The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3096 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerability :

  - The implementation of timer_create system call in the     Linux kernel before 4.14.8 doesn't properly validate     the sigevent::sigev_notify field, which leads to     out-of-bounds access in the show_timer function (called     when /proc/$PID/timers is read). This allows userspace     applications to read arbitrary kernel memory (on a     kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE).

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent-i1/4zsigev_notify field,     which leads to out-of-bounds access in the show_timer     function.(CVE-2017-18344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001625 advisory.

    The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8     doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the     show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read     arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002973 advisory.

    The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8     doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the     show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read     arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-3620: Local attackers on baremetal systems     could use speculative code patterns on hyperthreaded     processors to read data present in the L1 Datacache used     by other hyperthreads on the same CPU core, potentially     leaking sensitive data. (bnc#1087081).

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system.
    (bnc#1089343).

  - CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can     be forced to make very expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for     every incoming packet which can lead to a denial of     service (bnc#1102340).

  - CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP     packet reassembly could be used by remote attackers to     consume lots of CPU time (bnc#1103097).

  - CVE-2018-14734: drivers/infiniband/core/ucma.c allowed     ucma_leave_multicast to access a certain data structure     after a cleanup step in ucma_process_join, which allowed     attackers to cause a denial of service (use-after-free)     (bnc#1103119).

  - CVE-2017-18344: The timer_create syscall implementation     in kernel/time/posix-timers.c didn't properly validate     the sigevent->sigev_notify field, which leads to     out-of-bounds access in the show_timer function (called     when /proc/$PID/timers is read). This allowed userspace     applications to read arbitrary kernel memory (on a     kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).

  - CVE-2018-9385: When printing the 'driver_override'     option from with-in the amba driver, a very long line     could expose one additional uninitialized byte     (bnc#1100491).

  - CVE-2018-13053: The alarm_timer_nsleep function in     kernel/time/alarmtimer.c had an integer overflow via a     large relative timeout because ktime_add_safe is not     used (bnc#1099924).

  - CVE-2018-13405: The inode_init_owner function in     fs/inode.c allowed local users to create files with an     unintended group ownership, in a scenario where a     directory is SGID to a certain group and is writable by     a user who is not a member of that group. Here, the     non-member can trigger creation of a plain file whose     group ownership is that group. The intended behavior was     that the non-member can trigger creation of a directory     (but not a plain file) whose group ownership is that     group. The non-member can escalate privileges by making     the plain file executable and SGID (bnc#1100416).

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function in     drivers/video/fbdev/uvesafb.c could result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1098016 1100418).

  - CVE-2018-5814: Multiple race condition errors when     handling probe, disconnect, and rebind operations could     be exploited to trigger a use-after-free condition or a     NULL pointer dereference by sending multiple USB over IP     packets (bnc#1096480).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.8 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K07020416 advisory.

    The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8     doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the     show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read     arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE).(CVE-2017-18344)ImpactA local attacker may use this vulnerability to expose     sensitive information or cause a denial of service (DoS), makingthe system unresponsive.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4196 advisory.

    - posix-timer: Properly check sigevent->sigev_notify (Thomas Gleixner)  [Orabug: 28481412]     {CVE-2017-18344}
    - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (Matt Fleming)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Fix SMT supported evaluation (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3620}
    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (KarimAllah Ahmed)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3620}
    - Documentation/l1tf: Remove Yonah processors from not vulnerable list (Thomas Gleixner)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr() (Nicolai Stange)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86: Dont include linux/irq.h from asm/hardirq.h (Nicolai Stange)  [Orabug: 28220625]  {CVE-2018-3620}
    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond' (Nicolai Stange)  [Orabug:
    28220625]  {CVE-2018-3646}
    - x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paolo Bonzini)  [Orabug: 28220625]     {CVE-2018-3646}
    - KVM: X86: Introduce kvm_get_msr_feature() (Wanpeng Li)  [Orabug: 28220674]  {CVE-2018-3646}
    - KVM: x86: Add a framework for supporting MSR-based features (Tom Lendacky)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: detect SMT disabled by BIOS (Josh Poimboeuf)  [Orabug: 28220674]  {CVE-2018-3620}
    - Documentation/l1tf: Fix typos (Tony Luck)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content (Nicolai Stange)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Jiri Kosina)  [Orabug:
    28220674]  {CVE-2018-3620}
    - Documentation: Add section about CPU vulnerabilities (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations (Jiri Kosina)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Expose SMT control init function (Jiri Kosina)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/kvm: Allow runtime control of L1D flush (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Serialize L1D flush parameter setter (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Add static key for flush always (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Move l1tf setup function (Thomas Gleixner)  [Orabug: 28220625]  {CVE-2018-3646}
    - x86/l1tf: Handle EPT disabled state proper (Thomas Gleixner)  [Orabug: 28220625]  {CVE-2018-3620}
    - x86/kvm: Drop L1TF MSR list approach (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/litf: Introduce vmx status variable (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Online siblings when SMT control is turned on (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add find_msr() helper function (Konrad Rzeszutek Wilk)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Konrad Rzeszutek Wilk)     [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D flush logic (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D MSR based flush (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D flush algorithm (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add module argument for L1TF mitigation (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3646} {CVE-2018-3646}
    - locking/static_keys: Add static_key_{en,dis}able() helpers (Peter Zijlstra)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - KVM: x86: Introducing kvm_x86_ops VM init/destroy hooks (Suravee Suthikulpanit)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: Boot HT siblings at least once (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - Revert 'x86/apic: Ignore secondary threads if nosmt=force' (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Borislav Petkov)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/cpufeatures: Add detection of L1D cache flush support. (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/apic: Ignore secondary threads if nosmt=force (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/AMD: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Borislav Petkov)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/cpu/intel: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/topology: Provide detect_extended_topology_early() (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/cpu/common: Provide detect_ht_early() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/AMD: Remove the pointless detect_ht() call (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/cpu: Remove the pointless CPU printout (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Provide knobs to control SMT (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/topology: Add topology_max_smt_threads() (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Split do_cpu_down() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/topology: Provide topology_smt_supported() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/smp: Provide topology_is_primary_thread() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Klein)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Klein)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Klein)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/mm: Limit mmap() of /dev/mem to valid physical addresses (Craig Bergstrom)  [Orabug: 28220674]     {CVE-2018-3620}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability due to a lack of input     filtering of incoming fragmented datagrams was found in     the IP-over-1394 driver [firewire-net] in a fragment     handling code in the Linux kernel. The vulnerability     exists since firewire supported IPv4, i.e. since version     2.6.31 (year 2009) till version v4.9-rc4. A maliciously     formed fragment with a respectively large datagram     offset would cause a memcpy() past the datagram buffer,     which would cause a system panic or possible arbitrary     code execution. The flaw requires [firewire-net] module     to be loaded and is remotely exploitable from connected     firewire devices, but not over a local network.
    (CVE-2016-8633)

  - The Linux Kernel imposes a size restriction on the     arguments and environmental strings passed through     RLIMIT_STACK/RLIMIT_INFINITY, but does not take the     argument and environment pointers into account, which     allows attackers to bypass this limitation.
    (CVE-2017-1000365)

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation. (CVE-2017-13166)

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent->sigev_notify field,     which leads to out-of-bounds access in the show_timer     function. (CVE-2017-18344)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5715 triggers the     speculative execution by utilizing branch target     injection. It relies on the presence of a precisely-     defined instruction sequence in the privileged code as     well as the fact that memory accesses may cause     allocation into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to cross the syscall and guest/host     boundaries and read privileged memory by conducting     targeted cache side-channel attacks. (CVE-2017-5715)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5753 triggers the     speculative execution by performing a bounds-check     bypass. It relies on the presence of a precisely-defined     instruction sequence in the privileged code as well as     the fact that memory accesses may cause allocation into     the microprocessor's data cache even for speculatively     executed instructions that never actually commit     (retire). As a result, an unprivileged attacker could     use this flaw to cross the syscall boundary and read     privileged memory by conducting targeted cache side-     channel attacks. (CVE-2017-5753)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5754 relies on the     fact that, on impacted microprocessors, during     speculative execution of instruction permission faults,     exception generation triggered by a faulting access is     suppressed until the retirement of the whole instruction     block. In a combination with the fact that memory     accesses may populate the cache even when the block is     being dropped and never committed (executed), an     unprivileged local attacker could use this flaw to read     privileged (kernel space) memory by conducting targeted     cache side-channel attacks. Note: CVE-2017-5754 affects     Intel x86-64 microprocessors. AMD x86-64 microprocessors     are not affected by this issue. (CVE-2017-5754)

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges. (CVE-2017-8824)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - An integer overflow flaw was found in the Linux kernel's     create_elf_tables() function. An unprivileged local user     with access to SUID (or otherwise privileged) binary     could use this flaw to escalate their privileges on the     system. (CVE-2018-14634)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load & Store instructions (a commonly used     performance optimization). It relies on the presence of     a precisely-defined instruction sequence in the     privileged code as well as the fact that memory read     from address to which a recent memory write has occurred     may see an older value and subsequently cause an update     into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the fact     that memory writes occur to an address which depends on     the untrusted value. Such writes cause an update into     the microprocessor's data cache even for speculatively     executed instructions that never actually commit     (retire). As a result, an unprivileged attacker could     use this flaw to influence speculative execution and/or     read privileged memory by conducting targeted cache     side-channel attacks. (CVE-2018-3693)

  - A flaw named SegmentSmack was found in the way the Linux     kernel handled specially crafted TCP packets. A remote     attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending specially     modified packets within ongoing TCP sessions which could     lead to a CPU saturation and hence a denial of service     on the system. Maintaining the denial of service     condition requires continuous two-way TCP sessions to a     reachable open port, thus the attacks cannot be     performed using spoofed IP addresses. (CVE-2018-5390)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - A an integer overflow vulnerability was discovered in     the Linux kernel, from version 3.4 through 4.15, in the     drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An     attacker with access to the udldrmfb driver could     exploit this to obtain full read and write permissions     on kernel physical pages, resulting in a code execution     in kernel space. (CVE-2018-8781)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)

* kernel: out-of-bounds access in the show_timer function in kernel/time/ posix-timers.c (CVE-2017-18344)

* kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space (CVE-2018-8781)

* kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

* kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members (CVE-2018-13405)

* kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

* kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation (CVE-2017-0861)

* kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

* kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial of service (CVE-2017-17805)

* kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service (CVE-2017-18208)

* kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

* kernel: a NULL pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

* kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service (CVE-2018-5344)

* kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service (CVE-2018-5803)

* kernel: buffer overflow in drivers/net/wireless/ath/wil6210/ wmi.c:wmi_set_ie() may lead to memory corruption (CVE-2018-5848)

* kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

* kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet (CVE-2018-1000026)

* kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

* kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

* kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image (CVE-2018-1092)

* kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image (CVE-2018-1094)

* kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

* kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

* kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/ libsas/sas_expander.c (CVE-2018-7757)

* kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service (CVE-2018-10322)

* kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

* kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image (CVE-2018-10881)

* kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

* kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120;
Evgenii Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

ID	名稱	產品	系列	已發布	已更新	嚴重性
118528	RHEL 7 : kernel-rt (RHSA-2018:3096)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/3/16	high
111642	Virtuozzo 7 : readykernel-patch (VZA-2018-052)	Nessus	Virtuozzo Local Security Checks	2018/8/10	2024/8/22	medium
119060	EulerOS Virtualization 2.5.2 : kernel (EulerOS-SA-2018-1369)	Nessus	Huawei Local Security Checks	2018/11/21	2024/7/22	medium
291233	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001625)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/2/6	medium
287461	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002973)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/2/10	medium
111815	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2344-1) (Foreshadow)	Nessus	SuSE Local Security Checks	2018/8/17	2024/8/19	high
151461	F5 Networks BIG-IP : Linux kernel vulnerability (K07020416)	Nessus	F5 Networks Local Security Checks	2021/7/8	2026/10/21	medium
111726	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4196)	Nessus	Oracle Linux Local Security Checks	2018/8/15	2026/2/9	medium
127233	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0049)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2026/1/26	high
118990	CentOS 7 : kernel (CESA-2018:3083)	Nessus	CentOS Local Security Checks	2018/11/16	2022/5/27	high

偵測

搜尋 Plugin

high

medium

medium

medium

medium

high

medium

medium

high

high