Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Giorgi Maisuradze, Dan Horea Lutas, Andrei Lutas, Volodymyr Pikhur, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida, Moritz Lipp, Michael Schwarz, and Daniel Gruss discovered that memory previously stored in microarchitectural fill buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information.
(CVE-2018-12130)

Brandon Falk, Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that memory previously stored in microarchitectural load ports of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12127)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Marina Minkin, Daniel Moghimi, Moritz Lipp, Michael Schwarz, Jo Van Bulck, Daniel Genkin, Daniel Gruss, Berk Sunar, Frank Piessens, and Yuval Yarom discovered that memory previously stored in microarchitectural store buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2018-12126)

Vasily Averin and Evgenii Shatokhin discovered that a use-after-free vulnerability existed in the NFS41+ subsystem when multiple network namespaces are in use. A local attacker in a container could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-16884)

Ke Sun, Henrique Kawakami, Kekai Hu, Rodrigo Branco, Volodrmyr Pikhur, Moritz Lipp, Michael Schwarz, Daniel Gruss, Stephan van Schaik, Alyssa Milburn, Sebastian Osterlund, Pietro Frigo, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida discovered that uncacheable memory previously stored in microarchitectural buffers of an Intel CPU core may be exposed to a malicious process that is executing on the same CPU core. A local attacker could use this to expose sensitive information. (CVE-2019-11091)

Matteo Croce, Natale Vinto, and Andrea Spagnolo discovered that the cgroups subsystem of the Linux kernel did not properly account for SCTP socket buffers. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-3874)

Alex Williamson discovered that the vfio subsystem of the Linux kernel did not properly limit DMA mappings. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2019-3882)

Marc Orr discovered that the KVM hypervisor implementation in the Linux kernel did not properly restrict APIC MSR register values when nested virtualization is used. An attacker in a guest vm could use this to cause a denial of service (host OS crash). (CVE-2019-3887)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel contained a heap buffer overflow. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9500)

Hugues Anguelkov discovered that the Broadcom Wifi driver in the Linux kernel did not properly prevent remote firmware events from being processed for USB Wifi devices. A physically proximate attacker could use this to send firmware events to the device. (CVE-2019-9503).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3969-1 advisory.

    The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

    The following security bugs were fixed:

    Unprivileged BPF has been disabled by default to reduce attack surface as too many security issues have     happened in the past (jsc#SLE-22573)       You can reenable via systemctl setting /proc/sys/kernel/unprivileged_bpf_disabled to 0.
      (kernel.unprivileged_bpf_disabled = 0)

    - CVE-2018-3639: Fixed a speculative execution that may allow unauthorized disclosure of information to an     attacker with local user access via a side-channel analysis. (bsc#1087082)
    - CVE-2021-20320: Fix a bug that allows a local attacker with special user privilege can circumvent the     verifier and may lead to a confidentiality problem. (bsc#1190601)
    - CVE-2021-0941: Fixed A missing sanity check to the current MTU check that may allow a local attacker     with special user privilege to gain access to out-of-bounds memory leading to a system crash or a leak of     internal kernel information. (bnc#1192045)
    - CVE-2021-31916: Fixed a bound check failure that could allows an attacker with special user     (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash, a leak of     internal kernel information, or a privilege escalation problem. (bnc#1192781)
    - CVE-2021-20322: Fixed a bug that provides to an attacker the ability to quickly scan open UDP ports.
    (bsc#1191790)
    - CVE-2021-3772: Fixed an issue that would allow a blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (bsc#1190351)
    - CVE-2021-34981: Fixed an issue that allows an attacker with a local account to escalate privileges when     CAPI (ISDN) hardware connection fails. (bsc#1191961)
    - CVE-2018-9517: Fixed possible memory corruption due to a use after free in pppol2tp_connect     (bsc#1108488).
    - CVE-2019-3874: Fixed possible denial of service attack via SCTP socket buffer used by a userspace     applications (bnc#1129898).
    - CVE-2019-3900: Fixed an infinite loop issue while handling incoming packets in handle_rx()     (bnc#1133374).
    - CVE-2020-12770: Fixed sg_remove_request call in a certain failure cases (bsc#1171420).
    - CVE-2020-3702: Fixed a bug which could be triggered with specifically timed and handcrafted traffic and     cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent     possibility of information disclosure. (bnc#1191193)
    - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM, which could bypass RO checks and     can lead to pages being freed while still accessible by the VMM and guest. This allowed users with the     ability to start and control a VM to read/write random pages of memory and can result in local privilege     escalation (bsc#1186482).
    - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and     CALIPSO refcounting for the DOI definitions is mishandled (bsc#1186109).
    - CVE-2021-34556: Fixed side-channel attack via a Speculative Store Bypass via unprivileged BPF program     that could have obtain sensitive information from kernel memory (bsc#1188983).
    - CVE-2021-35477: Fixed BPF stack frame pointer which could have been abused to disclose content of     arbitrary kernel memory (bsc#1188985).
    - CVE-2021-3640: Fixed a Use-After-Free vulnerability in function sco_sock_sendmsg() in the bluetooth     stack (bsc#1188172).
    - CVE-2021-3653: Missing validation of the `int_ctl` VMCB field and allows a malicious L1 guest to enable     AVIC support for the L2 guest. (bsc#1189399).
    - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the     kernel to read uninitialized memory (bsc#1188563).
    - CVE-2021-3656: Missing validation of the the `virt_ext` VMCB field and allows a malicious L1 guest to     disable both VMLOAD/VMSAVE intercepts and VLS for the L2 guest (bsc#1189400).
    - CVE-2021-3659: Fixed a NULL pointer dereference in llsec_key_alloc() in net/mac802154/llsec.c     (bsc#1188876).
    - CVE-2021-3679: A lack of CPU resource in tracing module functionality was found in the way user uses     trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use     this flaw to starve the resources causing denial of service (bnc#1189057).
    - CVE-2021-37159: Fixed use-after-free and a double free inside hso_free_net_device in     drivers/net/usb/hso.c when unregister_netdev is called without checking for the NETREG_REGISTERED state     (bnc#1188601).
    - CVE-2021-3732: Mounting overlayfs inside an unprivileged user namespace can reveal files (bsc#1189706).
    - CVE-2021-3744: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1189884)
    - CVE-2021-3752: Fixed a use after free vulnerability in the Linux kernel's bluetooth module.
    (bsc#1190023)
    - CVE-2021-3753: Fixed race out-of-bounds in virtual terminal handling (bsc#1190025).
    - CVE-2021-37576: Fixed an issue on the powerpc platform, where a KVM guest OS user could cause host OS     memory corruption via rtas_args.nargs (bsc#1188838).
    - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev->rf_conn_info object (bsc#1190067).
    - CVE-2021-3764: Fixed a bug which could allows attackers to cause a denial of service. (bsc#1190534)
    - CVE-2021-38160: Data corruption or loss could be triggered by an untrusted device that supplies a     buf->len value exceeding the buffer size in drivers/char/virtio_console.c (bsc#1190117)
    - CVE-2021-38198: arch/x86/kvm/mmu/paging_tmpl.h incorrectly computes the access permissions of a shadow     page, leading to a missing guest protection page fault (bnc#1189262).
    - CVE-2021-38204: drivers/usb/host/max3421-hcd.c allowed physically proximate attackers to cause a denial     of service (use-after-free and panic) by removing a MAX-3421 USB device in certain situations     (bnc#1189291).
    - CVE-2021-40490: Fixed a race condition discovered in the ext4 subsystem that could leat to local     priviledge escalation. (bnc#1190159)
    - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF     multiplication integer overflow with a resultant out-of-bounds write (bnc#1191317).
    - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in     drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead     to root access (bsc#1191315).
    - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to     access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute     privileges (bnc#1190479).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3517 advisory.

    - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}
    - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}
    - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714476] {CVE-2019-3846}
    - [net] Bluetooth: Fix faulty expression for minimum encryption key size check (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Fix regression with minimum encryption key size alignment (Gopal Tiwari) [1743076]     {CVE-2019-9506}
    - [net] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections (Gopal Tiwari)     [1743076] {CVE-2019-9506}
    - [bluetooth] Bluetooth: hci_uart: check for missing tty operations (Gopal Tiwari) [1734239]     {CVE-2019-10207}
    - [documentation] Documentation: Add swapgs description to the Spectre v1 documentation (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [documentation] Documentation: Add section about CPU vulnerabilities for Spectre (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/speculation/swapgs: Exclude ATOMs from speculation through SWAPGS (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724501]     {CVE-2019-1125}
    - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf)     [1724501] {CVE-2019-1125}
    - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724501] {CVE-2019-1125}
    - [net] sunrpc: make visible processing error in bc_svc_process() ('J. Bruce Fields') [1660823]     {CVE-2018-16884}
    - [net] sunrpc: remove unused xpo_prep_reply_hdr callback ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: remove svc_tcp_bc_class ('J. Bruce Fields') [1660823] {CVE-2018-16884}
    - [net] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ('J. Bruce Fields') [1660823]     {CVE-2018-16884}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
125139	Ubuntu 18.10 : Linux kernel vulnerabilities (USN-3980-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Ubuntu Local Security Checks	2019/5/15	2024/5/22	high
155930	SUSE SLES15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2021:3969-1)	Nessus	SuSE Local Security Checks	2021/12/8	2026/6/26	high
180632	Oracle Linux 8 : kernel (ELSA-2019-3517)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2026/2/9	critical

偵測

搜尋 Plugin

high

high

critical