drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOC_DQBUF ioctl call.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The hid_input_field() function in     'drivers/hid/hid-core.c' in the Linux kernel before 4.6     allows physically proximate attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read) by connecting a     device.(CVE-2016-7915i1/4%0

  - The Linux kernel, before version 4.14.2, is vulnerable     to a deadlock caused by     fs/ocfs2/file.c:ocfs2_setattr(), as the function does     not wait for DIO requests before locking the inode.
    This can be exploited by local users to cause a     subsequent denial of service.(CVE-2017-18204i1/4%0

  - The vmw_gb_surface_define_ioctl function (accessible     via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel through 4.11.4 defines a backup_handle variable     but does not give it an initial value. If one attempts     to create a GB surface, with a previously allocated DMA     buffer to be used as a backup buffer, the backup_handle     variable does not get written to and is then later     returned to user space, allowing local users to obtain     sensitive information from uninitialized kernel memory     via a crafted ioctl call.(CVE-2017-9605i1/4%0

  - Use-after-free vulnerability in the nfqnl_zcopy     function in net/netfilter/nfnetlink_queue_core.c in the     Linux kernel through 3.13.6 allows attackers to obtain     sensitive information from kernel memory by leveraging     the absence of a certain orphaning operation. NOTE: the     affected code was moved to the skb_zerocopy function in     net/core/skbuff.c before the vulnerability was     announced.(CVE-2014-2568i1/4%0

  - It was found that the Linux kernel's ISO file system     implementation did not correctly limit the traversal of     Rock Ridge extension Continuation Entries (CE). An     attacker with physical access to the system could use     this flaw to trigger an infinite loop in the kernel,     resulting in a denial of service.(CVE-2014-9420i1/4%0

  - An integer overflow vulnerability was found in the     ring_buffer_resize() calculations in which a privileged     user can adjust the size of the ringbuffer message     size. These calculations can create an issue where the     kernel memory allocator will not allocate the correct     count of pages yet expect them to be usable. This can     lead to the ftrace() output to appear to corrupt kernel     memory and possibly be used for privileged escalation     or more likely kernel panic.(CVE-2016-9754i1/4%0

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9730i1/4%0

  - In was found that in the Linux kernel, in     vmw_surface_define_ioctl() function in     'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file, a     'num_sizes' parameter is assigned a user-controlled     value which is not checked if it is zero. This is used     in a call to kmalloc() and later leads to dereferencing     ZERO_SIZE_PTR, which in turn leads to a GPF and     possibly to a kernel panic.(CVE-2017-7261i1/4%0

  - A race condition flaw was found in the way the Linux     kernel keys management subsystem performed key garbage     collection. A local attacker could attempt accessing a     key while it was being garbage collected, which would     cause the system to crash.(CVE-2014-9529i1/4%0

  - A flaw was found in the Linux kernel's implementation     of i8042 serial ports. An attacker could cause a kernel     panic if they are able to add and remove devices as the     module is loaded.(CVE-2017-18079i1/4%0

  - drivers/hid/hid-pl.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2892i1/4%0

  - The __clear_user function in     arch/arm64/lib/clear_user.S in the Linux kernel before     3.17.4 on the ARM64 platform allows local users to     cause a denial of service (system crash) by reading one     byte beyond a /dev/zero page boundary.(CVE-2014-7843i1/4%0

  - A divide-by-zero vulnerability was found in a way the     kernel processes TCP connections. The error can occur     if a connection starts another cwnd reduction phase by     setting tp-i1/4zprior_cwnd to the current cwnd (0) in     tcp_init_cwnd_reduction(). A remote, unauthenticated     attacker could use this flaw to crash the kernel     (denial of service).(CVE-2016-2070i1/4%0

  - The adjust_branches function in kernel/bpf/verifier.c     in the Linux kernel before 4.5 does not consider the     delta in the backward-jump case, which allows local     users to obtain sensitive information from kernel     memory by creating a packet filter and then loading     crafted BPF instructions.(CVE-2016-2383i1/4%0

  - System using the infiniband support module ib_srpt were     vulnerable to a denial of service by system crash by a     local attacker who is able to abort writes to a device     using this initiator.(CVE-2016-6327i1/4%0

  - A security flaw was found in the Linux kernel in the     mark_source_chains() function in     'net/ipv4/netfilter/ip_tables.c'. It is possible for a     user-supplied 'ipt_entry' structure to have a large     'next_offset' field. This field is not bounds checked     prior to writing to a counter value at the supplied     offset.(CVE-2016-3134i1/4%0

  - An out-of-bounds access issue was discovered in     yurex_read() in drivers/usb/misc/yurex.c in the Linux     kernel. A local attacker could use user access     read/writes with incorrect bounds checking in the yurex     USB driver to crash the kernel or potentially escalate     privileges.(CVE-2018-16276i1/4%0

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux     kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or     possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl     call.(CVE-2016-4568i1/4%0

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525i1/4%0

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-4 advisory.

  - The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local     users to obtain sensitive information from kernel memory by reading a tty data structure. (CVE-2015-8964)

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl call. (CVE-2016-4568)

  - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount     namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via     MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of     mounts. (CVE-2016-6213)

  - The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr     call, which allows local users to gain group privileges by leveraging the existence of a setgid program     with restrictions on execute permissions. (CVE-2016-7097)

  - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2     does not restrict a certain length field, which allows local users to gain privileges or cause a denial of     service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. (CVE-2016-7425)

  - The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is     enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction. (CVE-2016-8630)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local     users to cause a denial of service (system crash) or possibly have unspecified other impact via a long     SSID Information Element in a command to a Netlink socket. (CVE-2016-8658)

  - The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length     checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds     slab access) or possibly have unspecified other impact via crafted SCTP data. (CVE-2016-9555)

  - The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28     contains extended asm statements that are incompatible with the exception table, which allows local users     to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists     because of incorrect backporting of the CVE-2016-9178 patch to older kernels. (CVE-2016-9644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-3 advisory.

  - The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local     users to obtain sensitive information from kernel memory by reading a tty data structure. (CVE-2015-8964)

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl call. (CVE-2016-4568)

  - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount     namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via     MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of     mounts. (CVE-2016-6213)

  - The proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU     Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout     data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading     the /proc/keys file. (CVE-2016-7042)

  - The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr     call, which allows local users to gain group privileges by leveraging the existence of a setgid program     with restrictions on execute permissions. (CVE-2016-7097)

  - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2     does not restrict a certain length field, which allows local users to gain privileges or cause a denial of     service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. (CVE-2016-7425)

  - The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is     enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction. (CVE-2016-8630)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in     drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel before 4.7.5 allows local     users to cause a denial of service (system crash) or possibly have unspecified other impact via a long     SSID Information Element in a command to a Netlink socket. (CVE-2016-8658)

  - The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not     initialize a certain integer variable, which allows local users to obtain sensitive information from     kernel stack memory by triggering failure of a get_user_ex call. (CVE-2016-9178)

  - The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length     checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds     slab access) or possibly have unspecified other impact via crafted SCTP data. (CVE-2016-9555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-2 advisory.

  - The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local     users to obtain sensitive information from kernel memory by reading a tty data structure. (CVE-2015-8964)

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl call. (CVE-2016-4568)

  - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount     namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via     MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of     mounts. (CVE-2016-6213)

  - The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is     enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction. (CVE-2016-8630)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length     checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds     slab access) or possibly have unspecified other impact via crafted SCTP data. (CVE-2016-9555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3161-1 advisory.

  - The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c in the Linux kernel before 4.5 allows local     users to obtain sensitive information from kernel memory by reading a tty data structure. (CVE-2015-8964)

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl call. (CVE-2016-4568)

  - fs/namespace.c in the Linux kernel before 4.9 does not restrict how many mounts may exist in a mount     namespace, which allows local users to cause a denial of service (memory consumption and deadlock) via     MS_BIND mount system calls, as demonstrated by a loop that triggers exponential growth in the number of     mounts. (CVE-2016-6213)

  - The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is     enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M     byte in an undefined instruction. (CVE-2016-8630)

  - drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations,     allows remote attackers to execute arbitrary code via crafted fragmented packets. (CVE-2016-8633)

  - The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to     cause a denial of service (system crash) via a crafted application that makes sendto system calls, related     to net/ipv4/tcp_ipv4.c and net/ipv6/tcp_ipv6.c. (CVE-2016-8645)

  - The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linux kernel before 4.8.8 lacks chunk-length     checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds     slab access) or possibly have unspecified other impact via crafted SCTP data. (CVE-2016-9555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
124796	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1472)	Nessus	Huawei Local Security Checks	high
95998	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3161-4)	Nessus	Ubuntu Local Security Checks	critical
95997	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3161-3)	Nessus	Ubuntu Local Security Checks	critical
95996	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3161-2)	Nessus	Ubuntu Local Security Checks	critical
95995	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3161-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2016-4568

high

Tenable Plugins

high

critical

critical

critical

critical