The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4904-1 advisory.

  - The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr     operations that underspecifies removing extended privilege attributes, which allows local users to cause a     denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by     using chown to remove a capability from the ping or Wireshark dumpcap program. (CVE-2015-1350)

  - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (improper error handling and system crash) or possibly     have unspecified other impact via a crafted USB device. (CVE-2017-16644)

  - The time subsystem in the Linux kernel through 4.9.9, when CONFIG_TIMER_STATS is enabled, allows local     users to discover real PID values (as distinguished from PID values inside a PID namespace) by reading the     /proc/timer_list file, related to the print_timer function in kernel/time/timer_list.c and the
    __timer_stats_timer_set_start_info function in kernel/time/timer.c. (CVE-2017-5967)

  - An issue was discovered in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.17.3. A denial of     service (memory corruption and BUG) can occur for a corrupted xfs image upon encountering an inode that is     in extent format, but has more extents than fit in the inode fork. (CVE-2018-13095)

  - drivers/net/fjes/fjes_main.c in the Linux kernel 5.2.14 does not check the alloc_workqueue return value,     leading to a NULL pointer dereference. (CVE-2019-16231)

  - drivers/net/wireless/marvell/libertas/if_sdio.c in the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer dereference. (CVE-2019-16232)

  - A memory leak in the adis_update_scan_mode_burst() function in drivers/iio/imu/adis_buffer.c in the Linux     kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption), aka     CID-9c0530e898f3. (CVE-2019-19061)

  - A race condition was found in the Linux kernels implementation of the floppy disk drive controller driver     software. The impact of this issue is lessened by the fact that the default permissions on the floppy     device (/dev/fd0) are restricted to root. If the permissions on the device have changed the impact changes     greatly. In the default configuration root (or equivalent) permissions are required to attack this flaw.
    (CVE-2021-20261)

  - An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to     the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be     encountered. In one case, an error encountered earlier might be discarded by later processing, resulting     in the caller assuming successful mapping, and hence subsequent operations trying to access space that     wasn't mapped. In another case, internal state would be insufficiently updated, preventing safe recovery     from the error. This affects drivers/block/xen-blkback/blkback.c. (CVE-2021-26930)

  - An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI     backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially     being at least under the influence of guests (such as out of memory conditions), it isn't correct to     assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running     in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c.
    (CVE-2021-26931)

  - An issue was discovered in the Linux kernel through 5.11.3, as used with Xen PV. A certain part of the     netback driver lacks necessary treatment of errors such as failed memory allocations (as a result of     changes to the handling of grant mapping errors). A host OS denial of service may occur during misbehavior     of a networking frontend driver. NOTE: this issue exists because of an incomplete fix for CVE-2021-26931.
    (CVE-2021-28038)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2020-0044 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - can: peak_usb: pcan_usb_fd: Fix info-leaks to USB     devices (Tomas Bortoli) [Orabug: 31351221]     (CVE-2019-19535)

  - media: hdpvr: Fix an error handling path in hdpvr_probe     (Arvind Yadav) [Orabug: 31352053] (CVE-2017-16644)

  - fs/binfmt_misc.c: do not allow offset overflow (Thadeu     Lima de Souza Cascardo) [Orabug: 31588258] - clear inode     and truncate pages before enqueuing for async     inactivation (Gautham Ananthakrishna) [Orabug: 31744270]

  - mm: create alloc_last_chance debugfs entries (Mike     Kravetz) [Orabug: 31295499] - mm: perform 'last chance'     reclaim efforts before allocation failure (Mike Kravetz)     [Orabug: 31295499] - mm: let page allocation slowpath     retry 'order' times (Mike Kravetz) [Orabug: 31295499] -     fix kABI breakage from 'netns: provide pure entropy for     net_hash_mix' (Dan Duval) [Orabug: 31351904]     (CVE-2019-10638) (CVE-2019-10639)

  - netns: provide pure entropy for net_hash_mix (Eric     Dumazet) [Orabug: 31351904] (CVE-2019-10638)     (CVE-2019-10639)

  - hrtimer: Annotate lockless access to timer->base (Eric     Dumazet) [Orabug: 31380495] - rds: ib: Revert 'net/rds:
    Avoid stalled connection due to CM REQ retries'     (H&aring kon Bugge) [Orabug: 31648141] - rds: Clear     reconnect pending bit (H&aring kon Bugge) [Orabug:
    31648141] - RDMA/netlink: Do not always generate an ACK     for some netlink operations (H&aring kon Bugge) [Orabug:
    31666975] - genirq/proc: Return proper error code when     irq_set_affinity fails (Wen Yaxng) [Orabug: 31723450]

  - fs/binfmt_elf.c: allocate initialized memory in     fill_thread_core_info (Alexander Potapenko) [Orabug:
    31350639] (CVE-2020-10732)

  - crypto: user - fix memory leak in crypto_report (Navid     Emamdoost) [Orabug: 31351640] (CVE-2019-19062)

  - of: unittest: fix memory leak in unittest_data_add     (Navid Emamdoost) [Orabug: 31351702] (CVE-2019-19049)

  - IB/sa: Resolv use-after-free in ib_nl_make_request     (Divya Indi) [Orabug: 31656992] - net-sysfs: call     dev_hold if kobject_init_and_add success (YueHaibing)     [Orabug: 31687545] (CVE-2019-20811)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5837 advisory.

  - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel     image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the     attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic     is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a network namespace. (CVE-2019-10639)

  - A memory leak in the crypto_report() function in crypto/crypto_user_base.c in the Linux kernel through     5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     crypto_report_alg() failures, aka CID-ffdde5932042. (CVE-2019-19062)

  - A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an     attacker with a local account to crash a trivial program and exfiltrate private kernel data.
    (CVE-2020-10732)

  - ** DISPUTED ** A memory leak in the unittest_data_add() function in drivers/of/unittest.c in the Linux     kernel before 5.3.10 allows attackers to cause a denial of service (memory consumption) by triggering     of_fdt_unflatten_tree() failures, aka CID-e13de8fe0d6a. NOTE: third parties dispute the relevance of this     because unittest.c can only be reached during boot. (CVE-2019-19049)

  - An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and     netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
    (CVE-2019-20811)

  - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (improper error handling and system crash) or possibly     have unspecified other impact via a crafted USB device. (CVE-2017-16644)

  - In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device     in the drivers/net/can/usb/peak_usb/pcan_usb_fd.c driver, aka CID-30a8beeb3042. (CVE-2019-19535)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The snd_msndmidi_input_read function in     sound/isa/msnd/msnd_midi.c in the Linux kernel through     4.11.7 allows local users to cause a denial of service     (over-boundary access) or possibly have unspecified     other impact by changing the value of a message queue     head pointer between two kernel reads of that value,     aka a 'double fetch' vulnerability.(CVE-2017-9985i1/4%0

  - An assertion failure issue was found in the Linux     kernel's KVM hypervisor module built to support     visualization on ARM64 architecture platforms. The     failure could occur while accessing Performance     Monitors Cycle Count Register (PMCCNTR) from a guest. A     privileged guest user could use this flaw to crash the     host kernel resulting in denial of     service.(CVE-2017-12168i1/4%0

  - The iscsi_if_rx() function in     'drivers/scsi/scsi_transport_iscsi.c' in the Linux     kernel from v2.6.24-rc1 through 4.13.2 allows local     users to cause a denial of service (a system panic) by     making a number of certain syscalls by leveraging     incorrect length validation in the kernel     code.(CVE-2017-14489i1/4%0

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644i1/4%0

  - The dvb frontend management subsystem in the Linux     kernel contains a use-after-free which can allow a     malicious user to write to memory that may be assigned     to another kernel structure. This could create memory     corruption, panic, or possibly other side     affects.(CVE-2017-16648i1/4%0

  - It was found that the Linux kernel's IPv6     implementation mishandled socket options. A local     attacker could abuse concurrent access to the socket     options to escalate their privileges, or cause a denial     of service (use-after-free and system crash) via a     crafted sendmsg system call.(CVE-2016-3841i1/4%0

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879i1/4%0

  - A race condition was found in the Linux kernel, present     since v3.14-rc1 through v4.12. The race happens between     threads of inotify_handle_event() and vfs_rename()     while running the rename operation against the same     file. As a result of the race the next slab data or the     slab's free list pointer can be corrupted with     attacker-controlled data, which may lead to the     privilege escalation.(CVE-2017-7533i1/4%0

  - A privilege-escalation vulnerability was discovered in     the Linux kernel built with User Namespace     (CONFIG_USER_NS) support. The flaw occurred when the     ptrace() system call was used on a root-owned process     to enter a user namespace. A privileged namespace user     could exploit this flaw to potentially escalate their     privileges on the system, outside the original     namespace.(CVE-2015-8709i1/4%0

  - Use-after-free vulnerability in     drivers/net/ppp/ppp_generic.c in the Linux kernel     before 4.5.2 allows local users to cause a denial of     service (memory corruption and system crash, or     spinlock) or possibly have unspecified other impact by     removing a network namespace, related to the     ppp_register_net_channel and ppp_unregister_channel     functions.(CVE-2016-4805i1/4%0

  - A flaw was found in the way the Linux kernel's     kvm_iommu_map_pages() function handled IOMMU mapping     failures. A privileged user in a guest with an assigned     host device could use this flaw to crash the     host.(CVE-2014-3601i1/4%0

  - A flaw was found in the Linux kernel's implementation     of associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null     pointer dereference in assoc_array_apply_edit() due to     incorrect node-splitting in assoc_array implementation.
    This affects the keyring key type and thus key addition     and link creation operations may cause the kernel to     panic.(CVE-2017-12193i1/4%0

  - Multiple race conditions in drivers/char/adsprpc.c and     drivers/char/adsprpc_compat.c in the ADSPRPC driver for     the Linux kernel 3.x, as used in Qualcomm Innovation     Center (QuIC) Android contributions for MSM devices and     other products, allow attackers to cause a denial of     service (zero-value write) or possibly have unspecified     other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl     call.(CVE-2015-0572i1/4%0

  - The sanity_check_ckpt function in fs/f2fs/super.c in     the Linux kernel before version 4.12.4 does not     validate the blkoff and segno arrays. This allows an     unprivileged, local user to cause a system panic and     DoS. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-10663i1/4%0

  - A stack overflow flaw caused by infinite recursion was     found in the way the Linux kernel's Universal Disk     Format (UDF) file system implementation processed     indirect Information Control Blocks (ICBs). An attacker     with physical access to the system could use a     specially crafted UDF image to crash the     system.(CVE-2014-6410i1/4%0

  - Race condition in the ion_ioctl function in     drivers/staging/android/ion/ion.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) by calling     ION_IOC_FREE on two CPUs at the same     time.(CVE-2016-9120i1/4%0

  - drivers/hid/hid-picolcd_core.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_PICOLCD is enabled, allows     physically proximate attackers to cause a denial of     service (NULL pointer dereference and OOPS) via a     crafted device.(CVE-2013-2899i1/4%0

  - A flaw was found in the Linux kernel's implementation     of overlayfs. An attacker can leak file resources in     the system by opening a large file with write     permissions on a overlay filesystem that is     insufficient to deal with the size of the write.When     unmounting the underlying device, the system is unable     to free an inode and this will consume resources.
    Repeating this for all available inodes and memory will     create a denial of service situation.(CVE-2015-8953i1/4%0

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473i1/4%0

  - Use-after-free vulnerability in the     kvm_ioctl_create_device function in virt/kvm/kvm_main.c     in the Linux kernel before 4.8.13 allows host OS users     to cause a denial of service (host OS crash) or     possibly gain privileges via crafted ioctl calls on the     /dev/kvm device.(CVE-2016-10150i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The cdc_parse_cdc_header() function in     'drivers/usb/core/message.c' in the Linux kernel,     before 4.13.6, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-16534)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel can allow     a local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel, through 4.13.11, allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel,     through 4.13.11, allows local users to cause a denial     of service (ims_pcu_parse_cdc_data out-of-bounds read     and system crash) or possibly have unspecified other     impact via a crafted USB device.(CVE-2017-16645)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system.(CVE-2017-16939)

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net     namespaces.(CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel, through     4.14.4, does not restrict observations of Netlink     messages to a single net namespace, when CONFIG_NLMON     is enabled. This allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system.(CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through     4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations. This     allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all network     namespaces.(CVE-2017-17450)

  - The usb_destroy_configuration() function, in     'drivers/usb/core/config.c' in the USB core subsystem,     in the Linux kernel through 4.14.5 does not consider     the maximum number of configurations and interfaces     before attempting to release resources. This allows     local users to cause a denial of service, due to     out-of-bounds write access, or possibly have     unspecified other impact via a crafted USB device. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is     unlikely.(CVE-2017-17558)

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on     it.(CVE-2017-17807)

  - A flaw was found in the Linux kernel's implementation     of i8042 serial ports. An attacker could cause a kernel     panic if they are able to add and remove devices as the     module is loaded.(CVE-2017-18079)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with     CAP_SYS_ADMIN capability) can directly perform the     ioctl operations for dm device creation and removal and     this would typically be outside the direct control of     the unprivileged attacker.(CVE-2017-18203)

  - The madvise_willneed function in the Linux kernel     allows local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping.(CVE-2017-18208)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly     validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-     of-bounds read and system crash) via a crafted ext4 image. (CVE-2016-10208)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. (CVE-2017-11473)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0. (CVE-2017-14991)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system crash) or possibly have unspecified other impact     via a crafted USB device, related to a missing warm-start check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). (CVE-2017-16538)

  - The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11     allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16643)

  - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (improper error handling and system crash) or possibly     have unspecified other impact via a crafted USB device. (CVE-2017-16644)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an incorrect sample-rate calculation. (CVE-2017-18255)

  - In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands,     setting unwanted defaults or causing a denial of service. (CVE-2017-18270)

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of service (use-after-free) via a crafted application     that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. (CVE-2017-2584)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5     places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which     allows local users to obtain sensitive information by reading the log. (CVE-2017-5549)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds     access. (CVE-2017-5897)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages     lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on     IrDA devices. (CVE-2017-6348)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers     to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

  - The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5     allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified     other impact by changing a certain sequence-number value, aka a double fetch vulnerability.
    (CVE-2017-8831)

  - The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9984)

  - The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9985)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to     cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system     calls. (CVE-2018-10675)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a     root directory with a zero i_links_count, which allows attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. (CVE-2018-1092)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows     local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out     kernel memory. (CVE-2018-10940)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1087: And an unprivileged KVM guest user could     use this flaw to potentially escalate their privileges     inside a guest. (bsc#1087088)

  - CVE-2018-8897: An unprivileged system user could use     incorrect set up interrupt stacks to crash the Linux     kernel resulting in DoS issue. (bsc#1087088)

  - CVE-2018-10124: The kill_something_info function in     kernel/signal.c might allow local users to cause a     denial of service via an INT_MIN argument (bnc#1089752).

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might allow local users to cause a denial     of service by triggering an attempted use of the
    -INT_MIN value (bnc#1089608).

  - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c allowed     local users to cause a denial of service (memory     consumption) via many read accesses to files in the     /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file     (bnc#1084536 1087209).

  - CVE-2018-7566: A Buffer Overflow via an     SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to     /dev/snd/seq by a local user was fixed (bnc#1083483).

  - CVE-2017-0861: Use-after-free vulnerability in the     snd_pcm_info function in the ALSA subsystem allowed     attackers to gain privileges via unspecified vectors     (bnc#1088260).

  - CVE-2018-8822: Incorrect buffer length handling in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c     could be exploited by malicious NCPFS servers to crash     the kernel or execute code (bnc#1086162).

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver. (bnc#1072865).

  - CVE-2017-18203: The dm_get_from_kobject function in     drivers/md/dm.c allow local users to cause a denial of     service (BUG) by leveraging a race condition with
    __dm_destroy during creation and removal of DM devices     (bnc#1083242).

  - CVE-2017-16911: The vhci_hcd driver allowed allows local     attackers to disclose kernel memory addresses.
    Successful exploitation requires that a USB device is     attached over IP (bnc#1078674).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function in     kernel/futex.c might allow attackers to cause a denial     of service (integer overflow) or possibly have     unspecified other impact by triggering a negative wake     or requeue value (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     (drivers/usb/usbip/stub_tx.c) allowed attackers to cause     a denial of service (NULL pointer dereference) via a     specially crafted USB over IP packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function in     drivers/hid/hid-core.c allowed physically proximate     attackers to obtain sensitive information from kernel     memory or cause a denial of service (out-of-bounds read)     by connecting a device, as demonstrated by a Logitech DJ     receiver (bnc#1010470).

  - CVE-2015-5156: The virtnet_probe function in     drivers/net/virtio_net.c attempted to support a FRAGLIST     feature without proper memory allocation, which allowed     guest OS users to cause a denial of service (buffer     overflow and memory corruption) via a crafted sequence     of fragmented packets (bnc#940776).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions in block/bio.c did unbalanced refcounting when     a SCSI I/O vector has small consecutive buffers     belonging to the same page. The bio_add_pc_page function     merges them into one, but the page reference is never     dropped. This causes a memory leak and possible system     lockup (exploitable against the host OS by a guest OS     user, if a SCSI disk is passed through to a virtual     machine) due to an out-of-memory condition     (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). Enhancements and bugfixes over     the previous fixes have been added to this kernel.

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might have allowed local users to cause a     denial of service by triggering an attempted use of the
    -INT_MIN value (bnc#1089608).

  - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c allowed     local users to cause a denial of service (memory     consumption) via many read accesses to files in the     /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file     (bnc#1084536).

  - CVE-2018-7566: There was a buffer overflow via an     SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to     /dev/snd/seq by a local user (bnc#1083483).

  - CVE-2017-0861: Use-after-free vulnerability in the     snd_pcm_info function in the ALSA subsystem allowed     attackers to gain privileges via unspecified vectors     (bnc#1088260).

  - CVE-2018-8822: Incorrect buffer length handling in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c     could be exploited by malicious NCPFS servers to crash     the kernel or execute code (bnc#1086162).

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver. (bnc#1072865).

  - CVE-2017-18203: The dm_get_from_kobject function in     drivers/md/dm.c allowed local users to cause a denial of     service (BUG) by leveraging a race condition with
    __dm_destroy during creation and removal of DM devices     (bnc#1083242).

  - CVE-2017-16911: The vhci_hcd driver allowed allows local     attackers to disclose kernel memory addresses.
    Successful exploitation requires that a USB device is     attached over IP (bnc#1078674).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping (bnc#1083494).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function in     kernel/futex.c in the Linux kernel might allow attackers     to cause a denial of service (integer overflow) or     possibly have unspecified other impact by triggering a     negative wake or requeue value (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     (drivers/usb/usbip/stub_tx.c) allowed attackers to cause     a denial of service (NULL pointer dereference) via a     specially crafted USB over IP packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function in     drivers/hid/hid-core.c allowed physically proximate     attackers to obtain sensitive information from kernel     memory or cause a denial of service (out-of-bounds read)     by connecting a device, as demonstrated by a Logitech DJ     receiver (bnc#1010470).

  - CVE-2015-5156: The virtnet_probe function in     drivers/net/virtio_net.c attempted to support a FRAGLIST     feature without proper memory allocation, which allowed     guest OS users to cause a denial of service (buffer     overflow and memory corruption) via a crafted sequence     of fragmented packets (bnc#940776).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions in block/bio.c did unbalanced refcounting when     a SCSI I/O vector has small consecutive buffers     belonging to the same page. The bio_add_pc_page function     merges them into one, but the page reference is never     dropped. This causes a memory leak and possible system     lockup (exploitable against the host OS by a guest OS     user, if a SCSI disk is passed through to a virtual     machine) due to an out-of-memory condition     (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1068: Fixed flaw in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2017-18221: The __munlock_pagevec function allowed     local users to cause a denial of service (NR_MLOCK     accounting corruption) via crafted use of mlockall and     munlockall system calls (bnc#1084323).

  - CVE-2018-1066: Prevent NULL pointer dereference in     fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an     attacker controlling a CIFS server to kernel panic a     client that has this server mounted, because an empty     TargetInfo field in an NTLMSSP setup negotiation     response was mishandled during session recovery     (bnc#1083640).

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the kernel v4l2 video driver     (bnc#1072865).

  - CVE-2017-16911: The vhci_hcd driver allowed local     attackers to disclose kernel memory addresses.
    Successful exploitation required that a USB device was     attached over IP (bnc#1078674).

  - CVE-2017-15299: The KEYS subsystem mishandled use of     add_key for a key that already exists but is     uninstantiated, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted system call (bnc#1063416).

  - CVE-2017-18208: The madvise_willneed function kernel     allowed local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping (bnc#1083494).

  - CVE-2018-7566: The ALSA sequencer core initializes the     event pool on demand by invoking snd_seq_pool_init()     when the first write happens and the pool is empty. A     user could have reset the pool size manually via ioctl     concurrently, which may have lead UAF or out-of-bound     access (bsc#1083483).

  - CVE-2017-18204: The ocfs2_setattr function allowed local     users to cause a denial of service (deadlock) via DIO     requests (bnc#1083244).

  - CVE-2017-16644: The hdpvr_probe function allowed local     users to cause a denial of service (improper error     handling and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function allowed     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact by     triggering a negative wake or requeue value     (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     allowed attackers to cause a denial of service (NULL     pointer dereference) via a specially crafted USB over IP     packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function allowed     physically proximate attackers to obtain sensitive     information from kernel memory or cause a denial of     service (out-of-bounds read) by connecting a device     (bnc#1010470).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions did unbalanced refcounting when a SCSI I/O     vector had small consecutive buffers belonging to the     same page. The bio_add_pc_page function merged them into     one, but the page reference was never dropped. This     caused a memory leak and possible system lockup     (exploitable against the host OS by a guest OS user, if     a SCSI disk is passed through to a virtual machine) due     to an out-of-memory condition (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function allowed     attackers to cause a denial of service (out-of-bounds     read) via a specially crafted USB over IP packet     (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     when handling CMD_SUBMIT packets allowed attackers to     cause a denial of service (arbitrary memory allocation)     via a specially crafted USB over IP packet     (bnc#1078672).

  - CVE-2018-5332: The rds_message_alloc_sgs() function did     not validate a value that is used during DMA page     allocation, leading to a heap-based out-of-bounds write     (related to the rds_rdma_extra_size function in     net/rds/rdma.c) (bnc#1075621).

  - CVE-2018-5333: The rds_cmsg_atomic function in     net/rds/rdma.c mishandled cases where page pinning fails     or an invalid address is supplied, leading to an     rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function     allowed remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1068: Fixed flaw in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2017-18221: The __munlock_pagevec function allowed     local users to cause a denial of service (NR_MLOCK     accounting corruption) via crafted use of mlockall and     munlockall system calls (bnc#1084323).

  - CVE-2018-1066: Prevent NULL pointer dereference in     fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an     attacker controlling a CIFS server to kernel panic a     client that has this server mounted, because an empty     TargetInfo field in an NTLMSSP setup negotiation     response was mishandled during session recovery     (bnc#1083640).

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the kernel v4l2 video driver     (bnc#1072865).

  - CVE-2017-16911: The vhci_hcd driver allowed local     attackers to disclose kernel memory addresses.
    Successful exploitation required that a USB device was     attached over IP (bnc#1078674).

  - CVE-2017-15299: The KEYS subsystem mishandled use of     add_key for a key that already exists but is     uninstantiated, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted system call (bnc#1063416).

  - CVE-2017-18208: The madvise_willneed function kernel     allowed local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping (bnc#1083494).

  - CVE-2018-7566: The ALSA sequencer core initializes the     event pool on demand by invoking snd_seq_pool_init()     when the first write happens and the pool is empty. A     user could have reset the pool size manually via ioctl     concurrently, which may have lead UAF or out-of-bound     access (bsc#1083483).

  - CVE-2017-18204: The ocfs2_setattr function allowed local     users to cause a denial of service (deadlock) via DIO     requests (bnc#1083244).

  - CVE-2017-16644: The hdpvr_probe function allowed local     users to cause a denial of service (improper error     handling and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function allowed     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact by     triggering a negative wake or requeue value     (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     allowed attackers to cause a denial of service (NULL     pointer dereference) via a specially crafted USB over IP     packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function allowed     physically proximate attackers to obtain sensitive     information from kernel memory or cause a denial of     service (out-of-bounds read) by connecting a device     (bnc#1010470).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions did unbalanced refcounting when a SCSI I/O     vector had small consecutive buffers belonging to the     same page. The bio_add_pc_page function merged them into     one, but the page reference was never dropped. This     caused a memory leak and possible system lockup     (exploitable against the host OS by a guest OS user, if     a SCSI disk is passed through to a virtual machine) due     to an out-of-memory condition (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function allowed     attackers to cause a denial of service (out-of-bounds     read) via a specially crafted USB over IP packet     (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     when handling CMD_SUBMIT packets allowed attackers to     cause a denial of service (arbitrary memory allocation)     via a specially crafted USB over IP packet     (bnc#1078672).

  - CVE-2018-5332: The rds_message_alloc_sgs() function did     not validate a value that is used during DMA page     allocation, leading to a heap-based out-of-bounds write     (related to the rds_rdma_extra_size function in     net/rds/rdma.c) (bnc#1075621).

  - CVE-2018-5333: The rds_cmsg_atomic function in     net/rds/rdma.c mishandled cases where page pinning fails     or an invalid address is supplied, leading to an     rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function     allowed remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.120 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the v4l2 video driver. (bnc#1072865).

  - CVE-2017-15951: The KEYS subsystem did not correctly     synchronize the actions of updating versus finding a key     in the 'negative' state to avoid a race condition, which     allowed local users to cause a denial of service or     possibly have unspecified other impact via crafted     system calls (bnc#1062840 bnc#1065615).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

  - CVE-2017-17975: Use-after-free in the usbtv_probe     function in drivers/media/usb/usbtv/usbtv-core.c allowed     attackers to cause a denial of service (system crash) or     possibly have unspecified other impact by triggering     failure of audio registration, because a kfree of the     usbtv data structure occurs during a usbtv_video_free     call, but the usbtv_video_fail label's code attempts to     both access and free this data structure (bnc#1074426).

  - CVE-2017-18174: The amd_gpio_remove function in     drivers/pinctrl/pinctrl-amd.c calls the     pinctrl_unregister function, leading to a double free     (bnc#1080533).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2018-1000026: A insufficient input validation     vulnerability in bnx2x network card driver could result     in DoS: Network card firmware assertion takes card     off-line. This attack appear to be exploitable via An     attacker on a must pass a very large, specially crafted     packet to the bnx2x card. This can be done from an     untrusted guest VM. (bnc#1079384).

  - CVE-2018-8087: Memory leak in the hwsim_new_radio_nl     function in drivers/net/wireless/mac80211_hwsim.c     allowed local users to cause a denial of service (memory     consumption) by triggering an out-of-array error case     (bnc#1085053).

  - CVE-2018-1068: Insufficient user provided offset     checking in the ebtables compat code allowed local     attackers to overwrite kernel memory and potentially     execute code. (bsc#1085107)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.120 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the v4l2 video driver was fixed. (bnc#1072865).

  - CVE-2017-15951: The KEYS subsystem did not correctly     synchronize the actions of updating versus finding a key     in the 'negative' state to avoid a race condition, which     allowed local users to cause a denial of service or     possibly have unspecified other impact via crafted     system calls (bnc#1062840 bnc#1065615).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

  - CVE-2017-17975: Use-after-free in the usbtv_probe     function in drivers/media/usb/usbtv/usbtv-core.c allowed     attackers to cause a denial of service (system crash) or     possibly have unspecified other impact by triggering     failure of audio registration, because a kfree of the     usbtv data structure occurs during a usbtv_video_free     call, but the usbtv_video_fail label's code attempts to     both access and free this data structure (bnc#1074426).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2018-8087: Memory leak in the hwsim_new_radio_nl     function in drivers/net/wireless/mac80211_hwsim.c     allowed local users to cause a denial of service (memory     consumption) by triggering an out-of-array error case     (bnc#1085053).

  - CVE-2018-1000026: A insufficient input validation     vulnerability in the bnx2x network card driver could     result in DoS: Network card firmware assertion takes     card off-line. This attack appear to be exploitable via     An attacker on a must pass a very large, specially     crafted packet to the bnx2x card. This can be done from     an untrusted guest VM. (bnc#1079384).

  - CVE-2018-1068: Insufficient user provided offset     checking in the ebtables compat code allowed local     attackers to overwrite kernel memory and potentially     execute code. (bsc#1085107)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.13.16 update contains various fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-8824     Mohamed Ghannam discovered that the DCCP implementation     did not correctly manage resources when a socket is     disconnected and reconnected, potentially leading to a     use-after-free. A local user could use this for denial     of service (crash or data corruption) or possibly for     privilege escalation. On systems that do not already     have the dccp module loaded, this can be mitigated by     disabling it:echo >> /etc/modprobe.d/disable-dccp.conf     install dccp false

  - CVE-2017-16538     Andrey Konovalov reported that the dvb-usb-lmedm04 media     driver did not correctly handle some error conditions     during initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash).

  - CVE-2017-16644     Andrey Konovalov reported that the hdpvr media driver     did not correctly handle some error conditions during     initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash).

  - CVE-2017-16995     Jann Horn discovered that the Extended BPF verifier did     not correctly model the behaviour of 32-bit load     instructions. A local user can use this for privilege     escalation.

  - CVE-2017-17448     Kevin Cernekee discovered that the netfilter subsystem     allowed users with the CAP_NET_ADMIN capability in any     user namespace, not just the root namespace, to enable     and disable connection tracking helpers. This could lead     to denial of service, violation of network security     policy, or have other impact.

  - CVE-2017-17449     Kevin Cernekee discovered that the netlink subsystem     allowed users with the CAP_NET_ADMIN capability in any     user namespace to monitor netlink traffic in all net     namespaces, not just those owned by that user namespace.
    This could lead to exposure of sensitive information.

  - CVE-2017-17450     Kevin Cernekee discovered that the xt_osf module allowed     users with the CAP_NET_ADMIN capability in any user     namespace to modify the global OS fingerprint list.

  - CVE-2017-17558     Andrey Konovalov reported that that USB core did not     correctly handle some error conditions during     initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash or memory corruption), or     possibly for privilege escalation.

  - CVE-2017-17712     Mohamed Ghannam discovered a race condition in the IPv4     raw socket implementation. A local user could use this     to obtain sensitive information from the kernel.

  - CVE-2017-17741     Dmitry Vyukov reported that the KVM implementation for     x86 would over-read data from memory when emulating an     MMIO write if the kvm_mmio tracepoint was enabled. A     guest virtual machine might be able to use this to cause     a denial of service (crash).

  - CVE-2017-17805     It was discovered that some implementations of the     Salsa20 block cipher did not correctly handle     zero-length input. A local user could use this to cause     a denial of service (crash) or possibly have other     security impact.

  - CVE-2017-17806     It was discovered that the HMAC implementation could be     used with an underlying hash algorithm that requires a     key, which was not intended. A local user could use this     to cause a denial of service (crash or memory     corruption), or possibly for privilege escalation.

  - CVE-2017-17807     Eric Biggers discovered that the KEYS subsystem lacked a     check for write permission when adding keys to a     process's default keyring. A local user could use this     to cause a denial of service or to obtain sensitive     information.

  - CVE-2017-17862     Alexei Starovoitov discovered that the Extended BPF     verifier ignored unreachable code, even though it would     still be processed by JIT compilers. This could possibly     be used by local users for denial of service. It also     increases the severity of bugs in determining     unreachable code.

  - CVE-2017-17863     Jann Horn discovered that the Extended BPF verifier did     not correctly model pointer arithmetic on the stack     frame pointer. A local user can use this for privilege     escalation.

  - CVE-2017-17864     Jann Horn discovered that the Extended BPF verifier     could fail to detect pointer leaks from conditional     code. A local user could use this to obtain sensitive     information in order to exploit other vulnerabilities.

  - CVE-2017-1000407     Andrew Honig reported that the KVM implementation for     Intel processors allowed direct access to host I/O port     0x80, which is not generally safe. On some systems this     allows a guest VM to cause a denial of service (crash)     of the host.

  - CVE-2017-1000410     Ben Seri reported that the Bluetooth subsystem did not     correctly handle short EFS information elements in L2CAP     messages. An attacker able to communicate over Bluetooth     could use this to obtain sensitive information from the     kernel.

The various problems in the Extended BPF verifier can be mitigated by disabling use of Extended BPF by unprivileged users:sysctl kernel.unprivileged_bpf_disabled=1

Debian disables unprivileged user namespaces by default, but if they are enabled (via the kernel.unprivileged_userns_clone sysctl) then CVE-2017-17448 can be exploited by any local user.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16645)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6     allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - drivers/usb/core/config.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel     before 4.13.8 allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel before     4.13.10 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - A flaw was found that sound/core/timer.c in the Linux     kernel before 4.11.5 is vulnerable to a data race in     the ALSA /dev/snd/timer driver resulting in local users     being able to read information belonging to other     users. Uninitialized memory contents may be disclosed     when a read and an ioctl happen at the same     time.(CVE-2017-1000380)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16645)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16534)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel before 4.13.6 allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
148498	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4904-1)	Nessus	Ubuntu Local Security Checks	high
141374	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0044)	Nessus	OracleVM Local Security Checks	critical
140361	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0041)	Nessus	OracleVM Local Security Checks	high
140208	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5837)	Nessus	Oracle Linux Local Security Checks	high
124976	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1523)	Nessus	Huawei Local Security Checks	critical
124824	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1501)	Nessus	Huawei Local Security Checks	high
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	critical
109646	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1172-1)	Nessus	SuSE Local Security Checks	high
109360	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1080-1) (Spectre)	Nessus	SuSE Local Security Checks	high
108748	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0848-1)	Nessus	SuSE Local Security Checks	critical
108705	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0834-1)	Nessus	SuSE Local Security Checks	critical
108649	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0786-1)	Nessus	SuSE Local Security Checks	critical
108648	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0785-1)	Nessus	SuSE Local Security Checks	high
108577	openSUSE Security Update : the Linux Kernel (openSUSE-2018-292)	Nessus	SuSE Local Security Checks	critical
105930	Fedora 27 : kernel (2017-92a0ae09aa)	Nessus	Fedora Local Security Checks	medium
105433	Debian DSA-4073-1 : linux - security update	Nessus	Debian Local Security Checks	high
105047	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1319)	Nessus	Huawei Local Security Checks	medium
104979	Fedora 25 : kernel (2017-905bb449bc)	Nessus	Fedora Local Security Checks	medium
104943	Fedora 26 : kernel (2017-f9f3d80442)	Nessus	Fedora Local Security Checks	medium
104910	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1291)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2017-16644

medium

Tenable Plugins

high

critical

high

high

critical

high

critical

high

high

critical

critical

critical

high

critical

medium

high

medium

medium

medium

medium