The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code and gain privileges.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4071 advisory.

  - The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in     the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU     registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c. (CVE-2017-15537)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This     allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3582-2 advisory.

  - The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6     mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via     filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
    (CVE-2015-8952)

  - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page.
    The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a     memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk     is passed through to a virtual machine) due to an out-of-memory condition. (CVE-2017-12190)

  - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether     the intended netns is used in a peel-off action, which allows local users to cause a denial of service     (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15115)

  - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in     inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code     and gain privileges. (CVE-2017-17712)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to     gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during     the DCCP_LISTEN state. (CVE-2017-8824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3582-1 advisory.

  - The mbcache feature in the ext2 and ext4 filesystem implementations in the Linux kernel before 4.6     mishandles xattr block caching, which allows local users to cause a denial of service (soft lockup) via     filesystem operations in environments that use many attributes, as demonstrated by Ceph and Samba.
    (CVE-2015-8952)

  - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page.
    The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a     memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk     is passed through to a virtual machine) due to an out-of-memory condition. (CVE-2017-12190)

  - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether     the intended netns is used in a peel-off action, which allows local users to cause a denial of service     (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15115)

  - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in     inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code     and gain privileges. (CVE-2017-17712)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to     gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during     the DCCP_LISTEN state. (CVE-2017-8824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)

ChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)

Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3581-2 advisory.

  - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether     the intended netns is used in a peel-off action, which allows local users to cause a denial of service     (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15115)

  - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in     inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code     and gain privileges. (CVE-2017-17712)

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5715)

  - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to     gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during     the DCCP_LISTEN state. (CVE-2017-8824)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mohamed Ghannam discovered that the IPv4 raw socket implementation in the Linux kernel contained a race condition leading to uninitialized pointer usage. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2017-17712)

ChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code, (CVE-2017-15115)

Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-8824)

USN-3541-1 mitigated CVE-2017-5715 (Spectre Variant 2) for the amd64 architecture in Ubuntu 17.10. This update provides the compiler-based retpoline kernel mitigation for the amd64 and i386 architectures. 

Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could use this to expose sensitive information, including kernel memory. (CVE-2017-5715).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.114 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-15129: A use-after-free vulnerability was found     in network namespaces code affecting the Linux kernel     The function get_net_ns_by_id() in     net/core/net_namespace.c did not check for the     net::count value after it has found a peer network in     netns_ids idr, which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely     (bnc#1074839).

  - CVE-2017-17712: The raw_sendmsg() function in     net/ipv4/raw.c in the Linux kernel has a race condition     in inet->hdrincl that leads to uninitialized stack     pointer usage; this allowed a local user to execute code     and gain privileges (bnc#1073229).

  - CVE-2017-17862: kernel/bpf/verifier.c in the Linux     kernel ignored unreachable code, even though it would     still be processed by JIT compilers. This behavior, also     considered an improper branch-pruning logic issue, could     possibly be used by local users for denial of service     (bnc#1073928).

  - CVE-2017-17864: kernel/bpf/verifier.c in the Linux     kernel mishandled states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type, which     allowed local users to obtain potentially sensitive     address information, aka a 'pointer leak (bnc#1073928).

  - CVE-2017-18017: The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel allowed     remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

  - CVE-2018-1000004: In the Linux kernel a race condition     vulnerability existed in the sound system, this can lead     to a deadlock and denial of service condition     (bnc#1076017).

  - CVE-2018-5332: In the Linux kernel the     rds_message_alloc_sgs() function did not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c)     (bnc#1075621).

  - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic     function in net/rds/rdma.c mishandled cases where page     pinning fails or an invalid address is supplied, leading     to an rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - drivers/char/mem.c: deny access in open operation when     securelevel is set (Ethan Zhao) [Orabug: 27234850]     [Orabug: 27234850]

  - hugetlb: fix nr_pmds accounting with shared page tables     (Kirill A. Shutemov) [Orabug: 26988581]

  - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky)     [Orabug: 27416198]

  - x86/IBRS: Don't try to change IBRS mode if IBRS is not     available (Boris Ostrovsky) [Orabug: 27416198]

  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode     (Boris Ostrovsky) 

  - x86: Include linux/device.h in bugs_64.c (Boris     Ostrovsky) [Orabug: 27418896]

  - x86/spectre: Drop the warning about ibrs being obsolete.
    (Konrad Rzeszutek Wilk)

  - x86/spec: Don't print the Missing arguments for option     spectre_v2. (Konrad Rzeszutek Wilk)

  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad     Rzeszutek Wilk)

  - x86/IBPB: Provide debugfs interface for changing IBPB     mode (Boris Ostrovsky) [Orabug: 27449065]

  - xen: Make PV Dom0 Linux kernel NUMA aware (Elena     Ufimtseva)

  - net/rds: Fix incorrect error handling (H&aring kon     Bugge) [Orabug: 26848729]

  - net/rds: use multiple sge than buddy allocation in     congestion code (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: fix the sg allocation based on actual     message size' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: avoid large pages for sg allocation for TCP     transport' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'net/rds: Reduce memory footprint in rds_sendmsg'     (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during ib_post_recv in     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during rds_sendmsg with     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: set the rds_ib_init_frag based on supported sge     (Wei Lin Guay) [Orabug: 26848729]

  - bnxt_en: Fix possible corrupted NVRAM parameters from     firmware response. (Michael Chan) [Orabug: 27199588]

  - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y     kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: Fix build failure on !KASAN &&     KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: #undef memset/memcpy/memmove per arch     (Andrey Ryabinin) [Orabug: 27255122]

  - Revert 'Makefile: Build with -Werror=date-time if the     compiler supports it' (Gayatri Vasudevan) [Orabug:
    27255122]

  - dccp: CVE-2017-8824: use-after-free in DCCP code     (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)

  - x86/efi: Initialize and display UEFI secure boot state a     bit later during init (Daniel Kiper) [Orabug: 27309477]

  - x86/espfix: Init espfix on the boot CPU side (Zhu     Guihua) [Orabug: 27344552]

  - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu     Guihua) 

  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)     [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)

  - fs/ocfs2: remove page cache for converted direct write     (Wengang Wang)

  - Revert 'ocfs2: code clean up for direct io' (Wengang     Wang)

  - assoc_array: Fix a buggy node-splitting case (David     Howells) [Orabug: 27364592] (CVE-2017-12193)     (CVE-2017-12193)

  - Sanitize 'move_pages' permission checks (Linus Torvalds)     [Orabug: 27364690] (CVE-2017-14140)

  - pti: compile fix for when PTI is disabled (Pavel     Tatashin) [Orabug: 27383147] (CVE-2017-5754)

  - sctp: do not peel off an assoc from one netns to another     one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)

  - net: ipv4: fix for a race condition in raw_sendmsg     (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)

  - mlx4: add mstflint secure boot access kernel support     (Qing Huang) 

  - x86: Move STUFF_RSB in to the idt macro (Konrad     Rzeszutek Wilk)

  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad     Rzeszutek Wilk)

  - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad     Rzeszutek Wilk)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.114 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-15129: A use-after-free vulnerability was found     in network namespaces code affecting the Linux kernel in     the function get_net_ns_by_id() in     net/core/net_namespace.c did not check for the     net::count value after it has found a peer network in     netns_ids idr, which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely     (bnc#1074839).

  - CVE-2017-17712: The raw_sendmsg() function in     net/ipv4/raw.c in the Linux kernel has a race condition     in inet->hdrincl that leads to uninitialized stack     pointer usage; this allowed a local user to execute code     and gain privileges (bnc#1073229).

  - CVE-2017-17862: kernel/bpf/verifier.c in the Linux     kernel ignored unreachable code, even though it would     still be processed by JIT compilers. This behavior, also     considered an improper branch-pruning logic issue, could     possibly be used by local users for denial of service     (bnc#1073928).

  - CVE-2017-17864: kernel/bpf/verifier.c in the Linux     kernel mishandled states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type, which     allowed local users to obtain potentially sensitive     address information, aka a 'pointer leak (bnc#1073928).

  - CVE-2017-18017: The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel allowed     remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

  - CVE-2018-5332: In the Linux kernel the     rds_message_alloc_sgs() function did not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c)     (bnc#1075621).

  - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic     function in net/rds/rdma.c mishandled cases where page     pinning fails or an invalid address is supplied, leading     to an rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2018-1000004: In the Linux kernel a race condition     vulnerability existed in the sound system, this can lead     to a deadlock and denial of service condition     (bnc#1076017).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4025 advisory.

  - Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow     unauthorized disclosure of information to an attacker with local user access via a side-channel analysis     of the data cache. (CVE-2017-5754)

  - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11     mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference     and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link     creation operations. (CVE-2017-12193)

  - The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to     gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during     the DCCP_LISTEN state. (CVE-2017-8824)

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether     the intended netns is used in a peel-off action, which allows local users to cause a denial of service     (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.
    (CVE-2017-15115)

  - The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in     inet->hdrincl that leads to uninitialized stack pointer usage; this allows a local user to execute code     and gain privileges. (CVE-2017-17712)

  - The move_pages system call in mm/migrate.c in the Linux kernel before 4.12.9 doesn't check the effective     uid of the target process, enabling a local attacker to learn the memory layout of a setuid executable     despite ASLR. (CVE-2017-14140)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak

A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges. (CVE-2017-17712)

Use-after-free vulnerability in DCCP socket

A use-after-free vulnerability was found in DCCP socket code affecting the Linux kernel since 2.6.16. This vulnerability could allow an attacker to their escalate privileges. (CVE-2017-8824)

Stack-based out-of-bounds read via vmcall instruction

Linux kernel compiled with the KVM virtualization (CONFIG_KVM) support is vulnerable to an out-of-bounds read access issue. It could occur when emulating vmcall instructions invoked by a guest. A guest user/process could use this flaw to disclose kernel memory bytes.
(CVE-2017-17741)

Unchecked capabilities in net/netfilter/xt_osf.c allows for unprivileged modification to systemwide fingerprint list

net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces. (CVE-2017-17450)

Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure

net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability for new, get, and del operations, which allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces. (CVE-2017-17448)

The 4.14.7 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.14.8 stable kernel update contains a number of important fixes across the tree.

----

The 4.14.7 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-8824     Mohamed Ghannam discovered that the DCCP implementation     did not correctly manage resources when a socket is     disconnected and reconnected, potentially leading to a     use-after-free. A local user could use this for denial     of service (crash or data corruption) or possibly for     privilege escalation. On systems that do not already     have the dccp module loaded, this can be mitigated by     disabling it:echo >> /etc/modprobe.d/disable-dccp.conf     install dccp false

  - CVE-2017-16538     Andrey Konovalov reported that the dvb-usb-lmedm04 media     driver did not correctly handle some error conditions     during initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash).

  - CVE-2017-16644     Andrey Konovalov reported that the hdpvr media driver     did not correctly handle some error conditions during     initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash).

  - CVE-2017-16995     Jann Horn discovered that the Extended BPF verifier did     not correctly model the behaviour of 32-bit load     instructions. A local user can use this for privilege     escalation.

  - CVE-2017-17448     Kevin Cernekee discovered that the netfilter subsystem     allowed users with the CAP_NET_ADMIN capability in any     user namespace, not just the root namespace, to enable     and disable connection tracking helpers. This could lead     to denial of service, violation of network security     policy, or have other impact.

  - CVE-2017-17449     Kevin Cernekee discovered that the netlink subsystem     allowed users with the CAP_NET_ADMIN capability in any     user namespace to monitor netlink traffic in all net     namespaces, not just those owned by that user namespace.
    This could lead to exposure of sensitive information.

  - CVE-2017-17450     Kevin Cernekee discovered that the xt_osf module allowed     users with the CAP_NET_ADMIN capability in any user     namespace to modify the global OS fingerprint list.

  - CVE-2017-17558     Andrey Konovalov reported that that USB core did not     correctly handle some error conditions during     initialisation. A physically present user with a     specially designed USB device can use this to cause a     denial of service (crash or memory corruption), or     possibly for privilege escalation.

  - CVE-2017-17712     Mohamed Ghannam discovered a race condition in the IPv4     raw socket implementation. A local user could use this     to obtain sensitive information from the kernel.

  - CVE-2017-17741     Dmitry Vyukov reported that the KVM implementation for     x86 would over-read data from memory when emulating an     MMIO write if the kvm_mmio tracepoint was enabled. A     guest virtual machine might be able to use this to cause     a denial of service (crash).

  - CVE-2017-17805     It was discovered that some implementations of the     Salsa20 block cipher did not correctly handle     zero-length input. A local user could use this to cause     a denial of service (crash) or possibly have other     security impact.

  - CVE-2017-17806     It was discovered that the HMAC implementation could be     used with an underlying hash algorithm that requires a     key, which was not intended. A local user could use this     to cause a denial of service (crash or memory     corruption), or possibly for privilege escalation.

  - CVE-2017-17807     Eric Biggers discovered that the KEYS subsystem lacked a     check for write permission when adding keys to a     process's default keyring. A local user could use this     to cause a denial of service or to obtain sensitive     information.

  - CVE-2017-17862     Alexei Starovoitov discovered that the Extended BPF     verifier ignored unreachable code, even though it would     still be processed by JIT compilers. This could possibly     be used by local users for denial of service. It also     increases the severity of bugs in determining     unreachable code.

  - CVE-2017-17863     Jann Horn discovered that the Extended BPF verifier did     not correctly model pointer arithmetic on the stack     frame pointer. A local user can use this for privilege     escalation.

  - CVE-2017-17864     Jann Horn discovered that the Extended BPF verifier     could fail to detect pointer leaks from conditional     code. A local user could use this to obtain sensitive     information in order to exploit other vulnerabilities.

  - CVE-2017-1000407     Andrew Honig reported that the KVM implementation for     Intel processors allowed direct access to host I/O port     0x80, which is not generally safe. On some systems this     allows a guest VM to cause a denial of service (crash)     of the host.

  - CVE-2017-1000410     Ben Seri reported that the Bluetooth subsystem did not     correctly handle short EFS information elements in L2CAP     messages. An attacker able to communicate over Bluetooth     could use this to obtain sensitive information from the     kernel.

The various problems in the Extended BPF verifier can be mitigated by disabling use of Extended BPF by unprivileged users:sysctl kernel.unprivileged_bpf_disabled=1

Debian disables unprivileged user namespaces by default, but if they are enabled (via the kernel.unprivileged_userns_clone sysctl) then CVE-2017-17448 can be exploited by any local user.

ID	Name	Product	Family	Severity
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	high
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	high
109156	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	high
106973	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3582-2)	Nessus	Ubuntu Local Security Checks	high
106972	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3582-1)	Nessus	Ubuntu Local Security Checks	high
106971	Ubuntu 17.10 : linux-raspi2 vulnerabilities (USN-3581-3)	Nessus	Ubuntu Local Security Checks	high
106970	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3581-2)	Nessus	Ubuntu Local Security Checks	high
106969	Ubuntu 17.10 : linux vulnerabilities (USN-3581-1) (Spectre)	Nessus	Ubuntu Local Security Checks	high
106748	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0416-1) (Spectre)	Nessus	SuSE Local Security Checks	critical
106740	openSUSE Security Update : the Linux Kernel (openSUSE-2018-153) (Spectre)	Nessus	SuSE Local Security Checks	critical
106706	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)	Nessus	OracleVM Local Security Checks	high
106672	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0383-1) (Spectre)	Nessus	SuSE Local Security Checks	critical
106670	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4025)	Nessus	Oracle Linux Local Security Checks	high
106171	Amazon Linux AMI : kernel (ALAS-2018-944)	Nessus	Amazon Linux Local Security Checks	high
106010	Fedora 27 : kernel (2017-f7cb245861)	Nessus	Fedora Local Security Checks	high
105447	Fedora 26 : kernel (2017-7810b7c59f)	Nessus	Fedora Local Security Checks	high
105433	Debian DSA-4073-1 : linux - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-17712

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

critical

high

critical

high

high

high

high

high