The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A security flaw was found in the Linux kernel in     drivers/tty/n_tty.c which allows local attackers (ones     who are able to access pseudo terminals) to lock them     up and block further usage of any pseudo terminal     devices due to an EXTPROC versus ICANON confusion in     TIOCINQ handler.i1/4^CVE-2018-18386i1/4%0

  - The Linux kernel was found vulnerable to an integer     overflow in the     drivers/video/fbdev/uvesafb.c:uvesafb_setcmap()     function. The vulnerability could result in local     attackers being able to crash the kernel or potentially     elevate privileges.i1/4^CVE-2018-13406i1/4%0

  - The vsock_stream_sendmsg function in     net/vmw_vsock/af_vsock.c in the Linux kernel before     3.9-rc7 does not initialize a certain length variable,     which allows local users to obtain sensitive     information from kernel stack memory via a crafted     recvmsg or recvfrom system call.i1/4^CVE-2013-3237i1/4%0

  - The llc_ui_recvmsg function in net/llc/af_llc.c in the     Linux kernel before 3.9-rc7 does not initialize a     certain length variable, which allows local users to     obtain sensitive information from kernel stack memory     via a crafted recvmsg or recvfrom system     call.i1/4^CVE-2013-3231i1/4%0

  - The crypto API in the Linux kernel through 3.9-rc8 does     not initialize certain length variables, which allows     local users to obtain sensitive information from kernel     stack memory via a crafted recvmsg or recvfrom system     call, related to the hash_recvmsg function in     crypto/algif_hash.c and the skcipher_recvmsg function     in crypto/algif_skcipher.c.i1/4^CVE-2013-3076i1/4%0

  - Integer overflow in the snd_compr_allocate_buffer     function in sound/core/compress_offload.c in the ALSA     subsystem in the Linux kernel before     3.6-rc6-next-20120917 allows local users to cause a     denial of service (insufficient memory allocation) or     possibly have unspecified other impact via a crafted     SNDRV_COMPRESS_SET_PARAMS ioctl     call.i1/4^CVE-2012-6703i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
123890	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1204)	Nessus	Huawei Local Security Checks	Local	high
123883	EulerOS Virtualization 2.5.3 : kernel (EulerOS-SA-2019-1197)	Nessus	Huawei Local Security Checks	Local	high

Detections

Analytics

CVE-2013-3237

medium

Tenable Plugins

high

high