The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4855 advisory.

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0. (CVE-2017-14991)

  - In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params     division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry     with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should     be called. It can be triggered by an unprivileged local user even when a floppy disk has not been     inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14284)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local     users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a     write-what-where condition that occurs after a race condition and a NULL pointer dereference.
    (CVE-2017-15102)

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an     out of bounds write in the function i2c_smbus_xfer_emulated. (CVE-2017-18551)

  - An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket     option, an attacker can control a pointer in kernel land and cause an inet_csk_listen_stop general     protection fault, or potentially execute arbitrary code under certain circumstances. The issue can be     triggered as root (e.g., inside a default LXC container or with the CAP_NET_ADMIN capability) or after     namespace unsharing. This occurs because sk_type and protocol are not checked in the appropriate part of     the ip6_mroute_* functions. NOTE: this affects Linux distributions that use 4.9.x longterm kernels before     4.9.187. (CVE-2017-18509)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4854 advisory.

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0. (CVE-2017-14991)

  - In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params     division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry     with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should     be called. It can be triggered by an unprivileged local user even when a floppy disk has not been     inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14284)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local     users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a     write-what-where condition that occurs after a race condition and a NULL pointer dereference.
    (CVE-2017-15102)

  - An issue was discovered in drivers/i2c/i2c-core-smbus.c in the Linux kernel before 4.14.15. There is an     out of bounds write in the function i2c_smbus_xfer_emulated. (CVE-2017-18551)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The hi3660_stub_clk_probe function in     drivers/clk/hisilicon/clk-hi3660-stub.c in the Linux     kernel before 4.16 allows local users to cause a denial     of service (NULL pointer dereference) by triggering a     failure of resource retrieval.(CVE-2018-10074i1/4%0

  - An information leak flaw was found in the RAM Disks     Memory Copy (rd_mcp) backend driver of the iSCSI Target     subsystem of the Linux kernel. A privileged user could     use this flaw to leak the contents of kernel memory to     an iSCSI initiator remote client.(CVE-2014-4027i1/4%0

  - It was found that in the Linux kernel version 4.2-rc1     to 4.3-rc1, a use of uninitialized 'n_proto',     'ip_proto', and 'thoff' variables in
    __skb_flow_dissect() function can lead to a remote     denial-of-service via malformed MPLS     packet.(CVE-2017-13715i1/4%0

  - It was found that the packet_set_ring() function of the     Linux kernel's networking implementation did not     properly validate certain block-size data. A local     attacker with CAP_NET_RAW capability could use this     flaw to trigger a buffer overflow, resulting in the     crash of the system. Due to the nature of the flaw,     privilege escalation cannot be fully ruled     out.(CVE-2017-7308i1/4%0

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited.(CVE-2016-3672i1/4%0

  - sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c in the     MSM QDSP6 audio driver for the Linux kernel 3.x, as     used in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service     (out-of-bounds write and memory corruption) or possibly     have unspecified other impact via a crafted application     that makes an ioctl call triggering incorrect use of a     parameters pointer.(CVE-2016-2065i1/4%0

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation.
    A local attacker could use this flaw to cause a denial     of service (out-of-bounds access or system crash) by     changing a certain size value.(CVE-2016-6480i1/4%0

  - The omninet_open function in     drivers/usb/serial/omninet.c in the Linux kernel before     4.10.4 allows local users to cause a denial of service     (tty exhaustion) by leveraging reference count     mishandling.(CVE-2017-8925i1/4%0

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102i1/4%0

  - The rtnl_fill_link_ifmap function in     net/core/rtnetlink.c in the Linux kernel before 4.5.5     does not initialize a certain data structure, which     allows local users to obtain sensitive information from     kernel stack memory by reading a Netlink     message.(CVE-2016-4486i1/4%0

  - A vulnerability was found in the Linux kernel's     lp_setup() function where it doesn't apply any bounds     checking when passing 'lp=none'. This can result into     overflow of the parport_nr array. An attacker with     control over kernel command line can overwrite kernel     code and data with fixed (0xff)     values.(CVE-2017-1000363i1/4%0

  - sound/core/hrtimer.c in the Linux kernel before 4.4.1     does not prevent recursive callback access, which     allows local users to cause a denial of service     (deadlock) via a crafted ioctl call.(CVE-2016-2549i1/4%0

  - The pn_recvmsg function in net/phonet/datagram.c in the     Linux kernel before 3.12.4 updates a certain length     value before ensuring that an associated data structure     has been initialized, which allows local users to     obtain sensitive information from kernel stack memory     via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system     call.(CVE-2013-7265i1/4%0

  - A NULL pointer dereference flaw was found in the SCTP     implementation. A local user could use this flaw to     cause a denial of service on the system by triggering a     kernel panic when creating multiple sockets in parallel     while the system did not have the SCTP module     loaded.(CVE-2015-5283i1/4%0

  - It was found that in Linux kernel the mount table     expands by a power-of-two with each bind mount command.
    If a system is configured to allow non-privileged user     to do bind mounts, or allows to do so in a container or     unprivileged mount namespace, then non-privileged user     is able to cause a local DoS by overflowing the mount     table, which causes a deadlock for the whole     system.(CVE-2016-6213i1/4%0

  - The cifs_iovec_write function in fs/cifs/file.c in the     Linux kernel through 3.13.5 does not properly handle     uncached write operations that copy fewer than the     requested number of bytes, which allows local users to     obtain sensitive information from kernel memory, cause     a denial of service (memory corruption and system     crash), or possibly gain privileges via a writev system     call with a crafted pointer.(CVE-2014-0069i1/4%0

  - A flaw was found in the Linux kernel's implementation     of XFS file attributes. Two memory leaks were detected     in xfs_attr_shortform_list and xfs_attr3_leaf_list_int     when running a docker container backed by xfs/overlay2.
    A dedicated attacker could possible exhaust all memory     and create a denial of service     situation.(CVE-2016-9685i1/4%0

  - Multiple integer overflows in the MDSS driver for the     Linux kernel 3.x, as used in Qualcomm Innovation Center     (QuIC) Android contributions for MSM devices and other     products, allow attackers to cause a denial of service     or possibly have unspecified other impact via a large     size value, related to mdss_compat_utils.c, mdss_fb.c,     and mdss_rotator.c.(CVE-2016-5344i1/4%0

  - kernel/bpf/verifier.c in the Linux kernel through     4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior,     also considered an improper branch-pruning logic issue,     could possibly be used by local users for denial of     service.(CVE-2017-17862i1/4%0

  - A flaw was found in the Linux kernel's implementation     of the SCTP protocol. A remote attacker could trigger     an out-of-bounds read with an offset of up to 64kB     potentially causing the system to     crash.(CVE-2016-9555i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that in the Linux kernel through     v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in     'block/bio.c' do unbalanced pages refcounting if IO     vector has small consecutive buffers belonging to the     same page. bio_add_pc_page() merges them into one, but     the page reference is never dropped, causing a memory     leak and possible system lockup due to out-of-memory     condition.(CVE-2017-12190)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on a negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - A flaw was found in the Linux kernel's implementation     of associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null     pointer dereference in assoc_array_apply_edit() due to     incorrect node-splitting in assoc_array implementation.
    This affects the keyring key type and thus key addition     and link creation operations may cause the kernel to     panic.(CVE-2017-12193)

  - A divide-by-zero vulnerability was found in the
    __tcp_select_window function in the Linux kernel. This     can result in a kernel panic causing a local denial of     service.(CVE-2017-14106)

  - The move_pages system call in mm/migrate.c in the Linux     kernel doesn't check the effective uid of the target     process. This enables a local attacker to learn the     memory layout of a setuid executable allowing     mitigation of ASLR.(CVE-2017-14140)

  - The iscsi_if_rx() function in     'drivers/scsi/scsi_transport_iscsi.c' in the Linux     kernel from v2.6.24-rc1 through 4.13.2 allows local     users to cause a denial of service (a system panic) by     making a number of certain syscalls by leveraging     incorrect length validation in the kernel     code.(CVE-2017-14489)

  - The sg_ioctl() function in 'drivers/scsi/sg.c' in the     Linux kernel, from version 4.12-rc1 to 4.14-rc2, allows     local users to obtain sensitive information from     uninitialized kernel heap-memory locations via an     SG_GET_REQUEST_TABLE ioctl call for     '/dev/sg0'.(CVE-2017-14991)

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102)

  - A vulnerability was found in the Linux kernel when     peeling off an association to the socket in another     network namespace. All transports in this association     are not to be rehashed and keep using the old key in     hashtable, thus removing transports from hashtable when     closing the socket, all transports are being freed.
    Later on a use-after-free issue could be caused when     looking up an association and dereferencing the     transports.(CVE-2017-15115)

  - A use-after-free vulnerability was found in a network     namespaces code affecting the Linux kernel since     v4.0-rc1 through v4.15-rc5. The function     get_net_ns_by_id() does not check for the net::count     value after it has found a peer network in netns_ids     idr which could lead to double free and memory     corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)

  - A use-after-free vulnerability was found when issuing     an ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption     or possibly privilege escalation.(CVE-2017-15265)

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel     oops).(CVE-2017-15274)

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

  - The drivers/uwb/uwbd.c in the Linux kernel, before     4.13.6, allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - The sound/usb/mixer.c in the Linux kernel, before     4.13.8, allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16527)

  - The sound/core/seq_device.c in the Linux kernel, before     4.13.4, allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16528)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel, before 4.13.6, allows local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash), or possibly have unspecified     other impacts via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The function drivers/usb/core/config.c in the Linux     kernel, allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory.

  - A elevation of privilege vulnerability in the Upstream Linux file system. Product: Android. Versions:
    Android kernel. Android ID: A-36817013. (CVE-2017-0750)

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the     Linux kernel through 4.13.3. This function does not check whether the required attributes are present in a     Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in     a NULL pointer dereference and system crash. (CVE-2017-12153)

  - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page.
    The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a     memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk     is passed through to a virtual machine) due to an out-of-memory condition. (CVE-2017-12190)

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

  - An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in     the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and     system crash) by leveraging root access. (CVE-2017-14051)

  - The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective     uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable     despite ASLR. (CVE-2017-14140)

  - The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does     not initialize a certain data structure, which allows local users to obtain sensitive information from     kernel stack memory by reading locations associated with padding bytes. (CVE-2017-14156)

  - The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows     local users to cause a denial of service (panic) by leveraging incorrect length validation.
    (CVE-2017-14489)

  - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local     users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a     write-what-where condition that occurs after a race condition and a NULL pointer dereference.
    (CVE-2017-15102)

  - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether     the intended netns is used in a peel-off action, which allows local users to cause a denial of service     (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15115)

  - security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in     conjunction with a nonzero length value, which allows local users to cause a denial of service (NULL     pointer dereference and OOPS) via a crafted add_key or keyctl system call, a different vulnerability than     CVE-2017-12192. (CVE-2017-15274)

  - The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not     ensure that an l2cap socket is available, which allows local users to gain privileges via a crafted     application. (CVE-2017-15868)

  - The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device, related to disconnection and failed setup.
    (CVE-2017-16525)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x     before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption)     or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
    (CVE-2017-18017)

  - The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address     calculated by a certain rounding operation, which allows local users to map page zero, and consequently     bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat     system calls in a privileged context. (CVE-2017-5669)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel through 4.12.3 allows local     users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open     a raw socket. (CVE-2017-7542)

  - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file,     related to arch/x86/mm/init.c and drivers/char/mem.c. (CVE-2017-7889)

  - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to     gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during     the DCCP_LISTEN state. (CVE-2017-8824)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     attacker controllable speculative execution over code     patterns in the Linux Kernel to leak content from     otherwise not readable memory in the same address space,     allowing retrieval of passwords, cryptographic keys and     other secrets. This problem is mitigated by adding     speculative fencing on affected code paths throughout     the Linux kernel.

  - CVE-2017-5715: Local attackers on systems with modern     CPUs featuring branch prediction could use mispredicted     branches to speculatively execute code patterns that in     turn could be made to leak other non-readable content in     the same address space, an attack similar to     CVE-2017-5753. This problem is mitigated by disabling     predictive branches, depending on CPU architecture     either by firmware updates and/or fixes in the     user-kernel privilege boundaries. Please contact your     CPU / hardware vendor for potential microcode or BIOS     updates needed for this fix. As this feature can have a     performance impact, it can be disabled using the     'nospec' kernel commandline option.

  - CVE-2017-5754: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     code patterns in userspace to speculative executive code     that would read otherwise read protected memory, an     attack similar to CVE-2017-5753. This problem is     mitigated by unmapping the Linux Kernel from the user     address space during user code execution, following a     approach called 'KAISER'. The terms used here are     'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page     Table Isolation'. This feature is disabled on unaffected     architectures. This feature can be enabled / disabled by     the 'pti=[on|off|auto]' or 'nopti' commandline options.
    The following security bugs were fixed :

  - CVE-2017-1000251: The native Bluetooth stack in the     Linux Kernel (BlueZ) was vulnerable to a stack overflow     vulnerability in the processing of L2CAP configuration     responses resulting in Remote code execution in kernel     space (bnc#1057389).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer was fixed. (bnc#1072876).

  - CVE-2017-14106: The tcp_disconnect function in     net/ipv4/tcp.c in the Linux kernel allowed local users     to cause a denial of service (__tcp_select_window     divide-by-zero error and system crash) by triggering a     disconnect within a certain tcp_recvmsg code path     (bnc#1056982).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel didn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in     fs/xfs/xfs_linux.h in the Linux kernel did not verify     that a filesystem has a realtime device, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory (bnc#1058524).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695     1074033).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17805: The Salsa20 encryption algorithm in the     Linux kernel did not correctly handle zero-length     inputs, allowing a local attacker able to use the     AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792).

  - CVE-2017-17806: The HMAC implementation (crypto/hmac.c)     in the Linux kernel did not validate that the underlying     cryptographic hash algorithm is unkeyed, allowing a     local attacker able to use the AF_ALG-based hash     interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3     hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874).

  - CVE-2017-7472: The KEYS subsystem in the Linux kernel     allowed local users to cause a denial of service (memory     consumption) via a series of     KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring     calls (bnc#1034862).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102)

  - The sctp_do_peeloff function in net/sctp/socket.c in     the Linux kernel before 4.14 does not check whether the     intended netns is used in a peel-off action, which     allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system     calls.(CVE-2017-15115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-14489: The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     allowed local users to cause a denial of service (panic)     by leveraging incorrect length validation (bnc#1059051).

  - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in     fs/xfs/xfs_linux.h in the Linux kernel did not verify     that a filesystem has a realtime device, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory (bnc#1058524).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel doesn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-10661: Race condition in fs/timerfd.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel queueing     (bnc#1053152).

  - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A     user-controlled buffer is copied into a local buffer of     constant size using strcpy without a length check which     can cause a buffer overflow. (bnc#1053148).

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability (bnc#1037994).

  - CVE-2017-1000112: An exploitable memory corruption due     to UFO to non-UFO path switch was fixed. (bnc#1052311     bnc#1052365).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-1000405: The Linux Kernel had a problematic use     of pmd_mkdirty() in the touch_pmd() function inside the     THP implementation. touch_pmd() could be reached by     get_user_pages(). In such case, the pmd would become     dirty. This scenario breaks the new     can_follow_write_pmd()'s logic - pmd could become dirty     without going through a COW cycle. This bug was not as     severe as the original 'Dirty cow' because an ext4 file     (or any other regular file) could not be mapped using     THP. Nevertheless, it did allow us to overwrite     read-only huge pages. For example, the zero huge page     and sealed shmem files could be overwritten (since their     mapping could be populated using THP). Note that after     the first write page-fault to the zero page, it will be     replaced with a new fresh (and zeroed) thp (bnc#1069496     1070307).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c in the Linux kernel, when CONFIG_X86_X32 is     enabled, allowed local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067086).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations     (bnc#1066192).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - The assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel before 4.13.11     mishandles node splitting, which allows local users to     cause a denial of service (NULL pointer dereference and     panic) via a crafted application, as demonstrated by     the keyring key type, and key addition and link     creation operations.(CVE-2017-12193)

  - The bio_map_user_iov and bio_unmap_user functions in     block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small     consecutive buffers belonging to the same page. The     bio_add_pc_page function merges them into one, but the     page reference is never dropped. This causes a memory     leak and possible system lockup (exploitable against     the host OS by a guest OS user, if a SCSI disk is     passed through to a virtual machine) due to an     out-of-memory condition.(CVE-2017-12190)

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102)

  - The sctp_do_peeloff function in net/sctp/socket.c in     the Linux kernel before 4.14 does not check whether the     intended netns is used in a peel-off action, which     allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system     calls.(CVE-2017-15115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages. (bnc#1069702)

  - CVE-2017-1000405: mm, thp: do not dirty huge pages on     read fault (bnc#1069496).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067085)

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c, when CONFIG_X86_X32 is enabled, allowed     local users to gain privileges via a recvmmsg system     call with a crafted timeout pointer parameter     (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067086)

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1066700)

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference.
    (bnc#1066705)

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor.
    (bnc#1066671)

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations.
    (bnc#1066192)

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device. (bnc#1066650)

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup. (bnc#1066618)

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device.
    (bnc#1066573)

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device.
    (bnc#1066606)

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device. (bnc#1066625)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
131209	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2019-4855)	Nessus	Oracle Linux Local Security Checks	high
131175	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4854)	Nessus	Oracle Linux Local Security Checks	medium
124837	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1516)	Nessus	Huawei Local Security Checks	critical
124822	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1499)	Nessus	Huawei Local Security Checks	high
107003	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)	Nessus	Ubuntu Local Security Checks	critical
105685	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0040-1) (BlueBorne) (KRACK) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	high
105323	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1342)	Nessus	Huawei Local Security Checks	high
105172	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:3265-1) (KRACK)	Nessus	SuSE Local Security Checks	critical
105150	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3249-1) (Dirty COW)	Nessus	SuSE Local Security Checks	high
105046	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)	Nessus	Huawei Local Security Checks	high
105020	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3210-1) (Dirty COW)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-15102

medium

Tenable Plugins

high

medium

critical

high

critical

high

high

critical

high

high

high