crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have unspecified other impact by executing a crafted sequence of system calls.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted sequence of system calls. (CVE-2017-18075)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An information-leak vulnerability was found in the     kernel when it truncated a file to a smaller size which     consisted of an inline extent that was compressed. The     data between the new file size and the old file size     was not discarded and the number of bytes used by the     inode were not correctly decremented, which gave the     wrong report for callers of the stat(2) syscall. This     wasted metadata space and allowed for the truncated     data to be leaked, and data corruption or loss to     occur. A caller of the clone ioctl could exploit this     flaw by using only standard file-system operations     without root access to read the truncated     data.(CVE-2015-8374i1/4%0

  - crypto/pcrypt.c in the Linux kernel, before 4.14.13,     mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface     (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service     (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted     sequence of system calls. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2017-18075i1/4%0

  - An elevation of privilege vulnerability in the Qualcomm     Wi-Fi driver could enable a local malicious application     to execute arbitrary code within the context of the     kernel. This issue is rated as High because it first     requires compromising a privileged process. Product:
    Android. Versions: N/A. Android ID: A-32835279.
    References: QC-CR#1096945.(CVE-2017-0523i1/4%0

  - The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel through 4.10.14 allows local users to cause a     denial of service (out-of-bounds array access) or     possibly have unspecified other impact by changing a     certain sequence-number value, aka a 'double fetch'     vulnerability.(CVE-2017-8831i1/4%0

  - A flaw was found in the way the Linux kernel's splice()     system call validated its parameters. On certain file     systems, a local, unprivileged user could use this flaw     to write past the maximum file size, and thus crash the     system.(CVE-2014-7822i1/4%0

  - The vc4_get_bcl function in     drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM     driver in the Linux kernel before 4.9.7 does not set an     errno value upon certain overflow detections allowing     local users to cause a denial of service (incorrect     pointer dereference and OOPS) via inconsistent size     values in a VC4_SUBMIT_CL ioctl call.(CVE-2017-5577i1/4%0

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel     before 4.15, local users can cause a denial of service     (NULL pointer dereference and BUG) because a required     mutex is not used.(CVE-2017-18216i1/4%0

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets     implementation in the Linux kernel networking subsystem     handled synchronization while creating the TPACKET_V3     ring buffer. A local user able to open a raw packet     socket (requires the CAP_NET_RAW capability) could use     this flaw to elevate their privileges on the     system.(CVE-2016-8655i1/4%0

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112i1/4%0

  - A security flaw was found in the Linux kernel in a way     that the cleancache subsystem clears an inode after the     final file truncation (removal). The new file created     with the same inode may contain leftover pages from     cleancache and the old file data instead of the new     one.(CVE-2018-16862i1/4%0

  - arch/arm64/ include /asm/pgtable.h in the Linux kernel     before 3.15-rc5-next-20140519, as used in Android     before 2016-07-05 on Nexus 5X and 6P devices,     mishandles execute-only pages, which allows attackers     to gain privileges via a crafted application, aka     Android internal bug 28557020.(CVE-2014-9803i1/4%0

  - A heap-buffer overflow vulnerability was found in the     arcmsr_iop_message_xfer() function in     'drivers/scsi/arcmsr/arcmsr_hba.c' file in the Linux     kernel through 4.8.2. The function does not restrict a     certain length field, which allows local users to gain     privileges or cause a denial of service via an     ARCMSR_MESSAGE_WRITE_WQBUFFER control code. This can     potentially cause kernel heap corruption and arbitrary     kernel code execution.(CVE-2016-7425i1/4%0

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl     call.(CVE-2018-20511i1/4%0

  - A memory leak in the irda_bind function in     net/irda/af_irda.c in the Linux kernel, through 4.16,     allows local users to cause a denial of service due to     a memory consumption by repeatedly binding an AF_IRDA     socket.(CVE-2018-6554i1/4%0

  - sound/core/timer.c in the Linux kernel before 4.4.1     employs a locking approach that does not consider slave     timer instances, which allows local users to cause a     denial of service (race condition, use-after-free, and     system crash) via a crafted ioctl     call.(CVE-2016-2547i1/4%0

  - Buffer overflow in the complete_emulated_mmio function     in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6     allows guest OS users to execute arbitrary code on the     host OS by leveraging a loop that triggers an invalid     memory copy affecting certain cancel_work_item     data.(CVE-2014-0049i1/4%0

  - An issue was discovered in the F2FS filesystem code in     the Linux kernel in fs/f2fs/inode.c. A denial of     service due to a slab out-of-bounds read can occur for     a crafted f2fs filesystem image in which FI_EXTRA_ATTR     is set in an inode.(CVE-2018-13098i1/4%0

  - A vulnerability was found in the Linux kernel where     having malicious IP options present would cause the     ipv4_pktinfo_prepare() function to drop/free the dst.
    This could result in a system crash or possible     privilege escalation.(CVE-2017-5970i1/4%0

  - In the Linux kernel's vmw_gb_surface_define_ioctl()     function, in 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c'     file, a 'req-i1/4zmip_levels' is a user-controlled value     which is later used as a loop count limit. This allows     local unprivileged user to cause a denial of service by     a kernel lockup via a crafted ioctl call for a     '/dev/dri/renderD*' device.(CVE-2017-7346i1/4%0

  - It was found that the NFSv4 server in the Linux kernel     did not properly validate layout type when processing     NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A     remote attacker could use this flaw to soft-lockup the     system and thus cause denial of     service.(CVE-2017-8797i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2948 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

    * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and calculation expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within     ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system.
    Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open     port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/3658021

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for     reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200; and Wen Xu for reporting     CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer     (Red Hat) and Ondrej Mosnacek (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-2 advisory.

    USN-3619-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel improperly     performed sign extension in some situations. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16995)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15129)

    It was discovered that the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel     contained a use-after-free when handling device removal. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16528)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly     handle detach events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16646)

    Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors.
    A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16649)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb     ranges. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-16994)

    It was discovered that the netfilter component of the Linux did not properly restrict access to the     connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
    (CVE-2017-17448)

    It was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of     netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive     information (kernel netlink traffic). (CVE-2017-17449)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read     when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
    (CVE-2017-17741)

    It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not     properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-17805)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    It was discovered that the keyring implementation in the Linux kernel did not properly check permissions     when a key request was performed on a task's default keyring. A local attacker could use this to add keys     to unauthorized keyrings. (CVE-2017-17807)

    Alexei Starovoitov discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel     contained a branch-pruning logic issue around unreachable code. A local attacker could use this to cause a     denial of service. (CVE-2017-17862)

    It was discovered that the parallel cryptography component of the Linux kernel incorrectly freed kernel     memory. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18075)

    It was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A     local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)

    It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

    It was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel     in certain circumstances. A local attacker could use this to cause a denial of service (system hang).
    (CVE-2017-18208)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly     validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of     service (interface unavailability). (CVE-2018-1000026)

    It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an     out-of-bounds write during RDMA page allocation. An attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-5332)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927)

    It was discovered that a NULL pointer dereference existed in the RDS (Reliable Datagram Sockets) protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-7492)

    It was discovered that the Broadcom UniMAC MDIO bus controller driver in the Linux kernel did not properly     validate device resources. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2018-8043)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-1 advisory.

    Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel improperly     performed sign extension in some situations. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16995)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15129)

    It was discovered that the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel     contained a use-after-free when handling device removal. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16528)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly     handle detach events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16646)

    Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors.
    A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16649)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb     ranges. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-16994)

    It was discovered that the netfilter component of the Linux did not properly restrict access to the     connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
    (CVE-2017-17448)

    It was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of     netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive     information (kernel netlink traffic). (CVE-2017-17449)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read     when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
    (CVE-2017-17741)

    It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not     properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-17805)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    It was discovered that the keyring implementation in the Linux kernel did not properly check permissions     when a key request was performed on a task's default keyring. A local attacker could use this to add keys     to unauthorized keyrings. (CVE-2017-17807)

    Alexei Starovoitov discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel     contained a branch-pruning logic issue around unreachable code. A local attacker could use this to cause a     denial of service. (CVE-2017-17862)

    It was discovered that the parallel cryptography component of the Linux kernel incorrectly freed kernel     memory. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18075)

    It was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A     local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)

    It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

    It was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel     in certain circumstances. A local attacker could use this to cause a denial of service (system hang).
    (CVE-2017-18208)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly     validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of     service (interface unavailability). (CVE-2018-1000026)

    It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an     out-of-bounds write during RDMA page allocation. An attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-5332)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927)

    It was discovered that a NULL pointer dereference existed in the RDS (Reliable Datagram Sockets) protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-7492)

    It was discovered that the Broadcom UniMAC MDIO bus controller driver in the Linux kernel did not properly     validate device resources. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2018-8043)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
244274	Linux Distros Unpatched Vulnerability : CVE-2017-18075	Nessus	Misc.	high
124806	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1482)	Nessus	Huawei Local Security Checks	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	high
108878	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3619-2)	Nessus	Ubuntu Local Security Checks	high
108842	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3619-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2017-18075

high

Tenable Plugins

high

high

high

high

high