Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Linux 内核 之前的版本中发现一个问题 4.17.2。 drivers/virt/vboxguest/vboxguest_linux.c 中的 vbg_misc_device_ioctl() 使用 copy_from_user 读取相同的用户数据两次。用户数据的标头部分是双重提取的，由于争用条件，恶意用户线程可在两次提取期间篡改标头中的重要变量（hdr.size_in 和 hdr.size_out），进而导致严重的内核错误，例如缓冲区过度访问。此缺陷可造成本地拒绝服务和信息泄漏。 (CVE-2018-12633)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在到 4.17.2為止的 Linux 核心中發現一個問題。 drivers/virt/vboxguest/vboxguest_linux.c 中的 vbg_misc_device_ioctl() 會透過 copy_from_user 讀取相同的使用者資料兩次。使用者資料的標頭部分是雙重擷取的，因此由於爭用情形所致，惡意使用者執行緒可在兩次擷取之間竄改標頭中的重要變數 (hdr.size_in 和 hdr.size_out)，進而導致伺服器核心錯誤，例如緩衝區過度存取。此錯誤可造成本機拒絕服務和資訊洩漏。 (CVE-2018-12633)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - までの Linux カーネルで問題が見つかりました 4.17.2。 drivers/virt/vboxguest/vboxguest_linux.c の vbg_misc_device_ioctl() は、copy_from_user で同じユーザーデータを二度読み取ります。ユーザーデータのヘッダー部分がダブルフェッチされ、悪意のあるユーザースレッドが競合状態にある2つのフェッチの間のヘッダーにある重要な変数（hdr.size_inとhdr.size_out）を改ざんし、バッファオーバーアクセスなどの深刻なカーネルエラーを引き起こす可能性があります。このバグにより、ローカルのサービス拒否や情報漏洩が発生する可能性があります。CVE-2018-12633

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

v4.17.3更新には、ツリーにわたる重要な修正が含まれています。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header     part of the user data is double-fetched, and a malicious user thread can tamper with the critical     variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race     condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local     denial of service and information leakage. (CVE-2018-12633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The v4.17.3 update contains important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003075 advisory.

    An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header     part of the user data is double-fetched, and a malicious user thread can tamper with the critical     variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race     condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local     denial of service and information leakage.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001239 advisory.

    An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header     part of the user data is double-fetched, and a malicious user thread can tamper with the critical     variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race     condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local     denial of service and information leakage.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002933 advisory.

    An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice with copy_from_user. The header     part of the user data is double-fetched, and a malicious user thread can tamper with the critical     variables (hdr.size_in and hdr.size_out) in the header between the two fetches because of a race     condition, leading to severe kernel errors, such as buffer over-accesses. This bug can cause a local     denial of service and information leakage.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges.(CVE-2017-8824i1/4%0

  - The OZWPAN driver in the Linux kernel through 4.0.5     relies on an untrusted length field during packet     parsing, which allows remote attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read and system crash)     via a crafted packet.(CVE-2015-4004i1/4%0

  - Integer signedness error in the MSM V4L2 video driver     for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to gain     privileges or cause a denial of service (array overflow     and memory corruption) via a crafted application that     triggers an msm_isp_axi_create_stream     call.(CVE-2016-2061i1/4%0

  - A denial of service flaw was found in the way the Linux     kernel's XFS file system implementation ordered     directory hashes under certain conditions. A local     attacker could use this flaw to corrupt the file system     by creating directories with colliding hash values,     potentially resulting in a system     crash.(CVE-2014-7283i1/4%0

  - It was found that the Linux kernel's ping socket     implementation did not properly handle socket unhashing     during spurious disconnects, which could lead to a     use-after-free flaw. On x86-64 architecture systems, a     local user able to create ping sockets could use this     flaw to crash the system. On non-x86-64 architecture     systems, a local user able to create ping sockets could     use this flaw to escalate their privileges on the     system.(CVE-2015-3636i1/4%0

  - Incorrect buffer length handling was found in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in     the Linux kernel, which could be exploited by malicious     NCPFS servers to crash the kernel or possibly execute     an arbitrary code.(CVE-2018-8822i1/4%0

  - ** DISPUTED ** Kernel Samepage Merging (KSM) in the     Linux kernel 2.6.32 through 4.x does not prevent use of     a write-timing side channel, which allows guest OS     users to defeat the ASLR protection mechanism on other     guest OS instances via a Cross-VM ASL INtrospection     (CAIN) attack. NOTE: the vendor states 'Basically if     you care about this attack vector, disable     deduplication.' Share-until-written approaches for     memory conservation among mutually untrusting tenants     are inherently detectable for information disclosure,     and can be classified as potentially misunderstood     behaviors rather than vulnerabilities.(CVE-2015-2877i1/4%0

  - The tty_set_termios_ldisc() function in     'drivers/tty/tty_ldisc.c' in the Linux kernel before     4.5 allows local users to obtain sensitive information     from kernel memory by reading a tty data     structure.(CVE-2015-8964i1/4%0

  - An issue was discovered in the Linux kernel through     4.17.2. vbg_misc_device_ioctl() in     drivers/virt/vboxguest/vboxguest_linux.c reads the same     user data twice with copy_from_user. The header part of     the user data is double-fetched, and a malicious user     thread can tamper with the critical variables     (hdr.size_in and hdr.size_out) in the header between     the two fetches because of a race condition, leading to     severe kernel errors, such as buffer over-accesses.
    This bug can cause a local denial of service and     information leakage.(CVE-2018-12633i1/4%0

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2018-1092i1/4%0

  - fs/f2fs/extent_cache.c in the Linux kernel, before     4.13, mishandles extent trees. This allows local users     to cause a denial of service via an application with     multiple threads.(CVE-2017-18193i1/4%0

  - A design flaw was found in the file extended attribute     handling of the Linux kernel's handling of cached     attributes. Too many entries in the cache cause a soft     lockup while attempting to iterate the cache and access     relevant locks.(CVE-2015-8952i1/4%0

  - Off-by-one error in the pipe_advance function in     lib/iov_iter.c in the Linux kernel before 4.9.5 allows     local users to obtain sensitive information from     uninitialized heap-memory locations in opportunistic     circumstances by reading from a pipe after an incorrect     buffer-release decision.(CVE-2017-5550i1/4%0

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806i1/4%0

  - The mp_get_count function in     drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel     before 3.12 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel stack memory via a TIOCGICOUNT     ioctl call.(CVE-2013-4516i1/4%0

  - The perf_cpu_time_max_percent_handler function in     kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service     (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an     incorrect sample-rate calculation.(CVE-2017-18255i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when     mounting a crafted btrfs image could lead to a system     crash and a denial of service.(CVE-2018-14609i1/4%0

  - The oz_usb_handle_ep_data function in     drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver     in the Linux kernel through 4.0.5 allows remote     attackers to cause a denial of service (divide-by-zero     error and system crash) via a crafted     packet.(CVE-2015-4003i1/4%0

  - drivers/hid/hid-logitech-dj.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) or obtain     sensitive information from kernel memory via a crafted     device.(CVE-2013-2895i1/4%0

  - drivers/usb/serial/cypress_m8.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a USB device without both an     interrupt-in and an interrupt-out endpoint descriptor,     related to the cypress_generic_port_probe and     cypress_open functions.(CVE-2016-3137i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
246059	Linux Distros 未修补的漏洞：CVE-2018-12633	Nessus	Misc.	2025/8/8	2026/10/29	medium
246059	Linux Distros 未修補的弱點：CVE-2018-12633	Nessus	Misc.	2025/8/8	2026/10/29	medium
246059	Linux Distros のパッチ未適用の脆弱性: CVE-2018-12633	Nessus	Misc.	2025/8/8	2026/10/29	medium
110821	Fedora 27：kernel（2018-2a0f8b2c9d）	Nessus	Fedora Local Security Checks	2018/7/2	2025/3/27	medium
120836	Fedora 28：カーネル（2018-d92fde52d7）	Nessus	Fedora Local Security Checks	2019/1/3	2025/3/21	medium
246059	Linux Distros Unpatched Vulnerability : CVE-2018-12633	Nessus	Misc.	2025/8/8	2026/10/29	medium
110821	Fedora 27 : kernel (2018-2a0f8b2c9d)	Nessus	Fedora Local Security Checks	2018/7/2	2025/3/27	medium
287243	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003075)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
290865	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001239)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
120836	Fedora 28 : kernel (2018-d92fde52d7)	Nessus	Fedora Local Security Checks	2019/1/3	2025/3/21	medium
287572	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002933)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
124800	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1476)	Nessus	Huawei Local Security Checks	2019/5/13	2022/5/20	high

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high