The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4644 advisory.

  - The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows     local users to gain privileges or cause a denial of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. (CVE-2016-1583)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:
    Android kernel. Android ID: A-70526974. (CVE-2017-13305)

  - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num     from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds     (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)

  - The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because     install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the     ptrace_may_access() check has a race condition when reading /proc/pid/stat. (CVE-2019-11190)

  - The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows     physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash)     via a crafted endpoints value in a USB device descriptor. (CVE-2016-3139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):A buffer overflow was     discovered in tpacket_rcv() function in the Linux     kernel since v4.6-rc1 through v4.13. A number of     socket-related syscalls can be made to set up a     configuration when each packet received by a network     interface can cause writing up to 10 bytes to a kernel     memory outside of a kernel buffer. This can cause     unspecified kernel data corruption effects, including     damage of in-memory and on-disk XFS     data.(CVE-2017-14497)The qmi_wwan_bind function in     driverset/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)A race condition flaw was found     in the way the Linux kernel's SCTP implementation     handled sctp_accept() during the processing of     heartbeat timeout events. A remote attacker could use     this flaw to prevent further connections to be accepted     by the SCTP server running on the system, resulting in     a denial of service.(CVE-2015-8767)A race condition     flaw was found in the way the Linux kernel's KVM     subsystem handled PIT (Programmable Interval Timer)     emulation. A guest user who has access to the PIT I/O     ports could use this flaw to crash the     host.(CVE-2014-3611)The Linux kernel is vulnerable to a     memory leak in the     driverset/wireless/mac80211_hwsim.c:hwsim_new_radio_nl(     ) function. An attacker could exploit this to cause a     potential denial of service.(CVE-2018-8087)An integer     underflow flaw was found in the way the Linux kernel's     Stream Control Transmission Protocol (SCTP)     implementation processed certain COOKIE_ECHO packets.
    By sending a specially crafted SCTP packet, a remote     attacker could use this flaw to prevent legitimate     connections to a particular SCTP server socket to be     made.(CVE-2014-4667)The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)The     snd_usb_create_streams function in sound/usb/card.c in     the Linux kernel, before 4.13.6, allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)A flaw was     found in the Linux kernel's random number generator     API. A null pointer dereference in the rngapi_reset     function may result in denial of service, crashing the     system.(CVE-2017-15116)The __netlink_deliver_tap_skb     function in netetlink/af_netlink.c in the Linux kernel,     through 4.14.4, does not restrict observations of     Netlink messages to a single net namespace, when     CONFIG_NLMON is enabled. This allows local users to     obtain sensitive information by leveraging the     CAP_NET_ADMIN capability to sniff an nlmon interface     for all Netlink activity on the     system.(CVE-2017-17449)arch/arm64/kernel/perf_event.c     in the Linux kernel before 4.1 on arm64 platforms     allows local users to gain privileges or cause a denial     of service (invalid pointer dereference) via vectors     involving events that are mishandled during a span of     multiple HW PMUs.(CVE-2015-8955)The aac_compat_ioctl     function in drivers/scsi/aacraid/linit.c in the Linux     kernel before 3.11.8 does not require the CAP_SYS_RAWIO     capability, which allows local users to bypass intended     access restrictions via a crafted ioctl     call.(CVE-2013-6383)Linux kernel before version     4.16-rc7 is vulnerable to a null pointer dereference in     dccp_write_xmit() function in net/dccp/output.c in that     allows a local user to cause a denial of service by a     number of certain crafted system     calls.(CVE-2018-1130)The Linux kernel is vulerable to a     use-after-free flaw when Transformation User     configuration interface(CONFIG_XFRM_USER) compile-time     configuration were enabled. This vulnerability occurs     while closing a xfrm netlink socket in     xfrm_dump_policy_done. A user/process could abuse this     flaw to potentially escalate their privileges on a     system.(CVE-2017-16939)A vulnerability was found in the     Linux kernel in function rds_inc_info_copy of file     net/rds/recv.c. The last field 'flags' of object     'minfo' is not initialized. This can leak data     previously at the flags location to     userspace.(CVE-2016-5244)A flaw was found in the     kernel's ACPI interpreter when it does not flush the     operand cache and causes a kernel stack dump. This     allows local users to obtain sensitive information from     kernel memory and bypass the KASLR protection     mechanism.(CVE-2017-13693)It was found that     kernel/events/core.c in the Linux kernel mishandles     counter grouping, which allows local users to gain     privileges via a crafted application, related to the     perf_pmu_register and perf_event_open     functions.(CVE-2015-9004)The xfs_bmap_extents_to_btree     function in fs/xfs/libxfs/xfs_bmap.c in the Linux     kernel through 4.16.3 allows local users to cause a     denial of service (xfs_bmapi_write NULL pointer     dereference) via a crafted xfs     image.(CVE-2018-10323)The lrw_crypt() function in     'crypto/lrw.c' in the Linux kernel before 4.5 allows     local users to cause a system crash and a denial of     service by the NULL pointer dereference via accept(2)     system call for AF_ALG socket without calling setkey()     first to set a cipher key.(CVE-2015-8970)The IPv6     fragmentation implementation in the Linux kernel does     not consider that the nexthdr field may be associated     with an invalid option, which allows local users to     cause a denial of service (out-of-bounds read and BUG)     or possibly have unspecified other impact via crafted     socket and send system calls. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-9074)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The cdc_parse_cdc_header() function in     'drivers/usb/core/message.c' in the Linux kernel,     before 4.13.6, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-16534)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel can allow     a local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - The drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel, through 4.13.11, allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel,     through 4.13.11, allows local users to cause a denial     of service (ims_pcu_parse_cdc_data out-of-bounds read     and system crash) or possibly have unspecified other     impact via a crafted USB device.(CVE-2017-16645)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The Linux kernel is vulerable to a use-after-free flaw     when Transformation User configuration     interface(CONFIG_XFRM_USER) compile-time configuration     were enabled. This vulnerability occurs while closing a     xfrm netlink socket in xfrm_dump_policy_done. A     user/process could abuse this flaw to potentially     escalate their privileges on a system.(CVE-2017-16939)

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net     namespaces.(CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel, through     4.14.4, does not restrict observations of Netlink     messages to a single net namespace, when CONFIG_NLMON     is enabled. This allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system.(CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through     4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations. This     allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all network     namespaces.(CVE-2017-17450)

  - The usb_destroy_configuration() function, in     'drivers/usb/core/config.c' in the USB core subsystem,     in the Linux kernel through 4.14.5 does not consider     the maximum number of configurations and interfaces     before attempting to release resources. This allows     local users to cause a denial of service, due to     out-of-bounds write access, or possibly have     unspecified other impact via a crafted USB device. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is     unlikely.(CVE-2017-17558)

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux     kernel, before 4.14.8, does not validate that the     underlying cryptographic hash algorithm is unkeyed.
    This allows a local attacker, able to use the     AF_ALG-based hash interface     (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash     algorithm (CONFIG_CRYPTO_SHA3), to cause a kernel stack     buffer overflow by executing a crafted sequence of     system calls that encounter a missing SHA-3     initialization.(CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on     it.(CVE-2017-17807)

  - A flaw was found in the Linux kernel's implementation     of i8042 serial ports. An attacker could cause a kernel     panic if they are able to add and remove devices as the     module is loaded.(CVE-2017-18079)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with     CAP_SYS_ADMIN capability) can directly perform the     ioctl operations for dm device creation and removal and     this would typically be outside the direct control of     the unprivileged attacker.(CVE-2017-18203)

  - The madvise_willneed function in the Linux kernel     allows local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping.(CVE-2017-18208)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3754-1 advisory.

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly     validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-     of-bounds read and system crash) via a crafted ext4 image. (CVE-2016-10208)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 3.2 allows local users to gain privileges via a crafted ACPI table. (CVE-2017-11473)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0. (CVE-2017-14991)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service     (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB     device. (CVE-2017-16526)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16529)

  - drivers/usb/core/config.c in the Linux kernel before 4.13.6 allows local users to cause a denial of     service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB     device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (CVE-2017-16531)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The usbhid_parse function in drivers/hid/usbhid/hid-core.c in the Linux kernel before 4.13.8 allows local     users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16533)

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system crash) or possibly have unspecified other impact     via a crafted USB device, related to a missing warm-start check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner). (CVE-2017-16538)

  - The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11     allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16643)

  - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (improper error handling and system crash) or possibly     have unspecified other impact via a crafted USB device. (CVE-2017-16644)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The perf_cpu_time_max_percent_handler function in kernel/events/core.c in the Linux kernel before 4.11     allows local users to cause a denial of service (integer overflow) or possibly have unspecified other     impact via a large value, as demonstrated by an incorrect sample-rate calculation. (CVE-2017-18255)

  - In the Linux kernel before 4.13.5, a local user could create keyrings for other users via keyctl commands,     setting unwanted defaults or causing a denial of service. (CVE-2017-18270)

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of service (use-after-free) via a crafted application     that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. (CVE-2017-2584)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5     places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which     allows local users to obtain sensitive information by reading the log. (CVE-2017-5549)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds     access. (CVE-2017-5897)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages     lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on     IrDA devices. (CVE-2017-6348)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers     to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

  - The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel through 4.11.5     allows local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified     other impact by changing a certain sequence-number value, aka a double fetch vulnerability.
    (CVE-2017-8831)

  - The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9984)

  - The snd_msndmidi_input_read function in sound/isa/msnd/msnd_midi.c in the Linux kernel through 4.11.7     allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other     impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a     double fetch vulnerability. (CVE-2017-9985)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - drivers/scsi/libsas/sas_scsi_host.c in the Linux kernel before 4.16 allows local users to cause a denial     of service (ata qc leak) by triggering certain failure conditions. NOTE: a third party disputes the     relevance of this report because the failure can only occur for physically proximate attackers who unplug     SAS Host Bus Adapter cables (CVE-2018-10021)

  - The kernel_wait4 function in kernel/exit.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service by triggering an     attempted use of the -INT_MIN value. (CVE-2018-10087)

  - The kill_something_info function in kernel/signal.c in the Linux kernel before 4.13, when an unspecified     architecture and compiler is used, might allow local users to cause a denial of service via an INT_MIN     argument. (CVE-2018-10124)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to     cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted system     calls. (CVE-2018-10675)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_iget function in fs/ext4/inode.c in the Linux kernel through 4.15.15 mishandles the case of a     root directory with a zero i_links_count, which allows attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and OOPS) via a crafted ext4 image. (CVE-2018-1092)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - The cdrom_ioctl_media_changed function in drivers/cdrom/cdrom.c in the Linux kernel before 4.16.6 allows     local attackers to use a incorrect bounds check in the CDROM driver CDROM_MEDIA_CHANGED ioctl to read out     kernel memory. (CVE-2018-10940)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4071 advisory.

  - The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in     the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU     registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c. (CVE-2017-15537)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This     allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-2 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16528)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to     cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging     incorrect sign extension. (CVE-2017-16995)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4,     when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink activity on the system. (CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service. (CVE-2017-17862)

  - crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted sequence of system calls. (CVE-2017-18075)

  - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to     cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and     removal of DM devices. (CVE-2017-18203)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to     cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

  - The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to     cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a     negative wake or requeue value. (CVE-2018-6927)

  - A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel     before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST. (CVE-2018-7492)

  - The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8     does not validate certain resource availability, which allows local users to cause a denial of service     (NULL pointer dereference). (CVE-2018-8043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-1 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16528)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to     cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging     incorrect sign extension. (CVE-2017-16995)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4,     when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink activity on the system. (CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service. (CVE-2017-17862)

  - crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted sequence of system calls. (CVE-2017-18075)

  - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to     cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and     removal of DM devices. (CVE-2017-18203)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to     cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

  - The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to     cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a     negative wake or requeue value. (CVE-2018-6927)

  - A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel     before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST. (CVE-2018-7492)

  - The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8     does not validate certain resource availability, which allows local users to cause a denial of service     (NULL pointer dereference). (CVE-2018-8043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15129)

Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532)

Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537)

Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16645)

Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly handle detach events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16646)

Andrey Konovalov discovered that the ASIX Ethernet USB driver in the Linux kernel did not properly handle suspend and resume events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16647)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16649)

Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16650)

It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb ranges. A local attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-16994)

It was discovered that the netfilter component of the Linux did not properly restrict access to the connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
(CVE-2017-17448)

It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform access control checks. A local attacker could improperly modify the system-wide OS fingerprint list. (CVE-2017-17450)

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
(CVE-2017-17741)

It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-17805)

It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17806)

It was discovered that the keyring implementation in the Linux kernel did not properly check permissions when a key request was performed on a tasks' default keyring. A local attacker could use this to add keys to unauthorized keyrings. (CVE-2017-17807)

It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of service (interface unavailability). (CVE-2018-1000026)

It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an out-of-bounds during RDMA page allocation. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-5332)

Mohamed Ghannam discovered a NULL pointer dereference in the RDS (Reliable Datagram Sockets) protocol implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5333)

Fan Long Fei  discovered that a race condition existed in loop block device implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5344).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3617-2 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16647)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2017-1000407)

It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15129)

Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532)

Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537)

Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16645)

Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly handle detach events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16646)

Andrey Konovalov discovered that the ASIX Ethernet USB driver in the Linux kernel did not properly handle suspend and resume events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16647)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16649)

Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16650)

It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb ranges. A local attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-16994)

It was discovered that the netfilter component of the Linux did not properly restrict access to the connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
(CVE-2017-17448)

It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform access control checks. A local attacker could improperly modify the system-wide OS fingerprint list. (CVE-2017-17450)

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
(CVE-2017-17741)

It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-17805)

It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17806)

It was discovered that the keyring implementation in the Linux kernel did not properly check permissions when a key request was performed on a tasks' default keyring. A local attacker could use this to add keys to unauthorized keyrings. (CVE-2017-17807)

It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of service (interface unavailability). (CVE-2018-1000026)

It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an out-of-bounds during RDMA page allocation. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-5332)

Mohamed Ghannam discovered a NULL pointer dereference in the RDS (Reliable Datagram Sockets) protocol implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5333)

Fan Long Fei  discovered that a race condition existed in loop block device implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5344).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.13.16 update contains various fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the patches used to fix the 'dirtycow' vulnerability (CVE-2016-5195). An attacker, able to run local code, can exploit a race condition in transparent huge pages to modify usually read-only huge pages. (CVE-2017-1000405)

Linux kernel Virtualization Module (CONFIG_KVM) for the Intel processor family (CONFIG_KVM_INTEL) is vulnerable to a DoS issue. It could occur if a guest was to flood the I/O port 0x80 with write requests. A guest user could use this flaw to crash the host kernel resulting in DoS. (CVE-2017-1000407)

A BUG in drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16647)

A BUG in drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16646)

The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.
(CVE-2017-16645)

The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16643)

The walk_hugetlb_range() function in 'mm/pagewalk.c' file in the Linux kernel from v4.0-rc1 through v4.15-rc1 mishandles holes in hugetlb ranges. This allows local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call. (CVE-2017-16994)

The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16650)

The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16649)

A vulnerability was found in the Linux kernel when peeling off an association to the socket in another network namespace. All transports in this association are not to be rehashed and keep using the old key in hashtable, thus removing transports from hashtable when closing the socket, all transports are being freed. Later on a use-after-free issue could be caused when looking up an association and dereferencing the transports. (CVE-2017-15115)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0174 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3659 advisory.

  - A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and     f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption     policy to a directory owned by a different user, potentially creating a denial of service.
    (CVE-2016-10318)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-1000405: The Linux Kernel had a problematic use     of pmd_mkdirty() in the touch_pmd() function inside the     THP implementation. touch_pmd() could be reached by     get_user_pages(). In such case, the pmd would become     dirty. This scenario breaks the new     can_follow_write_pmd()'s logic - pmd could become dirty     without going through a COW cycle. This bug was not as     severe as the original 'Dirty cow' because an ext4 file     (or any other regular file) could not be mapped using     THP. Nevertheless, it did allow us to overwrite     read-only huge pages. For example, the zero huge page     and sealed shmem files could be overwritten (since their     mapping could be populated using THP). Note that after     the first write page-fault to the zero page, it will be     replaced with a new fresh (and zeroed) thp (bnc#1069496     1070307).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c in the Linux kernel, when CONFIG_X86_X32 is     enabled, allowed local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067086).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations     (bnc#1066192).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - mm, thp: Do not make page table dirty unconditionally in     follow_trans_huge_pmd (Kirill A. Shutemov) [Orabug:
    27200879] (CVE-2017-1000405)

  - NFS: Add static NFS I/O tracepoints (Chuck Lever)

  - storvsc: don't assume SG list is contiguous (Aruna     Ramakrishna) 

  - fix unbalanced page refcounting in bio_map_user_iov     (Vitaly Mayatskikh) [Orabug: 27069038] (CVE-2017-12190)

  - more bio_map_user_iov leak fixes (Al Viro) [Orabug:
    27069038] (CVE-2017-12190)

  - packet: in packet_do_bind, test fanout with bind_lock     held (Willem de Bruijn) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: hold bind lock when rebinding to fanout hook     (Willem de Bruijn) [Orabug: 27069065] (CVE-2017-15649)

  - net: convert packet_fanout.sk_ref from atomic_t to     refcount_t (Reshetova, Elena) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: fix races in fanout_add (Eric Dumazet) [Orabug:
    27069065] (CVE-2017-15649)

  - refcount_t: Introduce a special purpose refcount type     (Peter Zijlstra) [Orabug: 27069065] (CVE-2017-15649)

  - locking/atomics: Add _[acquire|release|relaxed] variants     of some atomic operations (Will Deacon) [Orabug:
    27069065] (CVE-2017-15649)

  - net: qmi_wwan: fix divide by 0 on bad descriptors     (Bj&oslash rn Mork) [Orabug: 27215225] (CVE-2017-16650)

  - ALSA: usb-audio: Kill stray URB at exiting (Takashi     Iwai) [Orabug: 27148276] (CVE-2017-16527)

  - scsi: Add STARGET_CREATED_REMOVE state to     scsi_target_state (Ewan D. Milne) [Orabug: 27187217]

  - ocfs2: fix posix_acl_create deadlock (Junxiao Bi)     [Orabug: 27126129]

  - scsi: Don't abort scsi_scan due to unexpected response     (John Sobecki) 

  - ocfs2: code clean up for direct io (Ryan Ding)

  - xscore: add dma address check (Zhu Yanjun) [Orabug:
    27076919]

  - KVM: nVMX: Fix loss of L2's NMI blocking state (Wanpeng     Li) [Orabug: 27062498]

  - KVM: nVMX: track NMI blocking state separately for each     VMCS (Paolo Bonzini) [Orabug: 27062498]

  - KVM: VMX: require virtual NMI support (Paolo Bonzini)     [Orabug: 27062498]

  - KVM: nVMX: Fix the NMI IDT-vectoring handling (Wanpeng     Li) [Orabug: 27062498]

  - uek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED     (Fred Herard) 

  - thp: run vma_adjust_trans_huge outside i_mmap_rwsem     (Kirill A. Shutemov) [Orabug: 27026180]

  - selinux: fix off-by-one in setprocattr (Stephen Smalley)     [Orabug: 27001717] (CVE-2017-2618) (CVE-2017-2618)     (CVE-2017-2618)

  - sysctl: Drop reference added by grab_header in     proc_sys_readdir (Zhou Chengming) [Orabug: 27036903]     (CVE-2016-9191) (CVE-2016-9191) (CVE-2016-9191)

  - KEYS: prevent KEYCTL_READ on negative key (Eric Biggers)     [Orabug: 27050248] (CVE-2017-12192)

  - IB/ipoib: For sendonly join free the multicast group on     leave (Christoph Lameter) [Orabug: 27077718]

  - IB/ipoib: increase the max mcast backlog queue (Doug     Ledford) 

  - IB/ipoib: Make sendonly multicast joins create the mcast     group (Doug Ledford) [Orabug: 27077718]

  - IB/ipoib: Expire sendonly multicast joins (Christoph     Lameter) 

  - IB/ipoib: Suppress warning for send only join failures     (Jason Gunthorpe) [Orabug: 27077718]

  - IB/ipoib: Clean up send-only multicast joins (Doug     Ledford) [Orabug: 27077718]

  - netlink: allow to listen 'all' netns (Nicolas Dichtel)     [Orabug: 27077944]

  - netlink: rename private flags and states (Nicolas     Dichtel) [Orabug: 27077944]

  - netns: use a spin_lock to protect nsid management     (Nicolas Dichtel) 

  - netns: notify new nsid outside __peernet2id (Nicolas     Dichtel) 

  - netns: rename peernet2id to peernet2id_alloc (Nicolas     Dichtel) 

  - netns: always provide the id to rtnl_net_fill (Nicolas     Dichtel) 

  - netns: returns always an id in __peernet2id (Nicolas     Dichtel) 

  - Hang/soft lockup in d_invalidate with simultaneous calls     (Al Viro) 

  - Revert 'drivers/char/mem.c: deny access in open     operation when securelevel is set' (Brian Maly) [Orabug:
    27037811]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3651 advisory.

  - The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd()     function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the     pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty     without going through a COW cycle. This bug is not as severe as the original Dirty cow because an ext4     file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite     read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since     their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it     will be replaced with a new fresh (and zeroed) thp. (CVE-2017-1000405)

  - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page.
    The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a     memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk     is passed through to a virtual machine) due to an out-of-memory condition. (CVE-2017-12190)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16645)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages. (bnc#1069702)

  - CVE-2017-1000405: mm, thp: do not dirty huge pages on     read fault (bnc#1069496).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067085)

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c, when CONFIG_X86_X32 is enabled, allowed     local users to gain privileges via a recvmmsg system     call with a crafted timeout pointer parameter     (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067086)

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1066700)

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference.
    (bnc#1066705)

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor.
    (bnc#1066671)

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations.
    (bnc#1066192)

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device. (bnc#1066650)

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup. (bnc#1066618)

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device.
    (bnc#1066573)

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device.
    (bnc#1066606)

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device. (bnc#1066625)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6     allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - drivers/usb/core/config.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel     before 4.13.8 allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel before     4.13.10 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - A flaw was found that sound/core/timer.c in the Linux     kernel before 4.11.5 is vulnerable to a data race in     the ALSA /dev/snd/timer driver resulting in local users     being able to read information belonging to other     users. Uninitialized memory contents may be disclosed     when a read and an ioctl happen at the same     time.(CVE-2017-1000380)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16645)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16534)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel before 4.13.6 allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125237	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4644)	Nessus	Oracle Linux Local Security Checks	high
124990	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1537)	Nessus	Huawei Local Security Checks	high
124824	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1501)	Nessus	Huawei Local Security Checks	high
112113	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3754-1)	Nessus	Ubuntu Local Security Checks	critical
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	high
109156	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	high
108878	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3619-2)	Nessus	Ubuntu Local Security Checks	high
108842	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3619-1)	Nessus	Ubuntu Local Security Checks	high
108840	Ubuntu 17.10 : linux-raspi2 vulnerabilities (USN-3617-3)	Nessus	Ubuntu Local Security Checks	high
108835	Ubuntu 16.04 LTS : Linux (HWE) vulnerabilities (USN-3617-2)	Nessus	Ubuntu Local Security Checks	high
108834	Ubuntu 17.10 : linux vulnerabilities (USN-3617-1)	Nessus	Ubuntu Local Security Checks	high
105930	Fedora 27 : kernel (2017-92a0ae09aa)	Nessus	Fedora Local Security Checks	medium
105422	Amazon Linux AMI : kernel (ALAS-2017-937) (Dirty COW)	Nessus	Amazon Linux Local Security Checks	high
105248	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0174) (BlueBorne) (Dirty COW) (Stack Clash)	Nessus	OracleVM Local Security Checks	high
105247	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3659)	Nessus	Oracle Linux Local Security Checks	high
105150	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3249-1) (Dirty COW)	Nessus	SuSE Local Security Checks	high
105146	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0172) (Dirty COW)	Nessus	OracleVM Local Security Checks	high
105143	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3651)	Nessus	Oracle Linux Local Security Checks	high
105047	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1319)	Nessus	Huawei Local Security Checks	medium
105020	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3210-1) (Dirty COW)	Nessus	SuSE Local Security Checks	high
104979	Fedora 25 : kernel (2017-905bb449bc)	Nessus	Fedora Local Security Checks	medium
104943	Fedora 26 : kernel (2017-f9f3d80442)	Nessus	Fedora Local Security Checks	medium
104910	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1291)	Nessus	Huawei Local Security Checks	medium

Detections

Analytics

CVE-2017-16650

medium

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

medium

high

medium

medium

medium