The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265)

  - The mISDN_sock_recvmsg function in     drivers/isdn/mISDN/socket.c in the Linux kernel before     3.12.4 does not ensure that a certain length value is     consistent with the size of an associated data     structure, which allows local users to obtain sensitive     information from kernel memory via a (1) recvfrom, (2)     recvmmsg, or (3) recvmsg system call.(CVE-2013-7266)

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267)

  - The ipx_recvmsg function in net/ipx/af_ipx.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7268)

  - The nr_recvmsg function in net/netrom/af_netrom.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7269)

  - The packet_recvmsg function in net/packet/af_packet.c     in the Linux kernel before 3.12.4 updates a certain     length value before ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7270)

  - The x25_recvmsg function in net/x25/af_x25.c in the     Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7271)

  - The dgram_recvmsg function in net/ieee802154/dgram.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel stack     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7281)

  - A NULL pointer dereference flaw was found in the     rds_ib_laddr_check() function in the Linux kernel's     implementation of Reliable Datagram Sockets (RDS). A     local, unprivileged user could use this flaw to crash     the system.(CVE-2013-7339)

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2013-7421)

  - A flaw was found in the Linux kernel's implementation     of Unix sockets. A server polling for client-socket     data could put the peer socket on a wait list the peer     socket could then close the connection, making the     reference on the wait list no longer valid. This could     lead to bypassing the permissions on a Unix socket and     packets being injected into the stream, and could also     panic the machine (denial of service).(CVE-2013-7446)

  - The compat_sys_recvmmsg function in net/compat.c in the     Linux kernel before 3.13.2, when CONFIG_X86_X32 is     enabled, allows local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter.(CVE-2014-0038)

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049)

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069)

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077)

  - Race condition in the inet_frag_intern function in     net/ipv4/inet_fragment.c in the Linux kernel through     3.13.6 allows remote attackers to cause a denial of     service (use-after-free error) or possibly have     unspecified other impact via a large series of     fragmented ICMP Echo Request packets to a system with a     heavy CPU load.(CVE-2014-0100)

  - A flaw was found in the way the Linux kernel processed     an authenticated COOKIE_ECHO chunk during the     initialization of an SCTP connection. A remote attacker     could use this flaw to crash the system by initiating a     specially crafted SCTP handshake in order to trigger a     NULL pointer dereference on the system.(CVE-2014-0101)

  - The keyring_detect_cycle_iterator function in     security/keys/keyring.c in the Linux kernel through     3.13.6 does not properly determine whether keyrings are     identical, which allows local users to cause a denial     of service (OOPS) via crafted keyctl     commands.(CVE-2014-0102)

  - Use-after-free vulnerability in the skb_segment     function in net/core/skbuff.c in the Linux kernel     through 3.13.6 allows attackers to obtain sensitive     information from kernel memory by leveraging the     absence of a certain orphaning     operation.(CVE-2014-0131)

  - The ioapic_deliver function in virt/kvm/ioapic.c in the     Linux kernel through 3.14.1 does not properly validate     the kvm_irq_delivery_to_apic return value, which allows     guest OS users to cause a denial of service (host OS     crash) via a crafted entry in the redirection table of     an I/O APIC. NOTE: the affected code was moved to the     ioapic_service function before the vulnerability was     announced.(CVE-2014-0155)

  - It was found that the permission checks performed by     the Linux kernel when a netlink message was received     were not sufficient. A local, unprivileged user could     potentially bypass these restrictions by passing a     netlink socket as stdout or stderr to a more privileged     process and altering the output of this     process.(CVE-2014-0181)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/hid/hid-zpff.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_ZEROPLUS is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2889i1/4%0

  - The capabilities implementation in the Linux kernel     before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows     local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by     setting the setgid bit on a file with group ownership     of root.(CVE-2014-4014i1/4%0

  - The function drivers/usb/core/config.c in the Linux     kernel, allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531i1/4%0

  - The snd_timer_interrupt function in sound/core/timer.c     in the Linux kernel before 4.4.1 does not properly     maintain a certain linked list, which allows local     users to cause a denial of service (race condition and     system crash) via a crafted ioctl     call.(CVE-2016-2545i1/4%0

  - A flaw was found in the Linux kernel where the deletion     of a file or directory could trigger an unmount and     reveal data under a mount point. This flaw was     inadvertently introduced with the new feature of being     able to lazily unmount a mount tree when using file     system user namespaces.(CVE-2015-4176i1/4%0

  - The do_shmat function in ipc/shm.c in the Linux kernel,     through 4.9.12, does not restrict the address     calculated by a certain rounding operation. This allows     privileged local users to map page zero and,     consequently, bypass a protection mechanism that exists     for the mmap system call. This is possible by making     crafted shmget and shmat system calls in a privileged     context.(CVE-2017-5669i1/4%0

  - In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the     Linux kernel, before 4.13, local users can cause a     denial of service (use-after-free and BUG) or possibly     have unspecified other impact by leveraging differences     in skb handling between hns_nic_net_xmit_hw and     hns_nic_net_xmit.(CVE-2017-18218i1/4%0

  - The ioapic_deliver function in virt/kvm/ioapic.c in the     Linux kernel through 3.14.1 does not properly validate     the kvm_irq_delivery_to_apic return value, which allows     guest OS users to cause a denial of service (host OS     crash) via a crafted entry in the redirection table of     an I/O APIC. NOTE: the affected code was moved to the     ioapic_service function before the vulnerability was     announced.(CVE-2014-0155i1/4%0

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2013-7421i1/4%0

  - Off-by-one error in the get_prng_bytes function in     crypto/ansi_cprng.c in the Linux kernel through 3.11.4     makes it easier for context-dependent attackers to     defeat cryptographic protection mechanisms via multiple     requests for small amounts of data, leading to improper     management of the state of the consumed     data.(CVE-2013-4345i1/4%0

  - sound/core/timer.c in the Linux kernel before 4.4.1     uses an incorrect type of mutex, which allows local     users to cause a denial of service (race condition,     use-after-free, and system crash) via a crafted ioctl     call.(CVE-2016-2546i1/4%0

  - The do_get_mempolicy function in mm/mempolicy.c in the     Linux kernel before 4.12.9 allows local users to cause     a denial of service (use-after-free) or possibly have     unspecified other impact via crafted system     calls.(CVE-2018-10675i1/4%0

  - A certain backport in the TCP Fast Open implementation     for the Linux kernel before 3.18 does not properly     maintain a count value, which allow local users to     cause a denial of service (system crash) via the Fast     Open feature, as demonstrated by visiting the     chrome://flags/#enable-tcp-fast-open URL when using     certain 3.10.x through 3.16.x kernel builds, including     longterm-maintenance releases and ckt (aka Canonical     Kernel Team) builds.(CVE-2015-3332i1/4%0

  - It was found that the try_to_unmap_cluster() function     in the Linux kernel's Memory Managment subsystem did     not properly handle page locking in certain cases,     which could potentially trigger the BUG_ON() macro in     the mlock_vma_page() function. A local, unprivileged     user could use this flaw to crash the     system.(CVE-2014-3122i1/4%0

  - The blkcg_init_queue function in block/blk-cgroup.c in     the Linux kernel, before 4.11, allows local users to     cause a denial of service (double free) or possibly     have unspecified other impact by triggering a creation     failure.(CVE-2018-7480i1/4%0

  - The create_fixed_stream_quirk function in     sound/usb/quirks.c in the snd-usb-audio driver in the     Linux kernel before 4.5.1 allows physically proximate     attackers to cause a denial of service (NULL pointer     dereference or double free, and system crash) via a     crafted endpoints value in a USB device     descriptor.(CVE-2016-2184i1/4%0

  - The etm_setup_aux function in     drivers/hwtracing/coresight/coresight-etm-perf.c in the     Linux kernel before 4.10.2 allows attackers to cause a     denial of service (panic) because a parameter is     incorrectly used as a local variable.(CVE-2018-11232i1/4%0

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service.(CVE-2017-18360i1/4%0

  - A flaw was found where the XFS filesystem code     mishandles a user-settable inode flag in the Linux     kernel prior to 4.14-rc1. This can cause a local denial     of service via a kernel panic.(CVE-2017-14340i1/4%0

  - An issue was discovered in the Linux kernel through     4.19. An information leak in cdrom_ioctl_select_disc in     drivers/cdrom/cdrom.c could be used by local attackers     to read kernel memory because a cast from unsigned long     to int interferes with bounds     checking.(CVE-2018-18710i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2337-1 advisory.

  - The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly     validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of     service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected     code was moved to the ioapic_service function before the vulnerability was announced. (CVE-2014-0155)

  - The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing     socket operations based on the opener of a socket, which allows local users to bypass intended access     restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr     of a setuid program. (CVE-2014-0181)

  - Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1     allows local users to obtain sensitive information from kernel memory via a large head value.
    (CVE-2014-0206)

  - The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that     namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by     first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership     of root. (CVE-2014-4014)

  - The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does     not properly initialize a certain data structure, which allows local users to obtain sensitive information     from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

  - mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range     notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by     using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity     by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.
    (CVE-2014-4171)

  - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall     auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000. (CVE-2014-4508)

  - Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in     sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local     users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
    (CVE-2014-4652)

  - sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure     possession of a read/write lock, which allows local users to cause a denial of service (use-after-free)     and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
    (CVE-2014-4653)

  - The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux     kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows     local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by     leveraging /dev/snd/controlCX access for an ioctl call. (CVE-2014-4654)

  - The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux     kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to     cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for     a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls. (CVE-2014-4655)

  - Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel     before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access,     related to (1) index values in the snd_ctl_add function and (2) numid values in the     snd_ctl_remove_numid_conflict function. (CVE-2014-4656)

  - The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not     properly manage a certain backlog value, which allows remote attackers to cause a denial of service     (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

  - The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a     certain reference count during attempts to use the umount system call in conjunction with a symlink, which     allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have     unspecified other impact via the umount program. (CVE-2014-5045)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq). A guest OS user could exploit this flaw to cause a denial of service (host OS crash).
(CVE-2014-0155)

Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions by having a privileged executable do something it was not intended to do. (CVE-2014-0181)

An information leak was discovered in the Linux kernels aio_read_events_ring function. A local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-0206)

A flaw was discovered in the Linux kernel's implementation of user namespaces with respect to inode permissions. A local user could exploit this flaw by creating a user namespace to gain administrative privileges. (CVE-2014-4014)

An information leak was discovered in the rd_mcp backend of the iSCSI target subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator. (CVE-2014-4027)

Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. A local user could exploit this flaw to cause a denial of service.
(CVE-2014-4171)

Toralf Forster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash). (CVE-2014-4508)

An information leak was discovered in the control implemenation of the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A local user could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-4652)

A use-after-free flaw was discovered in the Advanced Linux Sound Architecture (ALSA) control implementation of the Linux kernel. A local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-4653)

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls). (CVE-2014-4654)

A flaw discovered in how the snd_ctl_elem function of the Advanced Linux Sound Architecture (ALSA) handled a reference count. A local user could exploit this flaw to cause a denial of service (integer overflow and limit bypass). (CVE-2014-4655)

An integer overflow flaw was discovered in the control implementation of the Advanced Linux Sound Architecture (ALSA). A local user could exploit this flaw to cause a denial of service (system crash).
(CVE-2014-4656)

An integer underflow flaw was discovered in the Linux kernel's handling of the backlog value for certain SCTP packets. A remote attacker could exploit this flaw to cause a denial of service (socket outage) via a crafted SCTP packet. (CVE-2014-4667)

Vasily Averin discover a reference count flaw during attempts to umount in conjunction with a symlink. A local user could exploit this flaw to cause a denial of service (memory consumption or use after free) or possibly have other unspecified impact. (CVE-2014-5045).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges.
(CVE-2014-3153)

A flaw was discovered in the Linux kernel virtual machine's (kvm) validation of interrupt requests (irq). A guest OS user could exploit this flaw to cause a denial of service (host OS crash).
(CVE-2014-0155)

An information leak was discovered in the netfilter subsystem of the Linux kernel. An attacker could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-2568)

Sasha Levin reported a bug in the Linux kernel's virtual memory management subsystem. An unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-3122).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 3.13.11 stable kernel update contains a number of important fixes across the tree. The 3.13.10 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 3.13.10 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	high
124801	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1477)	Nessus	Huawei Local Security Checks	medium
124795	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1471)	Nessus	Huawei Local Security Checks	high
77492	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2337-1)	Nessus	Ubuntu Local Security Checks	high
77491	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2336-1)	Nessus	Ubuntu Local Security Checks	medium
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	critical
74361	Ubuntu 13.10 : linux vulnerabilities (USN-2241-1)	Nessus	Ubuntu Local Security Checks	high
74359	Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2239-1)	Nessus	Ubuntu Local Security Checks	high
73872	Fedora 19 : kernel-3.13.11-100.fc19 (2014-5609)	Nessus	Fedora Local Security Checks	medium
73628	Fedora 20 : kernel-3.13.10-200.fc20 (2014-5235)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-0155

medium

Tenable Plugins

high

medium

high

high

medium

critical

high

high

medium

medium