensitive information (kernel memory).
    (CVE-2019-15090)

    It was discovered that the Raremono AM/FM/SW radio device driver in the Linux kernel did not properly     allocate memory, leading to a use-after-free. A physically proximate attacker could use this to cause a     denial of service or possibly execute arbitrary code. (CVE-2019-15211)

    It was discovered at a double-free error existed in the USB Rio 500 device driver for the Linux kernel. A     physically proximate attacker could use this to cause a denial of service. (CVE-2019-15212)

    It was discovered that a race condition existed in the Advanced Linux Sound Architecture (ALSA) subsystem     of the Linux kernel, leading to a potential use-after-free. A physically proximate attacker could use this     to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-15214)

    It was discovered that a race condition existed in the CPiA2 video4linux device driver for the Linux     kernel, leading to a use-after-free. A physically proximate attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2019-15215)

    It was discovered that a race condition existed in the Softmac USB Prism54 device driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2019-15220)

    It was discovered that a use-after-free vulnerability existed in the AppleTalk implementation in the Linux     kernel if an error occurs during initialization. A local attacker could use this to cause a denial of     service (system crash). (CVE-2019-15292)

    Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux     kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host     system. (CVE-2019-3900)

    Daniele Antonioli, Nils Ole Tippenhauer, and Kasper B. Rasmussen discovered that the Bluetooth protocol     BR/EDR specification did not properly require sufficiently strong encryption key lengths. A physically     proximate attacker could use this to expose sensitive information. (CVE-2019-9506)

    It was discovered that a race condition existed in the USB YUREX device driver in the Linux kernel. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2019-15216)

    It was discovered that the Siano USB MDTV receiver device driver in the Linux kernel made improper     assumptions about the device characteristics. A physically proximate attacker could use this cause a     denial of service (system crash). (CVE-2019-15218)

    It was discovered that the Line 6 POD USB device driver in the Linux kernel did not properly validate data     size information from the device. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2019-15221)

    Muyu Yu discovered that the CAN implementation in the Linux kernel in some situations did not properly     restrict the field size when processing outgoing frames. A local attacker with CAP_NET_ADMIN privileges     could use this to execute arbitrary code. (CVE-2019-3701)

    Vladis Dronov discovered that the debug interface for the Linux kernel's HID subsystem did not properly     validate passed parameters in some situations. A local privileged attacker could use this to cause a     denial of service (infinite loop). (CVE-2019-3819)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-3819 advisory.

  - A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c     file which May enter an infinite loop with certain parameters passed from a userspace. A local privileged     user (root) can cause a system lock up and a denial of service. Versions from v4.18 and newer are     vulnerable. (CVE-2019-3819)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-20669: Missing access control checks in ioctl of gpu/drm/i915 driver were fixed which might have lead to information leaks.
(bnc#1122971).

CVE-2019-3459, CVE-2019-3460: The Bluetooth stack suffered from two remote information leak vulnerabilities in the code that handles incoming L2cap configuration packets (bsc#1120758).

CVE-2019-3819: A flaw was found in the function hid_debug_events_read() in drivers/hid/hid-debug.c file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged user ('root') can cause a system lock up and a denial of service. (bnc#1123161).

CVE-2019-6974: kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandled reference counting because of a race condition, leading to a use-after-free (bnc#1124728 ).

CVE-2019-7221: Fixed a use-after-free vulnerability in the KVM hypervisor related to the emulation of a preemption timer, allowing an guest user/process to crash the host kernel. (bsc#1124732).

CVE-2019-7222: Fixed an information leakage in the KVM hypervisor related to handling page fault exceptions, which allowed a guest user/process to use this flaw to leak the host's stack memory contents to a guest (bsc#1124735).

CVE-2019-7308: kernel/bpf/verifier.c performed undesirable out-of-bounds speculation on pointer arithmetic in various cases, including cases of different branches with different state or limits to sanitize, leading to side-channel attacks (bnc#1124055).

CVE-2019-8912: af_alg_release() in crypto/af_alg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free in sockfs_setattr (bnc#1125907).

CVE-2019-8980: A memory leak in the kernel_read_file function in fs/exec.c allowed attackers to cause a denial of service (memory consumption) by triggering vfs_read failures (bnc#1126209).

CVE-2019-9213: expand_downwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task (bnc#1128166).

CVE-2019-2024: A use-after-free when disconnecting a source was fixed which could lead to crashes. bnc#1129179).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
123413	SUSE SLED12 / SLES12セキュリティ更新プログラム：kernel（SUSE-SU-2019:0765-1）（Spectre）	Nessus	SuSE Local Security Checks	2019/3/27	2022/5/20	high
124050	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1193)	Nessus	SuSE Local Security Checks	2019/4/15	2021/1/19	high
123445	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:0767-1)	Nessus	SuSE Local Security Checks	2019/3/28	2022/5/20	high
124595	Debian DLA-1771-1 : linux-4.9 security update	Nessus	Debian Local Security Checks	2019/5/6	2024/5/29	high
125588	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1636)	Nessus	Huawei Local Security Checks	2019/5/30	2024/5/17	high
125754	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0024)	Nessus	OracleVM Local Security Checks	2019/6/7	2024/5/16	high
125755	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4670)	Nessus	Oracle Linux Local Security Checks	2019/6/7	2024/10/22	high
128475	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4115-1)	Nessus	Ubuntu Local Security Checks	2019/9/3	2024/8/28	critical
215375	Azure Linux 3.0 Security Update: kernel (CVE-2019-3819)	Nessus	Azure Linux Local Security Checks	2025/2/10	2025/2/10	medium
123413	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:0765-1) (Spectre)	Nessus	SuSE Local Security Checks	2019/3/27	2022/5/20	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

critical

medium

high