遠端 Oracle Linux 6/7 主機上安裝的套件受到 ELSA-2017-3659 公告中提及的一個弱點影響。

  在 4.7.4 之前的 Linux 內核的 ext4 和 f2fs 檔案系統加密支援中，fs/crypto/policy.c 的 fscrypt_process_policy 函式中缺少授權檢查，這會允許使用者將加密策略分配給不同使用者擁有的目錄，進而可能引致拒絕 服務。
    (CVE-2016-10318)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

远程 Ubuntu 16.04 LTS 主机上安装的一个程序包受到 USN-3312-1 公告中提及的多个漏洞影响。

  在低于 4.6 版本的 Linux 内核中，drivers/media/tuners/tuner-xc2028.c 中的 xc2028_set_config 函数允许本地用户通过涉及省略特定数据结构的固件名称的向量获取权限，或造成拒绝服务（释放后使用）。CVE-2016-7913

  - 4.5 之前的 Linux 内核内 net/netfilter/nfnetlink.c 中的 nfnetlink_rcv_batch 函数不会检查批量消息的长度字段是否足够大，这让本地用户可以利用 CAP_NET_ADMIN 功能从 kernel 内存获取敏感信息或导致服务拒绝（无限循环或越界读取）。(CVE-2016-7917)

  - 在 Linux 内核 4.8.11 及之前版本中，net/tipc/msg.c 中的 tipc_msg_build 函数未验证最小片段长度和最大数据包大小之间的关系，本地用户可利用此漏洞，通过使用 CAP_NET_ADMIN 功能，获取权限或造成拒绝服务（基于堆的缓冲区溢出）。(CVE-2016-8632)

  - 在 4.8.11 及之前的 Linux 内核中，drivers/vfio/pci/vfio_pci.c 允许本地用户通过利用对 VFIO_DEVICE_SET_IRQS ioctl 调用的 vfio PCI 设备的访问权限（亦称状态机混淆缺陷）绕过整数溢出检查，并造成拒绝服务（内存损坏）或其他不明影响。(CVE-2016-9083)

  - 在 4.8.11 及之前的 Linux 内核的 drivers/vfio/pci/vfio_pci_intrs.c 滥用 kzalloc 函数，这允许本地用户通过利用对 vfio PCI 设备文件的访问权限造成拒绝服务（整数溢出）或其他不明影响。(CVE-2016-9084)

  - 在低于 4.11-rc8 的 Linux 内核版本中发现漏洞，根用户通过以会话密钥环形式加入内部密钥环，即可获取内部密钥环的直接访问权限，如 RHEL-7 或“.builtin_trusted_keys”上游中的“.dns_resolver”。根用户可利用此漏洞，通过在密钥环中添加自设计的新公钥，绕过模块签名验证。(CVE-2016-9604)

  - 在 Linux 内核 4.9.8 及之前版本中，arch/x86/kvm/vmx.c 中的 nested_vmx_check_vmptr 函数未正确模拟 VMXON 指令，KVM L1 客户机操作系统用户可利用此漏洞，通过不当处理页面引用，造成拒绝服务（主机操作系统内存消耗）。(CVE-2017-2596)

  - 在 4.10.8 及之前的 Linux 内核中，net/ipv4/ping.c 中的 ping_unhash 函数在获取特定锁定出现延迟，因此无法确保断开连接函数调用的安全性，这允许本地用户利用套接字系统调用中 IPPROTO_ICMP 协议值的访问权限造成拒绝服务（错误）。(CVE-2017-2671)

  - 在低于 4.9.7 的 Linux 内核版本中，kernel/events/core.c 中存在争用条件，本地用户可利用此漏洞，通过构建的应用程序进行并发 perf_event_open 系统调用，将软件组移至硬件环境，从而获取权限。注意：存在此漏洞的原因是未完整修复 CVE-2016-6786。(CVE-2017-6001)

  - 在低于 4.10.13 的 Linux 内核版本中，本地用户可利用 KEYS 子系统，通过一系列 KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring 调用，造成拒绝服务（内存消耗）。
    (CVE-2017-7472)

  - 在 Linux 内核 4.10.9 及之前版本中，攻击者可利用 crypto/ahash.c，通过在完整队列中触发 EBUSY，造成拒绝服务（调用自己回调的 API 操作和无限递归）。
    (CVE-2017-7618)

  - 在 Linux 内核 4.10.11 及之前版本中，远程攻击者可利用 nfsd 子系统中的 NFSv2/NFSv3 服务器，通过长 RPC 回复，造成拒绝服务（系统崩溃），此问题与 net/sunrpc/svc.c、fs/nfsd/nfs3xdr.c 和 fs/nfsd/nfsxdr.c 相关。(CVE-2017-7645)

  - 在 3.2 及之前的 Linux 内核中，mm 子系统未正确执行 CONFIG_STRICT_DEVMEM 保护机制，这使得本地用户能够通过与 arch/x86/mm/init.c 和 drivers/char/mem.c 相关的能够打开 /dev/mem 文件的应用程序读取或写入第一个兆字节中的内核内存位置（并绕过 slab-allocation 访问权限限制）。(CVE-2017-7889)

  - 在 Linux 内核 4.10.13 及之前版本中，NFSv2 和 NFSv3 服务器实现缺少特定的缓冲区末尾检查，远程攻击者可利用此漏洞，通过构建的请求，触发指针运算错误，或可能造成其他不明影响，此问题与 fs/nfsd/nfs3xdr.c 和 fs/nfsd/nfsxdr.c 相关。
    (CVE-2017-7895)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Oracle Linux 6 / 7 主机上安装的程序包受到 ELSA-2018-4071 公告中提及的多个漏洞的影响。

  - 在低于 4.13.5 的 Linux 内核版本中，当处理器支持 xsave 功能但不支持 xsaves 功能时，x86/fpu（浮点单位）子系统未正确处理通过 ptrace() 或 rt_sigreturn() 系统调用在 xstate 标头中设置保留位的尝试，本地用户可利用此漏洞，读取系统上其他进程的 FPU 寄存器，此问题与 arch/x86/kernel/fpu/regset.c 和 arch/x86/kernel/fpu/signal.c 相关。(CVE-2017-15537)

  - 在 Linux 内核 4.13.11 及之前版本中，本地用户可利用 drivers/media/usb/dvb-usb/dib0700_devices.c，通过构建的 USB 设备，造成拒绝服务（错误和系统崩溃），或可能造成其他不明影响。(CVE-2017-16646)

  - 在 Linux 内核 4.13.11 及之前版本中，本地用户可利用 drivers/usb/misc/usbtest.c 中的 get_endpoints 函数，通过构建的 USB 设备，造成拒绝服务（空指针取消引用和系统崩溃），或可能造成其他不明影响。(CVE-2017-16532)

  - 在 Linux 4.x 内核用于桥接的 32 位系统调用接口实现中发现一个缺陷。特权用户可利用此缺陷，在有限范围的内核内存中任意写入数据。(CVE-2018-1068)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 OracleVM 系统缺少处理关键安全更新所需的补丁：有关详细信息，请参阅 Oracle VM 安全公告 OVMSA-2018-0035。

远程 Oracle Linux 6 / 7 主机上安装的程序包收到 ELSA-2017-3659 公告中提及的漏洞的影响。

  - 在低于 4.7.4 的 Linux 内核版本中，ext4 和 f2fs 文件系统加密支持内 fs/crypto/policy.c 中的 fscrypt_process_policy 函数中缺少授权检查，用户可利用此漏洞，向其他用户拥有的目录分配加密策略，进而可能造成拒绝服务。
    (CVE-2016-10318)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3312-1 advisory.

  - The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6     allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving     omission of the firmware name from a certain data structure. (CVE-2016-7913)

  - The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not     check whether a batch message's length field is large enough, which allows local users to obtain sensitive     information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by     leveraging the CAP_NET_ADMIN capability. (CVE-2016-7917)

  - The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the     relationship between the minimum fragment length and the maximum packet size, which allows local users to     gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN     capability. (CVE-2016-8632)

  - drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer     overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a state machine     confusion bug. (CVE-2016-9083)

  - drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which     allows local users to cause a denial of service (integer overflow) or have unspecified other impact by     leveraging access to a vfio PCI device file. (CVE-2016-9084)

  - It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal     keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its     session keyring. This allows root to bypass module signature verification by adding a new public key of     its own devising to the keyring. (CVE-2016-9604)

  - The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly     emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS     memory consumption) by leveraging the mishandling of page references. (CVE-2017-2596)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain     privileges via a crafted application that makes concurrent perf_event_open system calls for moving a     software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2016-6786. (CVE-2017-6001)

  - The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service     (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
    (CVE-2017-7472)

  - crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API     operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
    (CVE-2017-7618)

  - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers     to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

  - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file,     related to arch/x86/mm/init.c and drivers/char/mem.c. (CVE-2017-7889)

  - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the     end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have     unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4071 advisory.

  - The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in     the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU     registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c. (CVE-2017-15537)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This     allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3659 advisory.

  - A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and     f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption     policy to a directory owned by a different user, potentially creating a denial of service.
    (CVE-2016-10318)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Mounting a crafted EXT4 image read-only leads to an     attacker controlled memory corruption and     SLAB-Out-of-Bounds reads.(CVE-2016-10208i1/4%0

  - An issue was discovered in the hwpoison implementation     in mm/memory-failure.c in the Linux kernel before     5.0.4. When soft_offline_in_use_page() runs on a thp     tail page after pmd is split, an attacker can cause a     denial of service (BUG).(CVE-2019-10124i1/4%0

  - A stack-based buffer overflow flaw was found in the     Linux kernel's early load microcode functionality. On a     system with UEFI Secure Boot enabled, a local,     privileged user could use this flaw to increase their     privileges to the kernel (ring0) level, bypassing     intended restrictions in place.(CVE-2015-2666i1/4%0

  - A flaw was found in the way the Linux kernel's     networking subsystem handled offloaded packets with     multiple layers of encapsulation in the GRO (Generic     Receive Offload) code path. A remote attacker could use     this flaw to trigger unbounded recursion in the kernel     that could lead to stack corruption, resulting in a     system crash.(CVE-2016-8666i1/4%0

  - The ethtool_get_wol function in net/core/ethtool.c in     the Linux kernel through 4.7, as used in Android before     2016-08-05 on Nexus 5 and 7 (2013) devices, does not     initialize a certain data structure, which allows local     users to obtain sensitive information via a crafted     application, aka Android internal bug 28803952 and     Qualcomm internal bug CR570754.(CVE-2014-9900i1/4%0

  - A vulnerability was found in crypto/ahash.c in the     Linux kernel which allows attackers to cause a denial     of service (API operation calling its own callback, and     infinite recursion) by triggering EBUSY on a full     queue.(CVE-2017-7618i1/4%0

  - drivers/misc/qseecom.c in the QSEECOM driver for the     Linux kernel 3.x, as used in Qualcomm Innovation Center     (QuIC) Android contributions for MSM devices and other     products, does not validate certain offset, length, and     base values within an ioctl call, which allows     attackers to gain privileges or cause a denial of     service (memory corruption) via a crafted     application.(CVE-2014-4322i1/4%0

  - An integer overflow vulnerability was found in the     Linux kernel in xt_alloc_table_info, which on 32-bit     systems can lead to small structure allocation and a     copy_from_user based heap corruption.(CVE-2016-3135i1/4%0

  - Stack-based buffer overflow in the     supply_lm_input_write function in     drivers/thermal/supply_lm_core.c in the MSM Thermal     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted application that sends a large     amount of data through the debugfs     interface.(CVE-2016-2063i1/4%0

  - The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in     the Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7264i1/4%0

  - A bypass was found for the Spectre v1 hardening in the     eBPF engine of the Linux kernel. The code in the     kernel/bpf/verifier.c performs undesirable     out-of-bounds speculation on pointer arithmetic in     various cases, including cases of different branches     with different state or limits to sanitize, leading to     side-channel attacks.(CVE-2019-7308i1/4%0

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9077i1/4%0

  - The cgroup offline implementation in the Linux kernel     through 4.8.11 mishandles certain drain operations,     which allows local users to cause a denial of service     (system hang) by leveraging access to a container     environment for executing a crafted application, as     demonstrated by trinity.(CVE-2016-9191i1/4%0

  - The KVM implementation in the Linux kernel through     4.20.5 has a Use-after-Free.(CVE-2019-7221i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's network subsystem handled socket     creation with an invalid protocol identifier. A local     user could use this flaw to crash the     system.(CVE-2015-8543i1/4%0

  - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel, through 4.13.11, allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4653i1/4%0

  - A vulnerability leading to a local privilege escalation     was found in apparmor in the Linux kernel. When     proc_pid_attr_write() was changed to use memdup_user     apparmor's (interface violating) assumption that the     setprocattr buffer was always a single page was     violated.(CVE-2016-6187i1/4%0

  - A vulnerability was found in the Linux kernel in     'tmpfs' file system. When file permissions are modified     via 'chmod' and the user is not in the owning group or     capable of CAP_FSETID, the setgid bit is cleared in     inode_change_ok(). Setting a POSIX ACL via 'setxattr'     sets the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way this     allows to bypass the check in 'chmod'.(CVE-2017-5551i1/4%0

  - A flaw was found in the Linux Kernel in the     ucma_leave_multicast() function in     drivers/infiniband/core/ucma.c which allows access to a     certain data structure after freeing it in     ucma_process_join(). This allows an attacker to cause a     use-after-free bug and to induce kernel memory     corruption, leading to a system crash or other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-14734i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
105247	Oracle Linux 6 / 7：Unbreakable Enterprise 核心 (ELSA-2017-3659)	Nessus	Oracle Linux Local Security Checks	2017/12/14	2021/9/8	high
100664	Ubuntu 16.04 LTS：Linux 内核漏洞 (USN-3312-1)	Nessus	Ubuntu Local Security Checks	2017/6/7	2024/1/9	critical
109156	Oracle Linux 6 / 7：Unbreakable Enterprise 内核 (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	2018/4/19	2021/9/8	high
109158	OracleVM 3.4：Unbreakable / 等 (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	2018/4/19	2019/9/27	high
105247	Oracle Linux 6 / 7：Unbreakable Enterprise 内核 (ELSA-2017-3659)	Nessus	Oracle Linux Local Security Checks	2017/12/14	2021/9/8	high
100664	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3312-1)	Nessus	Ubuntu Local Security Checks	2017/6/7	2024/1/9	critical
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	2018/4/19	2019/9/27	high
109156	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	2018/4/19	2021/9/8	high
105247	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3659)	Nessus	Oracle Linux Local Security Checks	2017/12/14	2021/9/8	high
124978	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1525)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high

偵測

搜尋 Plugin

high

critical

high

high

high

critical

high

high

high

high