The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-3620: Local attackers on baremetal systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data. (bnc#1087081).

CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343).

CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (bnc#1102340).

CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP packet reassembly could be used by remote attackers to consume lots of CPU time (bnc#1103097).

CVE-2018-14734: drivers/infiniband/core/ucma.c allowed ucma_leave_multicast to access a certain data structure after a cleanup step in ucma_process_join, which allowed attackers to cause a denial of service (use-after-free) (bnc#1103119).

CVE-2017-18344: The timer_create syscall implementation in kernel/time/posix-timers.c didn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the show_timer function (called when /proc/$PID/timers is read). This allowed userspace applications to read arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).

CVE-2018-9385: When printing the 'driver_override' option from with-in the amba driver, a very long line could expose one additional uninitialized byte (bnc#1100491).

CVE-2018-13053: The alarm_timer_nsleep function in kernel/time/alarmtimer.c had an integer overflow via a large relative timeout because ktime_add_safe is not used (bnc#1099924).

CVE-2018-13405: The inode_init_owner function in fs/inode.c allowed local users to create files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a plain file whose group ownership is that group.
The intended behavior was that the non-member can trigger creation of a directory (but not a plain file) whose group ownership is that group. The non-member can escalate privileges by making the plain file executable and SGID (bnc#1100416).

CVE-2018-13406: An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c could result in local attackers being able to crash the kernel or potentially elevate privileges because kmalloc_array is not used (bnc#1098016 1100418).

CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3753-1 advisory.

    It was discovered that the generic SCSI driver in the Linux kernel did not properly enforce permissions on     kernel memory access. A local attacker could use this to expose sensitive information or possibly elevate     privileges. (CVE-2017-13168)

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the     Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10876,     CVE-2018-10879)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that an out-of-bounds write vulnerability existed in the ext4 filesystem implementation     in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted,     could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10878,     CVE-2018-10882)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly keep meta-     data information consistent in some situations. An attacker could use this to construct a malicious ext4     image that, when mounted, could cause a denial of service (system crash). (CVE-2018-10881)

    Shankara Pailoor discovered that the JFS filesystem implementation in the Linux kernel contained a buffer     overflow when handling extended attributes. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-12233)

    Wen Xu discovered that the XFS filesystem implementation in the Linux kernel did not properly handle an     error condition with a corrupted xfs image. An attacker could use this to construct a malicious xfs image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-13094)

    It was discovered that the Linux kernel did not properly handle setgid file creation when performed by a     non-member of the group. A local attacker could use this to gain elevated privileges. (CVE-2018-13405)

    Silvio Cesare discovered that the generic VESA frame buffer driver in the Linux kernel contained an     integer overflow. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-13406)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-920db25f88 advisory.

    Automatic update for qemu-6.2.0-5.fc37.

    ##### **Changelog**

    ```
    * Thu Feb 10 2022 Cole Robinson <crobinso@redhat.com> - 6.2.0-5
    - Split out qemu-virtiofsd subpackage
    * Wed Feb  9 2022 Eduardo Lima (Etrunko) <etrunko@redhat.com> - 2:6.2.0-4
    - virtiofsd: Drop membership of all supplementary groups (CVE-2022-0358)       Resolves: rhbz#2044863

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3096 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:4164 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for     non-members (CVE-2018-13405)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * kernel build: parallelize redhat/mod-sign.sh (BZ#1755325)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
118283	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2344-2) (Foreshadow)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	high
112111	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3753-1)	Nessus	Ubuntu Local Security Checks	2018/8/24	2024/8/27	high
211238	Fedora 37 : qemu (2022-920db25f88)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	high
118528	RHEL 7 : kernel-rt (RHSA-2018:3096)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/3/16	high
131981	RHEL 7 : kernel (RHSA-2019:4164)	Nessus	Red Hat Local Security Checks	2019/12/12	2024/11/7	high

偵測

搜尋 Plugin

high

high

high

high

high