The 4.8.12 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mikulas Patocka discovered that the asynchronous multibuffer cryptographic daemon (mcryptd) in the Linux kernel did not properly handle being invoked with incompatible algorithms. A local attacker could use this to cause a denial of service (system crash).
(CVE-2016-10147)

It was discovered that a use-after-free existed in the KVM susbsystem of the Linux kernel when creating devices. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-10150)

Qidan He discovered that the ICMP implementation in the Linux kernel did not properly check the size of an ICMP header. A local attacker with CAP_NET_ADMIN could use this to expose sensitive information.
(CVE-2016-8399)

Qian Zhang discovered a heap-based buffer overflow in the tipc_msg_build() function in the Linux kernel. A local attacker could use to cause a denial of service (system crash) or possible execute arbitrary code with administrative privileges. (CVE-2016-8632)

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel did not properly restrict the VCPU index when I/O APIC is enabled, An attacker in a guest VM could use this to cause a denial of service (system crash) or possibly gain privileges in the host OS.
(CVE-2016-9777).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

4.8.12 安定版（stable）の更新には、ツリーにわたる多くの重要な修正が含まれています。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

しないMikulas Patocka氏によって、Linuxカーネルの非同期マルチバッファ暗号デーモン（mcryptd）が、互換性のないアルゴリズムによる呼び出しを適切に処理しないことがわかりました。ローカルの攻撃者がこれを悪用して、サービス拒否（システムクラッシュ）を引き起こす可能性があります。（CVE-2016-10147）デバイスの作成時、LinuxカーネルのKVMサブシステムにメモリ解放後使用（use-after-free）が発生することがわかりました。ローカルの攻撃者がこれを悪用して、サービス拒否（システムクラッシュ）を引き起こす可能性があります。（CVE-2016-10150）LinuxカーネルのICMP実装でICMPヘッダーのサイズが適切にチェックされないことをQidan He氏が発見しました。CAP_NET_ADMINのあるローカルの攻撃者がこれを悪用して、秘密情報を漏えいさせる可能性があります。（CVE-2016-8399）Qian Zhang氏によって、Linuxカーネルのtipc_msg_build()数でヒープベースのバッファオーバーフローが発見されました。ローカルの攻撃者がこれを悪用して、サービス拒否（システムクラッシュ）を引き起こしたり、管理者権限で任意のコードを実行したりする可能性があります。（CVE-2016-8632）I/O APICが有効になっているとき、LinuxカーネルのKVM実装でVCPUインデックスが適切に制限されないことをDmitry Vyukov氏が発見しました。ゲストVMの攻撃者がこれを悪用してサービス拒否（システムクラッシュ）を引き起こしたり、ホストOSで権限を取得したりする可能性があります。（CVE-2016-9777）注意：Tenable Network Securityは、前述の説明ブロックをUbuntuセキュリティアドバイザリから直接抽出しています。Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Mikulas Patocka 發現 Linux 核心中的非同步多重緩衝區密碼編譯程序 (mcryptd) 在被不相容的演算法叫用時，未正確處理。本機攻擊者可利用此缺陷造成拒絕服務 (系統當機)。(CVE-2016-10147) 據發現，Linux 核心中的 KVM 子系統在建立裝置時存在釋放後使用。本機攻擊者可利用此缺陷造成拒絕服務 (系統當機)。(CVE-2016-10150) Qidan He 發現 Linux 核心中的 ICMP 實作未正確檢查 ICMP 標頭的大小。具 CAP_NET_ADMIN 的本機攻擊者可利用此弱點洩漏敏感資訊。(CVE-2016-8399) Qian Zhang 發現 Linux 核心中的 tipc_msg_build() 函式發生堆積型緩衝區溢位。本機攻擊者可惡意利用此缺陷，進而引發拒絕服務 (系統當機)，或可能以系統管理權限執行任意程式碼。(CVE-2016-8632) Dmitry Vyukov 發現當啟用 I/O APIC 時，Linux 核心中的 KVM 實作未正確限制 VCPU 索引。來賓 VM 中的攻擊者可利用此弱點造成拒絕服務 (系統當機) 或可能取得主機作業系統的權限。(CVE-2016-9777)。請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Mikulas Patocka 发现 Linux 内核的异步多缓冲区密码守护程序 (mcryptd) 未能正确处理不兼容运算的调用。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2016-10147) 发现 Linux 内核的 KVM 子系统在创建设备时存在释放后使用漏洞。本地攻击者可利用此问题造成拒绝服务（系统崩溃）。(CVE-2016-10150) Qidan He 发现 Linux 内核的 ICMP 实施未能正确检查 ICMP 标头尺寸。具有 CAP_NET_ADMIN 的本地攻击者可利用此问题暴露敏感信息。(CVE-2016-8399) Qian Zhang 发现 Linux 内核中的 tipc_msg_build() 函数存在基于堆栈的缓冲区溢出。本地攻击者可以利用这一问题造成拒绝服务（系统崩溃），或以管理权限执行任意代码。(CVE-2016-8632) Dmitry Vyukov 发现 Linux 内核中的 KVM 实施在启用 I/O APIC 时未能正确限制 VCPU 索引，客户机 VM 中的攻击者可利用此问题导致拒绝服务（系统崩溃）或可能取得主机操作系统的权限。(CVE-2016-9777)。请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds memory access flaw was found in the     Linux kernel's system call auditing implementation. On     a system with existing audit rules defined, a local,     unprivileged user could use this flaw to leak kernel     memory to user space or, potentially, crash the     system.(CVE-2014-3917i1/4%0

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net     namespaces.(CVE-2017-17448i1/4%0

  - A race condition flaw was found between the chown and     execve system calls. When changing the owner of a     setuid user binary to root, the race condition could     momentarily make the binary setuid root. A local,     unprivileged user could potentially use this flaw to     escalate their privileges on the     system.(CVE-2015-3339i1/4%0

  - Keberos 5 tickets being decoded when using the RXRPC     keys incorrectly assumes the size of a field. This     could lead to the size-remaining variable wrapping and     the data pointer going over the end of the buffer. This     could possibly lead to memory corruption and possible     privilege escalation.(CVE-2017-7482i1/4%0

  - The nfs_can_extend_write function in fs/nfs/write.c in     the Linux kernel before 3.13.3 relies on a write     delegation to extend a write operation without a     certain up-to-date verification, which allows local     users to obtain sensitive information from kernel     memory in opportunistic circumstances by writing to a     file in an NFS filesystem and then reading the same     file.(CVE-2014-2038i1/4%0

  - KVM in the Linux kernel before 4.8.12, when I/O APIC is     enabled, does not properly restrict the VCPU index,     which allows guest OS users to gain host OS privileges     or cause a denial of service (out-of-bounds array     access and host OS crash) via a crafted interrupt     request, related to arch/x86/kvm/ioapic.c and     arch/x86/kvm/ioapic.h.(CVE-2016-9777i1/4%0

  - The instruction decoder in arch/x86/kvm/emulate.c in     the KVM subsystem in the Linux kernel before 3.18-rc2     lacks intended decoder-table flags for certain     RIP-relative instructions, which allows guest OS users     to cause a denial of service (NULL pointer dereference     and host OS crash) via a crafted     application.(CVE-2014-8480i1/4%0

  - arch/x86/kernel/entry_32.S in the Linux kernel through     3.15.1 on 32-bit x86 platforms, when syscall auditing     is enabled and the sep CPU feature flag is set, allows     local users to cause a denial of service (OOPS and     system crash) via an invalid syscall number, as     demonstrated by number 1000.(CVE-2014-4508i1/4%0

  - The overlayfs implementation in the Linux kernel     through 4.5.2 does not properly restrict the mount     namespace, which allows local users to gain privileges     by mounting an overlayfs filesystem on top of a FUSE     filesystem, and then executing a crafted setuid     program.(CVE-2016-1576i1/4%0

  - A use-after-free vulnerability was found when issuing     an ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption     or possibly privilege escalation.(CVE-2017-15265i1/4%0

  - The drivers/uwb/uwbd.c in the Linux kernel, before     4.13.6, allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526i1/4%0

  - The Linux kernel was found vulnerable to a NULL pointer     dereference in the     drivers/net/phy/mdio-bcm-unimac.c:unimac_mdio_probe()     function caused by an unchecked return value from the     platform_get_resource() function. A successful flaw     exploitation can cause a system panic and a denial of     service. This flaw is believed not to be an attacker     triggerable as bad return value can be caused by     hardware misconfiguration.(CVE-2018-8043i1/4%0

  - A flaw was found in the Linux kernel SCSI subsystem,     which allowed a local user to gain privileges or cause     a denial of service (memory corruption and system     crash) by issuing an SG_IO ioctl call while a device     was being detached.(CVE-2015-8962i1/4%0

  - The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) via vectors     involving omission of the firmware name from a certain     data structure. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-7913i1/4%0

  - drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 does not ensure that     certain length values are sufficiently large, which     allows remote attackers to cause a denial of service     (system crash or large loop) or possibly execute     arbitrary code via a crafted packet, related to the (1)     oz_usb_rx and (2) oz_usb_handle_ep_data     functions.(CVE-2015-4002i1/4%0

  - Race condition in the environ_read() function in     'fs/proc/base.c' in the Linux kernel before 4.5.4     allows local users to obtain sensitive information from     kernel memory by reading a '/proc/*/environ' file     during a process-setup time interval in which     environment-variable copying is     incomplete.(CVE-2016-7916i1/4%0

  - Integer signedness error in the oz_hcd_get_desc_cnf     function in drivers/staging/ozwpan/ozhcd.c in the     OZWPAN driver in the Linux kernel through 4.0.5 allows     remote attackers to cause a denial of service (system     crash) or possibly execute arbitrary code via a crafted     packet.(CVE-2015-4001i1/4%0

  - A vulnerability was found in the Linux kernel when     peeling off an association to the socket in another     network namespace. All transports in this association     are not to be rehashed and keep using the old key in     hashtable, thus removing transports from hashtable when     closing the socket, all transports are being freed.
    Later on a use-after-free issue could be caused when     looking up an association and dereferencing the     transports.(CVE-2017-15115i1/4%0

  - The evm_verify_hmac function in     security/integrity/evm/evm_main.c in the Linux kernel     before 4.5 does not properly copy data, which makes it     easier for local users to forge MAC values via a timing     side-channel attack.(CVE-2016-2085i1/4%0

  - A flaw was discovered in processing setsockopt for 32     bit processes on 64 bit systems. This flaw will allow     attackers to alter arbitrary kernel memory when     unloading a kernel module. This action is usually     restricted to root-privileged users but can also be     leveraged if the kernel is compiled with CONFIG_USER_NS     and CONFIG_NET_NS and the user is granted elevated     privileges.(CVE-2016-4997i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
95685	Fedora 25 : kernel (2016-bbe98c341c)	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
95680	Fedora 23 : kernel (2016-9c17cb9648)	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
97098	Ubuntu 16.10 : linux-raspi2 vulnerabilities (USN-3190-2)	Nessus	Ubuntu Local Security Checks	2017/2/10	2023/1/12	critical
95685	Fedora 25：カーネル（2016-bbe98c341c）	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
95680	Fedora 23：カーネル（2016-9c17cb9648）	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
97098	Ubuntu 16.10：linux-raspi2の脆弱性（USN-3190-2）	Nessus	Ubuntu Local Security Checks	2017/2/10	2023/1/12	critical
97018	Ubuntu 16.10：linux 弱點 (USN-3190-1)	Nessus	Ubuntu Local Security Checks	2017/2/6	2023/1/12	critical
97018	Ubuntu 16.10：linux 漏洞 (USN-3190-1)	Nessus	Ubuntu Local Security Checks	2017/2/6	2023/1/12	critical
97098	Ubuntu 16.10：linux-raspi2 弱點 (USN-3190-2)	Nessus	Ubuntu Local Security Checks	2017/2/10	2023/1/12	critical
97098	Ubuntu 16.10：linux-raspi2 漏洞 (USN-3190-2)	Nessus	Ubuntu Local Security Checks	2017/2/10	2023/1/12	critical
97018	Ubuntu 16.10：Linuxの脆弱性（USN-3190-1）	Nessus	Ubuntu Local Security Checks	2017/2/6	2023/1/12	critical
95676	Fedora 24：カーネル（2016-5ec2475e3f）	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
95676	Fedora 24 : kernel (2016-5ec2475e3f)	Nessus	Fedora Local Security Checks	2016/12/12	2021/1/11	high
97018	Ubuntu 16.10 : linux vulnerabilities (USN-3190-1)	Nessus	Ubuntu Local Security Checks	2017/2/6	2023/1/12	critical
124981	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1528)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high

偵測

搜尋 Plugin

high

high

critical

high

high

critical

critical

critical

critical

critical

critical

high

high

critical

high