Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2     Voice Service driver for the Linux kernel 3.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via a write request, as demonstrated by a     voice_svc_send_req buffer overflow.(CVE-2016-5343i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655i1/4%0

  - Race condition in the handle_to_path function in     fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function.(CVE-2015-1420i1/4%0

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631i1/4%0

  - A flaw was found in the ext4 subsystem. This     vulnerability is a use after free vulnerability was     found in __ext4_journal_stop(). Attackers could abuse     this to allow any code which attempts to deal with the     journal failure to be mishandled or not fail at all.
    This could lead to data corruption or     crashes.(CVE-2015-8961i1/4%0

  - Buffer overflow in the oz_cdev_write function in     drivers/staging/ozwpan/ozcdev.c in the Linux kernel     before 3.12 allows local users to cause a denial of     service or possibly have unspecified other impact via a     crafted write operation.(CVE-2013-4513i1/4%0

  - The nfnetlink_rcv_batch() function in     'net/netfilter/nfnetlink.c' in the Linux kernel before     4.5 does not check whether a batch message's length     field is large enough, which allows local users to     obtain sensitive information from kernel memory or     cause a denial of service (infinite loop or     out-of-bounds read) by leveraging the CAP_NET_ADMIN     capability.(CVE-2016-7917i1/4%0

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587i1/4%0

  - A leak of information was possible when issuing a     netlink command of the stack memory area leading up to     this function call. An attacker could use this to     determine stack information for use in a later     exploit.(CVE-2016-5243i1/4%0

  - An issue was discovered in the Linux kernel in the F2FS     filesystem code. A NULL pointer dereference in     fscrypt_do_page_crypto() in the fs/crypto/crypto.c     function can occur when operating on a file on a     corrupted f2fs image.(CVE-2018-14616i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the sco_sock_bind() function (bluetooth/sco) did not     check the length of its sockaddr parameter. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8575i1/4%0

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257i1/4%0

  - The LLC subsystem in the Linux kernel does not ensure     that a certain destructor exists in required     circumstances, which allows local users to cause a     denial of service (BUG_ON) or possibly have unspecified     other impact via crafted system calls.(CVE-2017-6345i1/4%0

  - A vulnerability was found in Linux kernel. There is an     information leak in file sound/core/timer.c of the     latest mainline Linux kernel. The stack object aEURoer1aEUR     has a total size of 32 bytes. Its field aEURoeeventaEUR and     aEURoevalaEUR both contain 4 bytes padding. These 8 bytes     padding bytes are sent to user without being     initialized.(CVE-2016-4578i1/4%0

  - An information leak flaw was found in the way the Linux     kernel changed certain segment registers and     thread-local storage (TLS) during a context switch. A     local, unprivileged user could use this flaw to leak     the user space TLS base address of an arbitrary     process.(CVE-2014-9419i1/4%0

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364i1/4%0

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory.(CVE-2017-2618i1/4%0

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794i1/4%0

  - A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain     error code paths while processing FDRAWCMD IOCTL     commands. A local user with write access to /dev/fdX     could use this flaw to free (using the kfree()     function) arbitrary kernel memory. (CVE-2014-1737,     Important)t was found that the Linux kernel's floppy     driver leaked internal kernel memory addresses to user     space during the processing of the FDRAWCMD IOCTL     command. A local user with write access to /dev/fdX     could use this flaw to obtain information about the     kernel heap arrangement. (CVE-2014-1738, Low)Note: A     local user with write access to /dev/fdX could use     these two flaws (CVE-2014-1737 in combination with     CVE-2014-1738) to escalate their privileges on the     system.(CVE-2014-1737i1/4%0

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux kernel was updated to fix various bugs and security issues :

  - mm/page-writeback.c: do not count anon pages as     dirtyable memory (reclaim stalls).

  - mm/page-writeback.c: fix dirty_balance_reserve     subtraction from dirtyable memory (reclaim stalls).

  - compat_sys_recvmmsg X32 fix (bnc#860993 CVE-2014-0038).

  - hwmon: (coretemp) Fix truncated name of alarm attributes

  - net: fib: fib6_add: fix potential NULL pointer     dereference (bnc#854173 CVE-2013-6431).

  - keys: fix race with concurrent install_user_keyrings()     (bnc#808358)(CVE-2013-1792).

  - KVM: x86: Convert vapic synchronization to _cached     functions (CVE-2013-6368) (bnc#853052 CVE-2013-6368).

  - wireless: radiotap: fix parsing buffer overrun     (bnc#854634 CVE-2013-7027).

  - KVM: x86: fix guest-initiated crash with x2apic     (CVE-2013-6376) (bnc#853053 CVE-2013-6376).

  - KVM: x86: Fix potential divide by 0 in lapic     (CVE-2013-6367) (bnc#853051 CVE-2013-6367).

  - KVM: Improve create VCPU parameter (CVE-2013-4587)     (bnc#853050 CVE-2013-4587).

  - staging: ozwpan: prevent overflow in oz_cdev_write()     (bnc#849023 CVE-2013-4513).

  - perf/x86: Fix offcore_rsp valid mask for SNB/IVB     (bnc#825006).

  - perf/x86: Add Intel IvyBridge event scheduling     constraints (bnc#825006).

  - libertas: potential oops in debugfs (bnc#852559     CVE-2013-6378).

  - aacraid: prevent invalid pointer dereference (bnc#852373     CVE-2013-6380).

  - staging: wlags49_h2: buffer overflow setting station     name (bnc#849029 CVE-2013-4514).

  - net: flow_dissector: fail on evil iph->ihl (bnc#848079     CVE-2013-4348).

  - Staging: bcm: info leak in ioctl (bnc#849034     CVE-2013-4515).

  - Refresh     patches.fixes/net-rework-recvmsg-handler-msg_name-and-ms     g_namelen-logic.patch.

  - ipv6: remove max_addresses check from     ipv6_create_tempaddr (bnc#805226, CVE-2013-0343).

  - net: rework recvmsg handler msg_name and msg_namelen     logic (bnc#854722).

  - crypto: ansi_cprng - Fix off by one error in non-block     size request (bnc#840226).

  - x6: Fix reserve_initrd so that acpi_initrd_override is     reached (bnc#831836).

  - Refresh other Xen patches.

  - aacraid: missing capable() check in compat ioctl     (bnc#852558).

  -     patches.fixes/gpio-ich-fix-ichx_gpio_check_available-ret     urn.patch: Update upstream reference

  - perf/ftrace: Fix paranoid level for enabling function     tracer (bnc#849362).

  - xhci: fix NULL pointer dereference on     ring_doorbell_for_active_rings (bnc#848255).

  - xhci: Fix oops happening after address device timeout     (bnc#848255).

  - xhci: Ensure a command structure points to the correct     trb on the command ring (bnc#848255).

  -     patches.arch/iommu-vt-d-remove-stack-trace-from-broken-i     rq-remapping-warning.patch: Update upstream reference.

  - Allow NFSv4 username mapping to work properly     (bnc#838024).

  - Refresh btrfs attribute publishing patchset to match     openSUSE-13.1 No user-visible changes, but uses     kobj_sysfs_ops and better kobject lifetime management.

  - Fix a few incorrectly checked [io_]remap_pfn_range()     calls (bnc#849021, CVE-2013-4511).

  - drm/radeon: don't set hpd, afmt interrupts when     interrupts are disabled.

  -     patches.fixes/cifs-fill-TRANS2_QUERY_FILE_INFO-ByteCount
    -fields.patch: Fix TRANS2_QUERY_FILE_INFO ByteCount     fields (bnc#804950).

  - iommu: Remove stack trace from broken irq remapping     warning (bnc#844513).

  - Disable patches related to bnc#840656     patches.suse/btrfs-cleanup-don-t-check-the-same-thing-tw     ice     patches.suse/btrfs-0220-fix-for-patch-cleanup-don-t-chec     k-the-same-thi.patch

  - btrfs: use feature attribute names to print better error     messages.

  - btrfs: add ability to change features via sysfs.

  - btrfs: add publishing of unknown features in sysfs.

  - btrfs: publish per-super features to sysfs.

  - btrfs: add per-super attributes to sysfs.

  - btrfs: export supported featured to sysfs.

  - kobject: introduce kobj_completion.

  - btrfs: add ioctls to query/change feature bits online.

  - btrfs: use btrfs_commit_transaction when setting     fslabel.

  - x86/iommu/vt-d: Expand interrupt remapping quirk to     cover x58 chipset (bnc#844513).

  - NFSv4: Fix issues in nfs4_discover_server_trunking     (bnc#811746).

  - iommu/vt-d: add quirk for broken interrupt remapping on     55XX chipsets (bnc#844513).

Vasily Kulikov reported a flaw in the Linux kernel's implementation of ptrace. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-2929)

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's per event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

Jason Wang discovered a bug in the network flow dissector in the Linux kernel. A remote attacker could exploit this flaw to cause a denial of service (infinite loop). (CVE-2013-4348)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for the SystemBase Multi-2/PCI serial card. An unprivileged user could obtain sensitive information from kernel memory.
(CVE-2013-4516)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's debugfs filesystem. An administrative local user could exploit this flaw to cause a denial of service (OOPS). (CVE-2013-6378)

Nico Golde and Fabian Yamaguchi reported a flaw in the driver for Adaptec AACRAID scsi raid devices in the Linux kernel. A local user could use this flaw to cause a denial of service or possibly other unspecified impact. (CVE-2013-6380)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

A race condition flaw was discovered in the Linux kernel's ipc shared memory implementation. A local user could exploit this flaw to cause a denial of service (system crash) or possibly have unspecied other impacts. (CVE-2013-7026).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hannes Frederic Sowa discovered a flaw in the Linux kernel's UDP Fragmentation Offload (UFO). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2013-4470)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for the SystemBase Multi-2/PCI serial card. An unprivileged user could obtain sensitive information from kernel memory.
(CVE-2013-4516)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

Evan Huus reported a buffer overflow in the Linux kernel's radiotap header parsing. A remote attacker could cause a denial of service (buffer over- read) via a specially crafted header. (CVE-2013-7027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dave Jones and Vince Weaver reported a flaw in the Linux kernel's per event subsystem that allows normal users to enable function tracing.
An unprivileged local user could exploit this flaw to obtain potentially sensitive information from the kernel. (CVE-2013-2930)

Stephan Mueller reported an error in the Linux kernel's ansi cprng random number generator. This flaw makes it easier for a local attacker to break cryptographic protections. (CVE-2013-4345)

Multiple integer overflow flaws were discovered in the Alchemy LCD frame- buffer drivers in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges.
(CVE-2013-4511)

Nico Golde and Fabian Yamaguchi reported a buffer overflow in the Ozmo Devices USB over WiFi devices. A local user could exploit this flaw to cause a denial of service or possibly unspecified impact.
(CVE-2013-4513)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Agere Systems HERMES II Wireless PC Cards. A local user with the CAP_NET_ADMIN capability could exploit this flaw to cause a denial of service or possibly gain administrative priviliges.
(CVE-2013-4514)

Nico Golde and Fabian Yamaguchi reported a flaw in the Linux kernel's driver for Beceem WIMAX chipset based devices. An unprivileged local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2013-4515)

A flaw was discovered in the Linux kernel's compat ioctls for Adaptec AACRAID scsi raid devices. An unprivileged local user could send administrative commands to these devices potentially compromising the data stored on the device. (CVE-2013-6383)

Nico Golde reported a flaw in the Linux kernel's userspace IO (uio) driver. A local user could exploit this flaw to cause a denial of service (memory corruption) or possibly gain privileges.
(CVE-2013-6763)

Evan Huus reported a buffer overflow in the Linux kernel's radiotap header parsing. A remote attacker could cause a denial of service (buffer over- read) via a specially crafted header. (CVE-2013-7027).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125301	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1508)	Nessus	Huawei Local Security Checks	critical
75251	openSUSE Security Update : kernel (openSUSE-SU-2014:0204-1)	Nessus	SuSE Local Security Checks	high
71799	Ubuntu 13.10 : linux vulnerabilities (USN-2075-1)	Nessus	Ubuntu Local Security Checks	high
71798	Ubuntu 13.04 : linux vulnerabilities (USN-2073-1)	Nessus	Ubuntu Local Security Checks	medium
71797	Ubuntu 12.10 : linux vulnerabilities (USN-2071-1)	Nessus	Ubuntu Local Security Checks	medium
71796	Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2070-1)	Nessus	Ubuntu Local Security Checks	high
71795	Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2069-1)	Nessus	Ubuntu Local Security Checks	medium
71794	Ubuntu 12.04 LTS : linux-lts-quantal vulnerabilities (USN-2068-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-4513

high

Tenable Plugins

critical

high

high

medium

medium

high

medium

medium