Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a "double fetch" vulnerability.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow flaw was found in the way the Linux     kernel's netfilter connection tracking implementation     loaded extensions. An attacker on a local network could     potentially send a sequence of specially crafted     packets that would initiate the loading of a large     number of extensions, causing the targeted system in     that network to crash.(CVE-2014-9715i1/4%0

  - A flaw was found in the Linux kernel which could cause     a kernel panic when restoring machine specific     registers on the PowerPC platform. Incorrect     transactional memory state registers could     inadvertently change the call path on return from     userspace and cause the kernel to enter an unknown     state and crash.(CVE-2015-8844i1/4%0

  - A timing flaw was found in the Chrome EC driver in the     Linux kernel. An attacker could abuse timing to skip     validation checks to copy additional data from     userspace possibly increasing privilege or crashing the     system.(CVE-2016-6156i1/4%0

  - A race condition flaw was found in the way the Linux     kernel's IPC subsystem initialized certain fields in an     IPC object structure that were later used for     permission checking before inserting the object into a     globally visible list. A local, unprivileged user could     potentially use this flaw to elevate their privileges     on the system.(CVE-2015-7613i1/4%0

  - A path length checking flaw was found in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support. An     attacker able to mount a corrupted/malicious UDF file     system image could use this flaw to leak kernel memory     to user-space.(CVE-2014-9731i1/4%0

  - A race condition leading to a NULL pointer dereference     was found in the Linux kernel's Link Layer Control     implementation. A local attacker with access to ping     sockets could use this flaw to crash the     system.(CVE-2017-2671i1/4%0

  - The f2fs implementation in the Linux kernel, before     4.14, mishandles reference counts associated with     f2fs_wait_discard_bios calls. This allows local users     to cause a denial of service (BUG), as demonstrated by     fstrim.(CVE-2017-18200i1/4%0

  - The LIST_POISON feature in include/linux/poison.h in     the Linux kernel before 4.3, as used in Android 6.0.1     before 2016-03-01, does not properly consider the     relationship to the mmap_min_addr value, which makes it     easier for attackers to bypass a poison-pointer     protection mechanism by triggering the use of an     uninitialized list entry, aka Android internal bug     26186802, a different vulnerability than     CVE-2015-3636.(CVE-2016-0821i1/4%0

  - The xsave/xrstor implementation in     arch/x86/include/asm/xsave.h in the Linux kernel before     3.19.2 creates certain .altinstr_replacement pointers     and consequently does not provide any protection     against instruction faulting, which allows local users     to cause a denial of service (panic) by triggering a     fault, as demonstrated by an unaligned memory operand     or a non-canonical address memory     operand.(CVE-2015-2672i1/4%0

  - The n_tty_write function in drivers/tty/n_tty.c in the     Linux kernel through 3.14.3 does not properly manage     tty driver access in the 'LECHO i1/4+ !OPOST' case, which     allows local users to cause a denial of service (memory     corruption and system crash) or gain privileges by     triggering a race condition involving read and write     operations with long strings.(CVE-2014-0196i1/4%0

  - In the Linux kernel through 4.14.13,     drivers/block/loop.c mishandles lo_release     serialization, which allows attackers to cause a denial     of service (__lock_acquire use-after-free) or possibly     have unspecified other impact.(CVE-2018-5344i1/4%0

  - The lbs_debugfs_write function in     drivers/net/wireless/libertas/debugfs.c in the Linux     kernel through 3.12.1 allows local users to cause a     denial of service (OOPS) by leveraging root privileges     for a zero-length write operation.(CVE-2013-6378i1/4%0

  - A NULL-pointer dereference vulnerability was discovered     in the Linux kernel. The kernel's Reliable Datagram     Sockets (RDS) protocol implementation did not verify     that an underlying transport existed before creating a     connection to a remote server. A local system user     could exploit this flaw to crash the system by creating     sockets at specific times to trigger a NULL pointer     dereference.(CVE-2015-6937i1/4%0

  - A stack buffer overflow flaw was found in the way the     Bluetooth subsystem of the Linux kernel processed     pending L2CAP configuration responses from a client. On     systems with the stack protection feature enabled in     the kernel (CONFIG_CC_STACKPROTECTOR=y, which is     enabled on all architectures other than s390x and     ppc64le), an unauthenticated attacker able to initiate     a connection to a system via Bluetooth could use this     flaw to crash the system. Due to the nature of the     stack protection feature, code execution cannot be     fully ruled out, although we believe it is unlikely. On     systems without the stack protection feature (ppc64le     the Bluetooth modules are not built on s390x), an     unauthenticated attacker able to initiate a connection     to a system via Bluetooth could use this flaw to     remotely execute arbitrary code on the system with ring     0 (kernel) privileges.(CVE-2017-1000251i1/4%0

  - Integer signedness error in the MSM QDSP6 audio driver     for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to gain     privileges or cause a denial of service (memory     corruption) via a crafted application that makes an     ioctl call.(CVE-2016-2066i1/4%0

  - The bcm_char_ioctl function in     drivers/staging/bcm/Bcmchar.c in the Linux kernel     before 3.12 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel memory via an     IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl     call.(CVE-2013-4515i1/4%0

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled malformed Address Configuration Change Chunks     (ASCONF). A remote attacker could use either of these     flaws to crash the system.(CVE-2014-3673i1/4%0

  - It was found that paravirt_patch_call/jump() functions     in the arch/x86/kernel/paravirt.c in the Linux kernel     mishandles certain indirect calls, which makes it     easier for attackers to conduct Spectre-v2 attacks     against paravirtualized guests.(CVE-2018-15594i1/4%0

  - It was found that the Linux kernel's KVM implementation     did not ensure that the host CR4 control register value     remained unchanged across VM entries on the same     virtual CPU. A local, unprivileged user could use this     flaw to cause a denial of service on the     system.(CVE-2014-3690i1/4%0

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in     jbd2_journal_dirty_metadata(), a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10883i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3084-4 advisory.

  - arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when     CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended transaction. (CVE-2016-5412)

  - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through     4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by     changing a certain string, aka a double fetch vulnerability. (CVE-2016-6136)

  - Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux     kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing     a certain size value, aka a double fetch vulnerability. (CVE-2016-6156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3084-3 advisory.

  - arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when     CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended transaction. (CVE-2016-5412)

  - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through     4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by     changing a certain string, aka a double fetch vulnerability. (CVE-2016-6136)

  - Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux     kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing     a certain size value, aka a double fetch vulnerability. (CVE-2016-6156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3084-2 advisory.

  - arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when     CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended transaction. (CVE-2016-5412)

  - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through     4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by     changing a certain string, aka a double fetch vulnerability. (CVE-2016-6136)

  - Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux     kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing     a certain size value, aka a double fetch vulnerability. (CVE-2016-6156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3084-1 advisory.

  - arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when     CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite     loop) by making a H_CEDE hypercall during the existence of a suspended transaction. (CVE-2016-5412)

  - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through     4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by     changing a certain string, aka a double fetch vulnerability. (CVE-2016-6136)

  - Race condition in the ec_device_ioctl_xcmd function in drivers/platform/chrome/cros_ec_dev.c in the Linux     kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing     a certain size value, aka a double fetch vulnerability. (CVE-2016-6156)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to latest upstream stable release, Linux v4.6.4

For those with Skylake CPUs, please note that there may be instability with a recent microcode update. Read https://www.happyassassin.net/2016/07/07/psa-failure-to-boot-after-ker nel-update-on-skylake-systems/ and look for a system firmware update before installing the kernel.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124986	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1533)	Nessus	Huawei Local Security Checks	high
93607	Ubuntu 16.04 LTS : Linux kernel (Qualcomm Snapdragon) vulnerabilities (USN-3084-4)	Nessus	Ubuntu Local Security Checks	medium
93606	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2) vulnerabilities (USN-3084-3)	Nessus	Ubuntu Local Security Checks	medium
93605	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3084-2)	Nessus	Ubuntu Local Security Checks	medium
93604	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3084-1)	Nessus	Ubuntu Local Security Checks	medium
92446	Fedora 24 : kernel (2016-9a16b2e14e)	Nessus	Fedora Local Security Checks	high
92444	Fedora 23 : kernel (2016-784d5526d8)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-6156

medium

Tenable Plugins

high

medium

medium

medium

medium

high

medium