The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The NFSv2 and NFSv3 server implementations in the Linux     kernel through 4.10.13 lacked certain checks for the     end of a buffer. A remote attacker could trigger a     pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to     fs/nfsd/nfs3xdr.c and     fs/nfsd/nfsxdr.c.(CVE-2017-7895i1/4%0

  - A flaw was found in the Linux kernel's ACPI subsystem     where a function does not flush the operand cache and     causes a kernel stack dump. This allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism when using a     specially crafted ACPI table.(CVE-2017-13695i1/4%0

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649i1/4%0

  - Race condition in kernel/ucount.c in the Linux kernel     through 4.10.2 allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via crafted system calls     that leverage certain decrement behavior that causes     incorrect interaction between put_ucounts and     get_ucounts.(CVE-2017-6874i1/4%0

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825i1/4%0

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805i1/4%0

  - The msm_ipc_router_bind_control_port function in     net/ipc_router/ipc_router_core.c in the IPC router     kernel module for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, does not verify     that a port is a client port, which allows attackers to     gain privileges or cause a denial of service (race     condition and list corruption) by making many     BIND_CONTROL_PORT ioctl calls.(CVE-2016-2059i1/4%0

  - The do_remount function in fs/namespace.c in the Linux     kernel through 3.16.1 does not maintain the     MNT_LOCK_READONLY bit across a remount of a bind mount,     which allows local users to bypass an intended     read-only restriction and defeat certain sandbox     protection mechanisms via a 'mount -o remount' command     within a user namespace.(CVE-2014-5206i1/4%0

  - The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185i1/4%0

  - It was found that the fix for CVE-2014-3601 was     incomplete: the Linux kernel's kvm_iommu_map_pages()     function still handled IOMMU mapping failures     incorrectly. A privileged user in a guest with an     assigned host device could use this flaw to crash the     host.(CVE-2014-8369i1/4%0

  - A NULL pointer dereference was found in     net/rds/rdma.c:__rds_rdma_map() function in the Linux     kernel allowing local attackers to cause a system panic     and a denial-of-service.(CVE-2018-7492i1/4%0

  - An issue was discovered in the XFS filesystem in     fs/xfs/xfs_icache.c in the Linux kernel. There is a     NULL pointer dereference leading to a system panic in     lookup_slow() on a NULL inode-i1/4zi_ops pointer when     doing pathwalks on a corrupted xfs image. This occurs     because of a lack of proper validation that cached     inodes are free during an allocation.(CVE-2018-13093i1/4%0

  - The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2188i1/4%0

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local     Area Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path, as an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack     corruption in the kernel.(CVE-2016-7039i1/4%0

  - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in     the Linux kernel before 4.6.1 supports MSR 0x2f8, which     allows guest OS users to read or write to the     kvm_arch_vcpu data structure, and consequently obtain     sensitive information or cause a denial of service     (system crash), via a crafted ioctl     call.(CVE-2016-3713i1/4%0

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045i1/4%0

  - The KEYS subsystem in the Linux kernel before 4.13.10     does not correctly synchronize the actions of updating     versus finding a key in the 'negative' state to avoid a     race condition, which allows local users to cause a     denial of service or possibly have unspecified other     impact via crafted system calls.(CVE-2017-15951i1/4%0

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348i1/4%0

  - The Linux kernel through 3.17.4 does not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allows local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c.(CVE-2014-8989i1/4%0

  - An infinite-loop flaw was found in the kernel. When a     local user calls the sys_writev syscall with a     specially crafted sequence of iov structs, the     fuse_fill_write_pages kernel function might never     terminate, instead continuing in a tight loop. This     process cannot be terminated and requires a     reboot.(CVE-2015-8785i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.120 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the v4l2 video driver. (bnc#1072865).

  - CVE-2017-15951: The KEYS subsystem did not correctly     synchronize the actions of updating versus finding a key     in the 'negative' state to avoid a race condition, which     allowed local users to cause a denial of service or     possibly have unspecified other impact via crafted     system calls (bnc#1062840 bnc#1065615).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

  - CVE-2017-17975: Use-after-free in the usbtv_probe     function in drivers/media/usb/usbtv/usbtv-core.c allowed     attackers to cause a denial of service (system crash) or     possibly have unspecified other impact by triggering     failure of audio registration, because a kfree of the     usbtv data structure occurs during a usbtv_video_free     call, but the usbtv_video_fail label's code attempts to     both access and free this data structure (bnc#1074426).

  - CVE-2017-18174: The amd_gpio_remove function in     drivers/pinctrl/pinctrl-amd.c calls the     pinctrl_unregister function, leading to a double free     (bnc#1080533).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2018-1000026: A insufficient input validation     vulnerability in bnx2x network card driver could result     in DoS: Network card firmware assertion takes card     off-line. This attack appear to be exploitable via An     attacker on a must pass a very large, specially crafted     packet to the bnx2x card. This can be done from an     untrusted guest VM. (bnc#1079384).

  - CVE-2018-8087: Memory leak in the hwsim_new_radio_nl     function in drivers/net/wireless/mac80211_hwsim.c     allowed local users to cause a denial of service (memory     consumption) by triggering an out-of-array error case     (bnc#1085053).

  - CVE-2018-1068: Insufficient user provided offset     checking in the ebtables compat code allowed local     attackers to overwrite kernel memory and potentially     execute code. (bsc#1085107)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.120 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the v4l2 video driver was fixed. (bnc#1072865).

  - CVE-2017-15951: The KEYS subsystem did not correctly     synchronize the actions of updating versus finding a key     in the 'negative' state to avoid a race condition, which     allowed local users to cause a denial of service or     possibly have unspecified other impact via crafted     system calls (bnc#1062840 bnc#1065615).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

  - CVE-2017-17975: Use-after-free in the usbtv_probe     function in drivers/media/usb/usbtv/usbtv-core.c allowed     attackers to cause a denial of service (system crash) or     possibly have unspecified other impact by triggering     failure of audio registration, because a kfree of the     usbtv data structure occurs during a usbtv_video_free     call, but the usbtv_video_fail label's code attempts to     both access and free this data structure (bnc#1074426).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2018-8087: Memory leak in the hwsim_new_radio_nl     function in drivers/net/wireless/mac80211_hwsim.c     allowed local users to cause a denial of service (memory     consumption) by triggering an out-of-array error case     (bnc#1085053).

  - CVE-2018-1000026: A insufficient input validation     vulnerability in the bnx2x network card driver could     result in DoS: Network card firmware assertion takes     card off-line. This attack appear to be exploitable via     An attacker on a must pass a very large, specially     crafted packet to the bnx2x card. This can be done from     an untrusted guest VM. (bnc#1079384).

  - CVE-2018-1068: Insufficient user provided offset     checking in the ebtables compat code allowed local     attackers to overwrite kernel memory and potentially     execute code. (bsc#1085107)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.13.10 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3507-2 advisory.

  - The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd()     function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the     pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty     without going through a COW cycle. This bug is not as severe as the original Dirty cow because an ext4     file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite     read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since     their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it     will be replaced with a new fresh (and zeroed) thp. (CVE-2017-1000405)

  - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11     mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference     and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link     creation operations. (CVE-2017-12193)

  - The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already     exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted system call.
    (CVE-2017-15299)

  - The kvm_vm_ioctl_check_extension function in arch/powerpc/kvm/powerpc.c in the Linux kernel before 4.13.11     allows local users to cause a denial of service (NULL pointer dereference and system crash) via a     KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to /dev/kvm. (CVE-2017-15306)

  - The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of     updating versus finding a key in the negative state to avoid a race condition, which allows local users     to cause a denial of service or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15951)

  - The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel before 4.13.11 allows     local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF     setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. (CVE-2017-16939)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939)

It was discovered that the Linux kernel did not properly handle copy-on- write of transparent huge pages. A local attacker could use this to cause a denial of service (application crashes) or possibly gain administrative privileges. (CVE-2017-1000405)

Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-12193)

Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-15299)

It was discovered that a NULL pointer dereference error existed in the PowerPC KVM implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-15306)

Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys in a negative state. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15951)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16535)

Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16643).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-3 advisory.

  - Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a     denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq     ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. (CVE-2017-15265)

  - The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already     exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted system call.
    (CVE-2017-15299)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of     updating versus finding a key in the negative state to avoid a race condition, which allows local users     to cause a denial of service or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15951)

  - The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device, related to disconnection and failed setup.
    (CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-     bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related     to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c. (CVE-2017-16530)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16534)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-2 advisory.

  - Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a     denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq     ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. (CVE-2017-15265)

  - The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already     exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted system call.
    (CVE-2017-15299)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of     updating versus finding a key in the negative state to avoid a race condition, which allows local users     to cause a denial of service or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15951)

  - The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device, related to disconnection and failed setup.
    (CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-     bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related     to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c. (CVE-2017-16530)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16534)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-1 advisory.

  - Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a     denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq     ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c. (CVE-2017-15265)

  - The KEYS subsystem in the Linux kernel through 4.13.7 mishandles use of add_key for a key that already     exists but is uninstantiated, which allows local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have unspecified other impact via a crafted system call.
    (CVE-2017-15299)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of     updating versus finding a key in the negative state to avoid a race condition, which allows local users     to cause a denial of service or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15951)

  - The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device, related to disconnection and failed setup.
    (CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-     bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related     to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c. (CVE-2017-16530)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The cdc_parse_cdc_header function in drivers/usb/core/message.c in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16534)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Incorrect updates of uninstantiated keys crash the kernel

A vulnerability was found in the key management subsystem of the Linux kernel. An update on an uninstantiated key could cause a kernel panic, leading to denial of service (DoS). (CVE-2017-15299)

Memory leak when merging buffers in SCSI IO vectors

It was found that in the Linux kernel through v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in 'block/bio.c' do unbalanced pages refcounting if IO vector has small consecutive buffers belonging to the same page. bio_add_pc_page() merges them into one, but the page reference is never dropped, causing a memory leak and possible system lockup due to out-of-memory condition. (CVE-2017-12190)

NULL pointer dereference due to incorrect node-splitting in assoc_array implementation

A flaw was found in the Linux kernel's implementation of associative arrays introduced in 3.13. This functionality was backported to the 3.10 kernels in Red Hat Enterprise Linux 7. The flaw involved a NULL pointer dereference in assoc_array_apply_edit() due to incorrect node-splitting in assoc_array implementation. This affects the keyring key type and thus key addition and link creation operations may cause the kernel to panic. (CVE-2017-12193)

Arbitrary stack overwrite causing oops via crafted signal frame

A flaw was found in the Linux kernel's handling of signal frame on PowerPC systems. A malicious local user process could craft a signal frame allowing an attacker to corrupt memory. (CVE-2017-1000255)

Race condition in the KEYS subsystem

The KEYS subsystem in the Linux kernel before 4.13.10 does not correctly synchronize the actions of updating versus finding a key in the 'negative' state to avoid a race condition, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls. (CVE-2017-15951)

The 4.13.10 update contains a number of important fixes across the tree.

----

The 4.13.9 update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
124974	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1521)	Nessus	Huawei Local Security Checks	critical
121754	Photon OS 2.0: Linux PHSA-2017-0043	Nessus	PhotonOS Local Security Checks	high
121752	Photon OS 1.0: Linux PHSA-2017-0042	Nessus	PhotonOS Local Security Checks	high
108649	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0786-1)	Nessus	SuSE Local Security Checks	critical
108648	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0785-1)	Nessus	SuSE Local Security Checks	high
108577	openSUSE Security Update : the Linux Kernel (openSUSE-2018-292)	Nessus	SuSE Local Security Checks	critical
105993	Fedora 27 : kernel (2017-ea254105cc)	Nessus	Fedora Local Security Checks	high
105101	Ubuntu 16.04 LTS : Linux kernel (GCP) vulnerabilities (USN-3507-2)	Nessus	Ubuntu Local Security Checks	high
105100	Ubuntu 17.10 : linux, linux-raspi2 vulnerabilities (USN-3507-1) (Dirty COW)	Nessus	Ubuntu Local Security Checks	high
104735	Ubuntu 14.04 LTS : Linux kernel (AWS) vulnerabilities (USN-3485-3)	Nessus	Ubuntu Local Security Checks	high
104717	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3485-2)	Nessus	Ubuntu Local Security Checks	high
104716	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3485-1)	Nessus	Ubuntu Local Security Checks	high
104707	Amazon Linux AMI : kernel (ALAS-2017-925)	Nessus	Amazon Linux Local Security Checks	high
104407	Fedora 25 : kernel (2017-ebab38baf6)	Nessus	Fedora Local Security Checks	high
104404	Fedora 26 : kernel (2017-10faeda281)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-15951

high

Tenable Plugins

critical

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high