Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 4.12.9 までの Linux カーネルの drivers/acpi/acpica/dsutils.c の acpi_ds_create_operands() 関数が、オペランドキャッシュをフラッシュせず、カーネルスタックダンプを引き起こします。これにより、ローカルユーザーがカーネルメモリから機密情報を取得し、 をバイパスする可能性があります。細工された ACPI テーブルを介した KASLR 保護メカニズム（ 4.9までのカーネル）。 （CVE-2017-13693）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):A buffer overflow was     discovered in tpacket_rcv() function in the Linux     kernel since v4.6-rc1 through v4.13. A number of     socket-related syscalls can be made to set up a     configuration when each packet received by a network     interface can cause writing up to 10 bytes to a kernel     memory outside of a kernel buffer. This can cause     unspecified kernel data corruption effects, including     damage of in-memory and on-disk XFS     data.(CVE-2017-14497)The qmi_wwan_bind function in     driverset/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)A race condition flaw was found     in the way the Linux kernel's SCTP implementation     handled sctp_accept() during the processing of     heartbeat timeout events. A remote attacker could use     this flaw to prevent further connections to be accepted     by the SCTP server running on the system, resulting in     a denial of service.(CVE-2015-8767)A race condition     flaw was found in the way the Linux kernel's KVM     subsystem handled PIT (Programmable Interval Timer)     emulation. A guest user who has access to the PIT I/O     ports could use this flaw to crash the     host.(CVE-2014-3611)The Linux kernel is vulnerable to a     memory leak in the     driverset/wireless/mac80211_hwsim.c:hwsim_new_radio_nl(     ) function. An attacker could exploit this to cause a     potential denial of service.(CVE-2018-8087)An integer     underflow flaw was found in the way the Linux kernel's     Stream Control Transmission Protocol (SCTP)     implementation processed certain COOKIE_ECHO packets.
    By sending a specially crafted SCTP packet, a remote     attacker could use this flaw to prevent legitimate     connections to a particular SCTP server socket to be     made.(CVE-2014-4667)The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)The     snd_usb_create_streams function in sound/usb/card.c in     the Linux kernel, before 4.13.6, allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)A flaw was     found in the Linux kernel's random number generator     API. A null pointer dereference in the rngapi_reset     function may result in denial of service, crashing the     system.(CVE-2017-15116)The __netlink_deliver_tap_skb     function in netetlink/af_netlink.c in the Linux kernel,     through 4.14.4, does not restrict observations of     Netlink messages to a single net namespace, when     CONFIG_NLMON is enabled. This allows local users to     obtain sensitive information by leveraging the     CAP_NET_ADMIN capability to sniff an nlmon interface     for all Netlink activity on the     system.(CVE-2017-17449)arch/arm64/kernel/perf_event.c     in the Linux kernel before 4.1 on arm64 platforms     allows local users to gain privileges or cause a denial     of service (invalid pointer dereference) via vectors     involving events that are mishandled during a span of     multiple HW PMUs.(CVE-2015-8955)The aac_compat_ioctl     function in drivers/scsi/aacraid/linit.c in the Linux     kernel before 3.11.8 does not require the CAP_SYS_RAWIO     capability, which allows local users to bypass intended     access restrictions via a crafted ioctl     call.(CVE-2013-6383)Linux kernel before version     4.16-rc7 is vulnerable to a null pointer dereference in     dccp_write_xmit() function in net/dccp/output.c in that     allows a local user to cause a denial of service by a     number of certain crafted system     calls.(CVE-2018-1130)The Linux kernel is vulerable to a     use-after-free flaw when Transformation User     configuration interface(CONFIG_XFRM_USER) compile-time     configuration were enabled. This vulnerability occurs     while closing a xfrm netlink socket in     xfrm_dump_policy_done. A user/process could abuse this     flaw to potentially escalate their privileges on a     system.(CVE-2017-16939)A vulnerability was found in the     Linux kernel in function rds_inc_info_copy of file     net/rds/recv.c. The last field 'flags' of object     'minfo' is not initialized. This can leak data     previously at the flags location to     userspace.(CVE-2016-5244)A flaw was found in the     kernel's ACPI interpreter when it does not flush the     operand cache and causes a kernel stack dump. This     allows local users to obtain sensitive information from     kernel memory and bypass the KASLR protection     mechanism.(CVE-2017-13693)It was found that     kernel/events/core.c in the Linux kernel mishandles     counter grouping, which allows local users to gain     privileges via a crafted application, related to the     perf_pmu_register and perf_event_open     functions.(CVE-2015-9004)The xfs_bmap_extents_to_btree     function in fs/xfs/libxfs/xfs_bmap.c in the Linux     kernel through 4.16.3 allows local users to cause a     denial of service (xfs_bmapi_write NULL pointer     dereference) via a crafted xfs     image.(CVE-2018-10323)The lrw_crypt() function in     'crypto/lrw.c' in the Linux kernel before 4.5 allows     local users to cause a system crash and a denial of     service by the NULL pointer dereference via accept(2)     system call for AF_ALG socket without calling setkey()     first to set a cipher key.(CVE-2015-8970)The IPv6     fragmentation implementation in the Linux kernel does     not consider that the nexthdr field may be associated     with an invalid option, which allows local users to     cause a denial of service (out-of-bounds read and BUG)     or possibly have unspecified other impact via crafted     socket and send system calls. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9074)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c     driver.(CVE-2019-15212)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the     drivers/media/usb/dvb-usb/dvb-usb-init.c     driver.(CVE-2019-15213)

  - An issue was discovered in the Linux kernel before     5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c     driver.(CVE-2019-15215)

  - An issue was discovered in the Linux kernel before     5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c     driver.(CVE-2019-15216)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the     drivers/media/usb/zr364xx/zr364xx.c     driver.(CVE-2019-15217)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c     in the Linux kernel before 5.1.12. In the qedi_dbg_*     family of functions, there is an out-of-bounds     read.(CVE-2019-15090)

  - An issue was discovered in the Linux kernel before     4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file     kernel/trace/trace.c.(CVE-2017-18595)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - Heap-based buffer overflow in the     logi_dj_ll_raw_request function in     drivers/hid/hid-logitech-dj.c in the Linux kernel     before 3.16.2 allows physically proximate attackers to     cause a denial of service (system crash) or possibly     execute arbitrary code via a crafted device that     specifies a large report size for an LED     report.(CVE-2014-3183)

  - An issue was discovered in the Linux kernel before     5.0.5. There is a use-after-free issue when     hci_uart_register_dev() fails in hci_uart_set_proto()     in drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)

  - An issue was discovered in the Linux kernel before     5.0.10. There is a use-after-free in the sound     subsystem because card disconnection causes certain     data structures to be deleted too early. This is     related to sound/core/init.c and     sound/core/info.c.(CVE-2019-15214)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 4.12.9 及之前版本的 Linux 内核的 drivers/acpi/acpica/dsutils.c 中的 acpi_ds_create_operands() 函数未刷新操作数缓存并导致内核堆栈转储，这样本地用户可从内核内存获取敏感信息并绕过通过特制的 ACPI 表造成的 KASLR 保护机制（在内核及 4.9之前的版本中）。 (CVE-2017-13693)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 4.12.9 版之前的 Linux 核心中，drivers/acpi/acpica/dsutils.c 內的 acpi_ds_create_operands() 函式未排清運算元快取，並造成核心堆疊轉儲存，其允許本機使用者從核心記憶體取得敏感資訊並繞過透過特製 ACPI 表格的 KASLR 保護機制 (在 及之前 4.9版本的核心中)。 (CVE-2017-13693)

請注意，Nessus 依賴供應商報告的套件存在。

CVE-2017-13693、CVE-2017-13694、CVE-2017-13695のセキュリティ修正。

これは、ユーザー空間ACPICAツールのみの修正を提供します。カーネルの更新はすべて個別に処理されます。

この更新には、20190209バージョンのUpstreamソースへのアップグレードも含まれています。 

---------------------------------------- 2018年2月9日。バージョン20180209の変更のサマリー：

1）ACPICAカーネル常駐サブシステム：

パッケージオブジェクト処理およびモジュールレベルのAMLコードサポートに対する最近の変更の最終統合を完了しました。これにより、パッケージオブジェクトがモジュールレベルのコードブロック内から宣言されたときに、個々のパッケージ要素からの前方参照が可能になります。他のACPI実装との互換性を提供します。

AMLモジュールレベルのコードの新しいアーキテクチャが完成し、現在ACPICAコードのデフォルトになっています。この新しいアーキテクチャは、テーブルが完全にロードされるまでこのコードを保留していた以前のアーキテクチャの代わりに、ACPIテーブルがロード/解析されると、モジュールレベルのコードをインラインで実行します。これにより、一部のASLコード順序の問題が解決され、他のACPI実装との互換性が提供されます。現時点で、以前のアーキテクチャにフォールバックするオプションがありますが、このサポートは廃止予定であり、今年後半に完全に削除される予定です。

パッケージオブジェクト内の名前付き参照要素の解決中にAE_NOT_FOUND例外を無視するためのコンパイル時オプションを追加しました。
これは深刻な問題の可能性がありますが、ファームウェアが未使用のパッケージオブジェクトを大量に処理するプラットフォームでは、多くのノイズ/エラーが発生する可能性があります。これらのエラーを無効にするには、OS固有のヘッダーでACPI_IGNORE_PACKAGE_RESOLUTION_ERRORSを定義します。AcpiExecなどのACPICAアプリケーションでは、必ずすべてのエラーが報告されます。

明示的型変換AML演算子に関連する不具合を修正しました（ToXXXX）。この不具合は2017年の早い時期に導入されましたが、最近まで確認されていませんでした。これは、このような演算子が他のACPI実装で完全にサポートされておらず、ファームウェア開発者によって使用されることがほとんどなかったためです。演算子は、「暗黙的結果オブジェクト変換」を実装しないようにACPI仕様で定義されています。この不具合は、以下の明示的変換演算子に対して、このオブジェクト変換が不適切に導入されていました：

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2）iASLコンパイラ/逆アセンブラとツール：

iASL：ToXXXXの明示的変換演算子に関連したコンパイラ定数畳み込み機能に伴う問題を修正しました。これらの演算子は、定義によって「暗黙的結果オブジェクト変換」をサポートしません。
したがって、これらの演算子を使用するASL式を単純なStore演算子に畳み込むことはできません。これは、Store演算子は暗黙的変換を実装しているためです。この変更では、代わりにToXXXX演算子畳み込みにCopyObject演算子が使用されます。CopyObjectは、暗黙的結果変換を実装しないように定義されているため、ToXXXX演算子の畳み込みに適しています。

iASL：シンボルがローカルでと外部シンボルとしての両方で宣言されている場合は、エラー状態の深刻度を単純な警告に変更しました。これは、既存のASLコードに適合します。

AcpiExec：モジュールレベルのコードの新しいアーキテクチャを有効にするための-epオプションが削除されました。これは、逆の効果を持つ-dpオプションに置き換えられています：これは、新しいアーキテクチャ（デフォルト）を無効にし、レガシーアーキテクチャを有効にします。レガシーコードが今後削除された場合は、-dpオプションも削除されます。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The acpi_ds_create_operands() function in drivers/acpi/acpica/dsutils.c in the Linux kernel through 4.12.9     does not flush the operand cache and causes a kernel stack dump, which allows local users to obtain     sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through     4.9) via a crafted ACPI table. (CVE-2017-13693)

Note that Nessus relies on the presence of the package as reported by the vendor.

Security fix for CVE-2017-13693, CVE-2017-13694, CVE-2017-13695.

This provides fixes for the user space ACPICA tools only. Any kernel updates are handled separately.

This update also includes the upgrade to the 20190209 version of the upstream source. 

---------------------------------------- 09 February 2018. Summary of changes for version 20180209 :

1) ACPICA kernel-resident subsystem :

Completed the final integration of the recent changes to Package Object handling and the module-level AML code support. This allows forward references from individual package elements when the package object is declared from within module-level code blocks. Provides compatibility with other ACPI implementations.

The new architecture for the AML module-level code has been completed and is now the default for the ACPICA code. This new architecture executes the module-level code in-line as the ACPI table is loaded/parsed instead of the previous architecture which deferred this code until after the table was fully loaded. This solves some ASL code ordering issues and provides compatibility with other ACPI implementations. At this time, there is an option to fallback to the earlier architecture, but this support is deprecated and is planned to be completely removed later this year.

Added a compile-time option to ignore AE_NOT_FOUND exceptions during resolution of named reference elements within Package objects.
Although this is potentially a serious problem, it can generate a lot of noise/errors on platforms whose firmware carries around a bunch of unused Package objects. To disable these errors, define ACPI_IGNORE_PACKAGE_RESOLUTION_ERRORS in the OS-specific header. All errors are always reported for ACPICA applications such as AcpiExec.

Fixed a regression related to the explicit type-conversion AML operators (ToXXXX). The regression was introduced early in 2017 but was not seen until recently because these operators are not fully supported by other ACPI implementations and are thus rarely used by firmware developers. The operators are defined by the ACPI specification to not implement the 'implicit result object conversion'. The regression incorrectly introduced this object conversion for the following explicit conversion operators :

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2) iASL Compiler/Disassembler and Tools :

iASL: Fixed a problem with the compiler constant folding feature as related to the ToXXXX explicit conversion operators. These operators do not support the 'implicit result object conversion' by definition.
Thus, ASL expressions that use these operators cannot be folded to a simple Store operator because Store implements the implicit conversion. This change uses the CopyObject operator for the ToXXXX operator folding instead. CopyObject is defined to not implement implicit result conversions and is thus appropriate for folding the ToXXXX operators.

iASL: Changed the severity of an error condition to a simple warning for the case where a symbol is declared both locally and as an external symbol. This accommodates existing ASL code.

AcpiExec: The -ep option to enable the new architecture for module-level code has been removed. It is replaced by the -dp option which instead has the opposite effect: it disables the new architecture (the default) and enables the legacy architecture. When the legacy code is removed in the future, the -dp option will be removed also.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     through 4.13.2 allows local users to cause a denial of     service (panic) by leveraging incorrect length     validation.(CVE-2017-14489)

  - The move_pages system call in mm/migrate.c in the Linux     kernel before 4.12.9 doesn't check the effective uid of     the target process, enabling a local attacker to learn     the memory layout of a setuid executable despite     ASLR.(CVE-2017-14140)

  - The offset2lib patch as used in the Linux Kernel     contains a vulnerability that allows a PIE binary to be     execve()'ed with 1GB of arguments or environmental     strings then the stack occupies the address 0x80000000     and the PIE binary is mapped above 0x40000000     nullifying the protection of the offset2lib patch. This     affects Linux Kernel version 4.11.5 and earlier. This     is a different issue than CVE-2017-1000371. This issue     appears to be limited to i386 based     systems.(CVE-2017-1000370)

  - Race condition in fs/timerfd.c in the Linux kernel     before 4.10.15 allows local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel     queueing.(CVE-2017-10661)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - The tcp_disconnect function in net/ipv4/tcp.c in the     Linux kernel before 4.12 allows local users to cause a     denial of service (__tcp_select_window divide-by-zero     error and system crash) by triggering a disconnect     within a certain tcp_recvmsg code path.(CVE-2017-14106)

  - The native Bluetooth stack in the Linux Kernel (BlueZ),     starting at the Linux kernel version 3.3-rc1 and up to     and including 4.13.1, are vulnerable to a stack     overflow vulnerability in the processing of L2CAP     configuration responses resulting in Remote code     execution in kernel space.(CVE-2017-1000251

  - )

  - The prepare_vmcs02 function in arch/x86/kvm/vmx.c in     the Linux kernel through 4.13.3 does not ensure that     the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allows KVM L2 guest     OS users to obtain read and write access to the     hardware CR8 register.(CVE-2017-12154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

4.12.11 stable カーネルの更新には、多岐にわたる重要なバグ修正が多く含まれています。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

CVE-2017-13693、CVE-2017-13694、CVE-2017-13695のセキュリティ修正。

これは、ユーザー空間ACPICAツールのみの修正を提供します。カーネルの更新はすべて個別に処理されます。

この更新には、20190209バージョンのUpstreamソースへのアップグレードも含まれています。 

---------------------------------------- 2018年2月9日。バージョン20180209の変更のサマリー：

1）ACPICAカーネル常駐サブシステム：

パッケージオブジェクト処理およびモジュールレベルのAMLコードサポートに対する最近の変更の最終統合を完了しました。これにより、パッケージオブジェクトがモジュールレベルのコードブロック内から宣言されたときに、個々のパッケージ要素からの前方参照が可能になります。他のACPI実装との互換性を提供します。

AMLモジュールレベルのコードの新しいアーキテクチャが完成し、現在ACPICAコードのデフォルトになっています。この新しいアーキテクチャは、テーブルが完全にロードされるまでこのコードを保留していた以前のアーキテクチャの代わりに、ACPIテーブルがロード/解析されると、モジュールレベルのコードをインラインで実行します。これにより、一部のASLコード順序の問題が解決され、他のACPI実装との互換性が提供されます。現時点で、以前のアーキテクチャにフォールバックするオプションがありますが、このサポートは廃止予定であり、今年後半に完全に削除される予定です。

パッケージオブジェクト内の名前付き参照要素の解決中にAE_NOT_FOUND例外を無視するためのコンパイル時オプションを追加しました。
これは深刻な問題の可能性がありますが、ファームウェアが未使用のパッケージオブジェクトを大量に処理するプラットフォームでは、多くのノイズ/エラーが発生する可能性があります。これらのエラーを無効にするには、OS固有のヘッダーでACPI_IGNORE_PACKAGE_RESOLUTION_ERRORSを定義します。AcpiExecなどのACPICAアプリケーションでは、必ずすべてのエラーが報告されます。

明示的型変換AML演算子に関連する不具合を修正しました（ToXXXX）。この不具合は2017年の早い時期に導入されましたが、最近まで確認されていませんでした。これは、このような演算子が他のACPI実装で完全にサポートされておらず、ファームウェア開発者によって使用されることがほとんどなかったためです。演算子は、「暗黙的結果オブジェクト変換」を実装しないようにACPI仕様で定義されています。この不具合では、以下の明示的変換演算子にこのオブジェクト変換が誤って導入されました：

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2）iASLコンパイラ/逆アセンブラとツール：

iASL：ToXXXXの明示的変換演算子に関連したコンパイラ定数畳み込み機能に伴う問題を修正しました。これらの演算子は、定義によって「暗黙的結果オブジェクト変換」をサポートしません。
したがって、これらの演算子を使用するASL式を単純なStore演算子に畳み込むことはできません。これは、Store演算子は暗黙的変換を実装しているためです。この変更では、代わりにToXXXX演算子畳み込みにCopyObject演算子が使用されます。CopyObjectは、暗黙的結果変換を実装しないように定義されているため、ToXXXX演算子の畳み込みに適しています。

iASL：シンボルがローカルでと外部シンボルとしての両方で宣言されている場合は、エラー状態の深刻度を単純な警告に変更しました。これは、既存のASLコードに適合します。

AcpiExec：モジュールレベルのコードの新しいアーキテクチャを有効にするための-epオプションが削除されました。これは、逆の効果を持つ-dpオプションに置き換えられています：これは、新しいアーキテクチャ（デフォルト）を無効にし、レガシーアーキテクチャを有効にします。レガシーコードが今後削除された場合は、-dpオプションも削除されます。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

The 4.12.11 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Array index error in the tcm_vhost_make_tpg function in     drivers/vhost/scsi.c in the Linux kernel before 4.0     might allow guest OS users to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl     call. NOTE: the affected function was renamed to     vhost_scsi_make_tpg before the vulnerability was     announced.(CVE-2015-4036)

  - The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3     allows local users to gain privileges or cause a denial     of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames,     leading to recursive pagefault handling.(CVE-2016-1583)

  - It was found that SCSI driver in the Linux kernel can     improperly access userspace memory outside the provided     buffer. A local privileged attacker could potentially     use this flaw to expose information from the kernel     memory.(CVE-2017-13168)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h     in the Linux kernel before 4.13.2 does not verify that     a filesystem has a realtime device, which allows local     users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory.(CVE-2017-14340)

  - The xfs_bmap_extents_to_btree function in     fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through     4.16.3 allows local users to cause a denial of service     (xfs_bmapi_write NULL pointer dereference) via a     crafted xfs image.(CVE-2018-10323)

  - A flaw was found in Linux kernel in the ext4 filesystem     code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and     operating a crafted ext4 image.(CVE-2018-10876)

  - A flaw was found in the Linux kernel ext4 filesystem.
    An out-of-bound access is possible in the     ext4_ext_drop_refs() function when operating on a     crafted ext4 filesystem image.(CVE-2018-10877)

  - The pcpu_embed_first_chunk function in mm/percpu.c in     the Linux kernel through 4.14.14 allows local users to     obtain sensitive address information by reading dmesg     data from a(CVE-2018-5995)

  - Memory leak in the irda_bind function in     net/irda/af_irda.c and later in     drivers/staging/irda/net/af_irda.c in the Linux kernel     before 4.17 allows local users to cause a denial of     service (memory consumption) by repeatedly binding an     AF_IRDA socket.(CVE-2018-6554)

  - A NULL pointer dereference was found in the     net/rds/rdma.c __rds_rdma_map() function in the Linux     kernel before 4.14.7 allowing local attackers to cause     a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST.(CVE-2018-7492)

  - ** DISPUTED ** Race condition in the     store_int_with_restart() function in     arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel     through 4.15.7 allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck<cpu     number> directory. NOTE: a third party has indicated     that this report is not security     relevant.(CVE-2018-7995)

  - Non-optimized code for key handling of shared futexes     was found in the Linux kernel in the form of unbounded     contention time due to the page lock for real-time     users. Before the fix, the page lock was an     unnecessarily heavy lock for the futex path that     protected too much. After the fix, the page lock is     only required in a specific corner case.(CVE-2018-9422)

  - A memory leak in the ccp_run_sha_cmd() function in     drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-128c66429247.(CVE-2019-18808)

  - In the Linux kernel before 5.1, there is a memory leak     in __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
220620	Linux Distros のパッチ未適用の脆弱性: CVE-2017-13693	Nessus	Misc.	2025/3/4	2025/9/3	medium
124990	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1537)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high
129129	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1972)	Nessus	Huawei Local Security Checks	2019/9/23	2024/4/24	high
220620	Linux Distros 未修补的漏洞: CVE-2017-13693	Nessus	Misc.	2025/3/4	2025/9/3	medium
220620	Linux Distros 未修補弱點：CVE-2017-13693	Nessus	Misc.	2025/3/4	2025/9/3	medium
120603	Fedora 28：acpica-tools（2018-8d90571cdf）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	medium
132605	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1012)	Nessus	Huawei Local Security Checks	2020/1/2	2024/4/1	critical
220620	Linux Distros Unpatched Vulnerability : CVE-2017-13693	Nessus	Misc.	2025/3/4	2025/9/3	medium
120603	Fedora 28 : acpica-tools (2018-8d90571cdf)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	medium
104578	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1245)	Nessus	Huawei Local Security Checks	2017/11/16	2021/1/6	high
135525	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2020-1396)	Nessus	Huawei Local Security Checks	2020/4/15	2023/4/25	critical
137516	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2020-1674)	Nessus	Huawei Local Security Checks	2020/6/17	2023/4/25	critical
103117	Fedora 26：kernel（2017-6764d16965）	Nessus	Fedora Local Security Checks	2017/9/12	2021/1/6	medium
103151	Fedora 25：kernel（2017-a3a8638a60）	Nessus	Fedora Local Security Checks	2017/9/13	2021/1/6	medium
108777	Fedora 27：acpica-tools（2018-7c2e0a998d）	Nessus	Fedora Local Security Checks	2018/4/2	2024/11/21	medium
103117	Fedora 26 : kernel (2017-6764d16965)	Nessus	Fedora Local Security Checks	2017/9/12	2021/1/6	medium
103151	Fedora 25 : kernel (2017-a3a8638a60)	Nessus	Fedora Local Security Checks	2017/9/13	2021/1/6	medium
108777	Fedora 27 : acpica-tools (2018-7c2e0a998d)	Nessus	Fedora Local Security Checks	2018/4/2	2024/11/21	medium
141697	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-2222)	Nessus	Huawei Local Security Checks	2020/10/21	2021/1/6	high

偵測

搜尋 Plugin

medium

high

high

medium

medium

medium

critical

medium

medium

high

critical

critical

medium

medium

medium

medium

medium

medium

high