This update for the Linux Kernel 3.12.61-52_86 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     was fixed in the kernel v4l2 video driver.
    (bsc#1085447).

  - CVE-2018-1068: A flaw was found in the Linux kernels     implementation of 32-bit syscall interface for bridging.
    This allowed a privileged user to arbitrarily write to a     limited range of kernel memory (bsc#1085114).

  - CVE-2018-1000004: A race condition vulnerability existed     in the sound system, which could lead to a deadlock and     denial of service condition (bsc#1076017)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.90-92_50 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the v4l2 video driver (bsc#1085447).

  - CVE-2018-1068: A flaw in the implementation of 32-bit     syscall interface for bridging allowed a privileged user     to arbitrarily write to a limited range of kernel memory     (bsc#1085114).

  - CVE-2018-7566: Prevent buffer overflow via an     SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to     /dev/snd/seq by a local user (bsc#1083488).

  - CVE-2018-1000004: Prevent race condition in the sound     system that could have lead to a deadlock and denial of     service condition (bsc#1076017).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.74-60_64_48 fixes several issues. The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     was fixed in the kernel v4l2 video driver.
    (bsc#1085447).

  - CVE-2018-1068: A flaw was found in the Linux kernels     implementation of 32-bit syscall interface for bridging.
    This allowed a privileged user to arbitrarily write to a     limited range of kernel memory (bsc#1085114).

  - CVE-2018-1000004: A race condition vulnerability existed     in the sound system, which could lead to a deadlock and     denial of service condition (bsc#1076017)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.59-92_24 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the v4l2 video driver (bsc#1085447).

  - CVE-2018-1068: A flaw in the implementation of 32-bit     syscall interface for bridging allowed a privileged user     to arbitrarily write to a limited range of kernel memory     (bsc#1085114).

  - CVE-2018-7566: Prevent buffer overflow via an     SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to     /dev/snd/seq by a local user (bsc#1083488).

  - CVE-2018-1000004: Prevent race condition in the sound     system that could have lead to a deadlock and denial of     service condition (bsc#1076017).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues. The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     was fixed in the kernel v4l2 video driver.
    (bsc#1085447).

  - CVE-2018-1068: A flaw was found in the Linux kernels     implementation of 32-bit syscall interface for bridging.
    This allowed a privileged user to arbitrarily write to a     limited range of kernel memory (bsc#1085114).

  - CVE-2018-1000004: A race condition vulnerability existed     in the sound system, which could lead to a deadlock and     denial of service condition (bsc#1076017)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4110 advisory.

    - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208383]  {CVE-2017-16537}
    - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215095]  {CVE-2017-16643}
    - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602321]  {CVE-2017-16532}
    - netfilter: ebtables: CONFIG_COMPAT: dont trust userland offsets (Florian Westphal)  [Orabug: 27774010]     {CVE-2018-1068}
    - ext4: add validity checks for bitmap block numbers (Theodore Tso)  [Orabug: 27854370]  {CVE-2018-1093}     {CVE-2018-1093}
    - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898064]  {CVE-2017-17558}
    - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934081]  {CVE-2018-5332}
    - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989490]     {CVE-2018-10323}
    - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897}
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947612]     {CVE-2018-100199}
    - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148283]  {CVE-2017-16527}
    - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206900]  {CVE-2017-16526}
    - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207935]  {CVE-2017-16533}
    - cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208080]     {CVE-2017-16536}
    - net: cdc_ether: fix divide by 0 on bad descriptors (Bjorn Mork)  [Orabug: 27215206]  {CVE-2017-16649}
    - Bluetooth: bnep: bnep_add_connection() should verify that its dealing with l2cap socket (Al Viro)     [Orabug: 27344787]  {CVE-2017-15868}
    - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344787]  {CVE-2017-15868}
    - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344840]  {CVE-2017-0861}     {CVE-2017-0861}
    - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (David Woodhouse)  [Orabug:
    27649498]  {CVE-2017-5715}
    - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27649510]     {CVE-2017-5715}
    - x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk)  [Orabug:
    27649631]  {CVE-2017-5715}
    - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (KarimAllah Ahmed)     [Orabug: 27649640]  {CVE-2017-5715}
    - x86: Add STIBP feature enumeration (David Woodhouse)  [Orabug: 27649693]  {CVE-2017-5715}
    - x86/cpu/AMD: Add speculative control support for AMD (Tom Lendacky)  [Orabug: 27649706]  {CVE-2017-5715}
    - x86/spectre_v2: Dont spam the console with these: (Konrad Rzeszutek Wilk)  [Orabug: 27649723]     {CVE-2017-5715}
    - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug:
    27516441]  {CVE-2017-5715}
    - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Tim Tianyang Chen)     [Orabug: 25757946]  {CVE-2017-6951}
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813391]  {CVE-2017-14106}
    - rxrpc: Fix several cases where a padded len isnt checked in ticket decode (David Howells)  [Orabug:
    26880520]  {CVE-2017-7482} {CVE-2017-7482}
    - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206839]     {CVE-2017-16525}
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug:
    27206934]  {CVE-2017-16529}
    - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207243]     {CVE-2017-16531}
    - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290308]  {CVE-2017-8824}
    - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec: Dont print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug:
    27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86: Move ENABLE_IBRS in the interrupt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - Set CONFIG_GENERIC_CPU_VULNERABILITIES flag (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - sysfs/cpu: Fix typos in vulnerability documentation (David Woodhouse)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/spec_ctrl: Add missing 'lfence' when IBRS is not supported (Konrad Rzeszutek Wilk)  [Orabug:
    27369777]  {CVE-2017-5715} {CVE-2017-5753}
    - x86/ia32: Move STUFF_RSB And ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/enter: MACROS to set/clear IBRS and set IBPB (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715}     {CVE-2017-5753}
    - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27369777]     {CVE-2017-5715} {CVE-2017-5753}
    - x86: fix build breakage (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753}
    - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI to match upstream (Mike Kravetz)   {CVE-2017-5754}
    - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333761]     {CVE-2017-5754}
    - KPTI: Report when enabled (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754}
    - kaiser: Set _PAGE_NX only if supported (Guenter Roeck)  [Orabug: 27333761] [Orabug: 27333760]     {CVE-2017-5754}
    - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/kaiser: Reenable PARAVIRT, dynamically disable KAISER if PARAVIRT (Borislav Petkov)  [Orabug:
    27333761]  {CVE-2017-5754}
    - kaiser: add 'nokaiser' boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86-32: Fix boot with CONFIG_X86_INVD_BUG (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - kaiser: user_map __kprobes_text too (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333761]  {CVE-2017-5754}
    - KAISER: Kernel Address Isolation (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: fix bad backport to disable PCID on Xen (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)     [Orabug: 27333761]  {CVE-2017-5754}
    - sched/core: Idle_task_exit() shouldnt use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86, cpufeature: Add CPU features from Intel document 319433-012A (H. Peter Anvin)  [Orabug: 27333761]     {CVE-2017-5754}
    - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86-64: Map the HPET NX (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754}     {CVE-2015-5157}
    - x86, cpu: Add cpufeature flag for PCIDs (Arun Thomas)  [Orabug: 27333761]  {CVE-2017-5754}
    - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333761]     {CVE-2017-5754}
    - locking/barriers: fix compile issue (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753}
    - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27346425]  {CVE-2017-5753}
    - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}
    - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27346425]     {CVE-2017-5753}
    - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27346425]     {CVE-2017-5753}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1318 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

    * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick     Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these     bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3431641

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1355 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick     Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

    Bug Fix(es):

    * The kernel-rt packages have been upgraded to the 3.10.0-862.2.3 source tree, which provides a number of     bug fixes over the previous version. (BZ#1549768)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

* Kernel: error in exception handling leads to DoS (CVE-2018-8897)

* Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

* kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068)

* kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

* kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3431641

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - net/llc/sysctl_net_llc.c in the Linux kernel before 3.19     uses an incorrect data type in a sysctl table, which     allows local users to obtain potentially sensitive     information from kernel memory or possibly have     unspecified other impact by accessing a sysctl entry.
    (CVE-2015-2041)

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses an     incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry. (CVE-2015-2042)

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service (out-of-     bounds access) or possibly have unspecified other impact     by sending a XFRM_MSG_MIGRATE netlink message. This flaw     is present in the Linux kernel since an introduction of     XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3.
    (CVE-2017-11600)

  - A flaw was found in the Linux kernel's skcipher     component, which affects the skcipher_recvmsg function.
    Attackers using a specific input can lead to a privilege     escalation. (CVE-2017-13215)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system. (CVE-2017-16939)

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-8890)

  - An address corruption flaw was discovered in the Linux     kernel built with hardware breakpoint     (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a     h/w breakpoint via 'modify_user_hw_breakpoint' routine,     an unprivileged user/process could use this flaw to     crash the system kernel resulting in DoS OR to     potentially escalate privileges on a the system.
    (CVE-2018-1000199)

  - The do_get_mempolicy() function in mm/mempolicy.c in the     Linux kernel allows local users to hit a use-after-free     bug via crafted system calls and thus cause a denial of     service (DoS) or possibly have unspecified other impact.
    Due to the nature of the flaw, privilege escalation     cannot be fully ruled out. (CVE-2018-10675)

  - A flaw was found in the Linux kernel's implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory. (CVE-2018-1068)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.
    (CVE-2018-8897)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4159 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Out-of-bounds heap access in xfrm (CVE-2017-7184)

    * kernel: Exploitable memory corruption due to UFO to non-UFO path switch (CVE-2017-1000112)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for     non-members (CVE-2018-13405)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * IPv6 UDP inconsistent usage of UFO and HW checksums (BZ#1773816)

    * UDPv6 packets badly fragmented when ESP in use on devices supporting UFO (BZ#1774503)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated for the x86 architecture (amd64 and   i386) by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated by identifying vulnerable code sections   (array bounds checking followed by array access) and replacing the   array access with the speculation-safe array_index_nospec()   function.

  More use sites will be added over time.

  - CVE-2017-17975     Tuba Yavuz reported a use-after-free flaw in the     USBTV007 audio-video grabber driver. A local user could     use this for denial of service by triggering failure of     audio registration.

  - CVE-2017-18193     Yunlei He reported that the f2fs implementation does not     properly handle extent trees, allowing a local user to     cause a denial of service via an application with     multiple threads.

  - CVE-2017-18216     Alex Chen reported that the OCFS2 filesystem failed to     hold a necessary lock during nodemanager sysfs file     operations, potentially leading to a NULL pointer     dereference. A local user could use this for denial of     service.

  - CVE-2017-18218     Jun He reported a use-after-free flaw in the Hisilicon     HNS ethernet driver. A local user could use this for     denial of service.

  - CVE-2017-18222     It was reported that the Hisilicon Network Subsystem     (HNS) driver implementation does not properly handle     ethtool private flags. A local user could use this for     denial of service or possibly have other impact.

  - CVE-2017-18224     Alex Chen reported that the OCFS2 filesystem omits the     use of a semaphore and consequently has a race condition     for access to the extent tree during read operations in     DIRECT mode. A local user could use this for denial of     service.

  - CVE-2017-18241     Yunlei He reported that the f2fs implementation does not     properly initialise its state if the 'noflush_merge'     mount option is used. A local user with access to a     filesystem mounted with this option could use this to     cause a denial of service.

  - CVE-2017-18257     It was reported that the f2fs implementation is prone to     an infinite loop caused by an integer overflow in the
    __get_data_block() function. A local user can use this     for denial of service via crafted use of the open and     fallocate system calls with an FS_IOC_FIEMAP ioctl.

  - CVE-2018-1065     The syzkaller tool found a NULL pointer dereference flaw     in the netfilter subsystem when handling certain     malformed iptables rulesets. A local user with the     CAP_NET_RAW or CAP_NET_ADMIN capability (in any user     namespace) could use this to cause a denial of service.
    Debian disables unprivileged user namespaces by default.

  - CVE-2018-1066     Dan Aloni reported to Red Hat that the CIFS client     implementation would dereference a NULL pointer if the     server sent an invalid response during NTLMSSP setup     negotiation. This could be used by a malicious server     for denial of service.

  - CVE-2018-1068     The syzkaller tool found that the 32-bit compatibility     layer of ebtables did not sufficiently validate offset     values. On a 64-bit kernel, a local user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this to overwrite kernel memory, possibly leading to     privilege escalation. Debian disables unprivileged user     namespaces by default.

  - CVE-2018-1092     Wen Xu reported that a crafted ext4 filesystem image     would trigger a null dereference when mounted. A local     user able to mount arbitrary filesystems could use this     for denial of service.

  - CVE-2018-1093     Wen Xu reported that a crafted ext4 filesystem image     could trigger an out-of-bounds read in the     ext4_valid_block_bitmap() function. A local user able to     mount arbitrary filesystems could use this for denial of     service.

  - CVE-2018-1108     Jann Horn reported that crng_ready() does not properly     handle the crng_init variable states and the RNG could     be treated as cryptographically safe too early after     system boot.

  - CVE-2018-5803     Alexey Kodanev reported that the SCTP protocol did not     range-check the length of chunks to be created. A local     or remote user could use this to cause a denial of     service.

  - CVE-2018-7480     Hou Tao discovered a double-free flaw in the     blkcg_init_queue() function in block/blk-cgroup.c. A     local user could use this to cause a denial of service     or have other impact.

  - CVE-2018-7566     Fan LongFei reported a race condition in the ALSA     (sound) sequencer core, between write and ioctl     operations. This could lead to an out-of-bounds access     or use-after-free. A local user with access to a     sequencer device could use this for denial of service or     possibly for privilege escalation.

  - CVE-2018-7740     Nic Losby reported that the hugetlbfs filesystem's mmap     operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs     filesystem could use this to cause a denial of service.

  - CVE-2018-7757     Jason Yan reported a memory leak in the SAS     (Serial-Attached SCSI) subsystem. A local user on a     system with SAS devices could use this to cause a denial     of service.

  - CVE-2018-7995     Seunghun Han reported a race condition in the x86 MCE     (Machine Check Exception) driver. This is unlikely to     have any security impact.

  - CVE-2018-8087     A memory leak flaw was found in the hwsim_new_radio_nl()     function in the simulated radio testing tool driver for     mac80211, allowing a local user to cause a denial of     service.

  - CVE-2018-8781     Eyal Itkin reported that the udl (DisplayLink) driver's     mmap operation did not properly range-check the file     offset. A local user with access to a udl framebuffer     device could exploit this to overwrite kernel memory,     leading to privilege escalation.

  - CVE-2018-8822     Dr Silvio Cesare of InfoSect reported that the ncpfs     client implementation did not validate reply lengths     from the server. An ncpfs server could use this to cause     a denial of service or remote code execution in the     client.

  - CVE-2018-10323     Wen Xu reported a NULL pointer dereference flaw in the     xfs_bmapi_write() function triggered when mounting and     operating a crafted xfs filesystem image. A local user     able to mount arbitrary filesystems could use this for     denial of service.

  - CVE-2018-1000199     Andy Lutomirski discovered that the ptrace subsystem did     not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,     or possibly for privilege escalation, on x86 (amd64 and     i386) and possibly other architectures.

ID	名稱	產品	系列	已發布	已更新	嚴重性
109258	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1009-1)	Nessus	SuSE Local Security Checks	2018/4/23	2024/10/28	high
109260	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1011-1)	Nessus	SuSE Local Security Checks	2018/4/23	2024/10/28	high
109263	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1015-1)	Nessus	SuSE Local Security Checks	2018/4/23	2024/10/28	high
109267	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1021-1)	Nessus	SuSE Local Security Checks	2018/4/23	2024/10/25	high
109274	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1032-1)	Nessus	SuSE Local Security Checks	2018/4/23	2024/10/25	high
109156	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	2018/4/19	2024/10/22	medium
109881	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2018-4110)	Nessus	Oracle Linux Local Security Checks	2018/5/17	2024/11/1	high
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	2018/4/19	2024/10/30	high
109633	RHEL 7 : kernel (RHSA-2018:1318)	Nessus	Red Hat Local Security Checks	2018/5/9	2025/4/15	high
109642	RHEL 7 : kernel-rt (RHSA-2018:1355)	Nessus	Red Hat Local Security Checks	2018/5/9	2024/11/5	high
110245	CentOS 7 : kernel (CESA-2018:1318)	Nessus	CentOS Local Security Checks	2018/5/31	2024/9/30	high
127192	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0028)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
131980	RHEL 7 : kernel (RHSA-2019:4159)	Nessus	Red Hat Local Security Checks	2019/12/12	2024/11/7	high
109518	Debian DSA-4188-1 : linux - security update (Spectre)	Nessus	Debian Local Security Checks	2018/5/2	2024/10/15	high

偵測

搜尋 Plugin

high

high

high

high

high

medium

high

high

high

high

high

high

high

high