The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to cause a denial of service (deadlock) via DIO requests.

The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).

CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).

CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed :

CVE-2020-25705: A flaw in the way reply ICMP packets are limited in was found that allowed to quickly scan open UDP ports. This flaw allowed an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentiality and possibly integrity, because software and services that rely on UDP source port randomization (like DNS) are indirectly affected as well. Kernel versions may be vulnerable to this issue (bsc#1175721, bsc#1178782).

CVE-2020-25668: Fixed a use-after-free in con_font_op() (bsc#1178123).

CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).

CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).

CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).

CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka 'BleedingTooth' (bsc#1177725).

CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).

CVE-2020-14381: Fixed a use-after-free in the fast user mutex (futex) wait operation, which could have lead to memory corruption and possibly privilege escalation (bsc#1176011).

CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).

CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).

CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).

CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).

CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).

CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).

CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).

CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).

CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).

CVE-2019-19063: Fixed two memory leaks in the rtl_usb_probe() function in drivers/net/wireless/realtek/rtlwifi/usb.c, which could have allowed an attacker to cause a denial of service (memory consumption) (bsc#1157298).

CVE-2019-6133: In PolicyKit (aka polkit), the 'start time' protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c (bsc#1121872).

CVE-2017-18204: Fixed a denial of service in the ocfs2_setattr function of fs/ocfs2/file.c (bnc#1083244).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The hid_input_field() function in     'drivers/hid/hid-core.c' in the Linux kernel before 4.6     allows physically proximate attackers to obtain     sensitive information from kernel memory or cause a     denial of service (out-of-bounds read) by connecting a     device.(CVE-2016-7915i1/4%0

  - The Linux kernel, before version 4.14.2, is vulnerable     to a deadlock caused by     fs/ocfs2/file.c:ocfs2_setattr(), as the function does     not wait for DIO requests before locking the inode.
    This can be exploited by local users to cause a     subsequent denial of service.(CVE-2017-18204i1/4%0

  - The vmw_gb_surface_define_ioctl function (accessible     via DRM_IOCTL_VMW_GB_SURFACE_CREATE) in     drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux     kernel through 4.11.4 defines a backup_handle variable     but does not give it an initial value. If one attempts     to create a GB surface, with a previously allocated DMA     buffer to be used as a backup buffer, the backup_handle     variable does not get written to and is then later     returned to user space, allowing local users to obtain     sensitive information from uninitialized kernel memory     via a crafted ioctl call.(CVE-2017-9605i1/4%0

  - Use-after-free vulnerability in the nfqnl_zcopy     function in net/netfilter/nfnetlink_queue_core.c in the     Linux kernel through 3.13.6 allows attackers to obtain     sensitive information from kernel memory by leveraging     the absence of a certain orphaning operation. NOTE: the     affected code was moved to the skb_zerocopy function in     net/core/skbuff.c before the vulnerability was     announced.(CVE-2014-2568i1/4%0

  - It was found that the Linux kernel's ISO file system     implementation did not correctly limit the traversal of     Rock Ridge extension Continuation Entries (CE). An     attacker with physical access to the system could use     this flaw to trigger an infinite loop in the kernel,     resulting in a denial of service.(CVE-2014-9420i1/4%0

  - An integer overflow vulnerability was found in the     ring_buffer_resize() calculations in which a privileged     user can adjust the size of the ringbuffer message     size. These calculations can create an issue where the     kernel memory allocator will not allocate the correct     count of pages yet expect them to be usable. This can     lead to the ftrace() output to appear to corrupt kernel     memory and possibly be used for privileged escalation     or more likely kernel panic.(CVE-2016-9754i1/4%0

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9730i1/4%0

  - In was found that in the Linux kernel, in     vmw_surface_define_ioctl() function in     'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file, a     'num_sizes' parameter is assigned a user-controlled     value which is not checked if it is zero. This is used     in a call to kmalloc() and later leads to dereferencing     ZERO_SIZE_PTR, which in turn leads to a GPF and     possibly to a kernel panic.(CVE-2017-7261i1/4%0

  - A race condition flaw was found in the way the Linux     kernel keys management subsystem performed key garbage     collection. A local attacker could attempt accessing a     key while it was being garbage collected, which would     cause the system to crash.(CVE-2014-9529i1/4%0

  - A flaw was found in the Linux kernel's implementation     of i8042 serial ports. An attacker could cause a kernel     panic if they are able to add and remove devices as the     module is loaded.(CVE-2017-18079i1/4%0

  - drivers/hid/hid-pl.c in the Human Interface Device     (HID) subsystem in the Linux kernel through 3.11, when     CONFIG_HID_PANTHERLORD is enabled, allows physically     proximate attackers to cause a denial of service     (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2892i1/4%0

  - The __clear_user function in     arch/arm64/lib/clear_user.S in the Linux kernel before     3.17.4 on the ARM64 platform allows local users to     cause a denial of service (system crash) by reading one     byte beyond a /dev/zero page boundary.(CVE-2014-7843i1/4%0

  - A divide-by-zero vulnerability was found in a way the     kernel processes TCP connections. The error can occur     if a connection starts another cwnd reduction phase by     setting tp-i1/4zprior_cwnd to the current cwnd (0) in     tcp_init_cwnd_reduction(). A remote, unauthenticated     attacker could use this flaw to crash the kernel     (denial of service).(CVE-2016-2070i1/4%0

  - The adjust_branches function in kernel/bpf/verifier.c     in the Linux kernel before 4.5 does not consider the     delta in the backward-jump case, which allows local     users to obtain sensitive information from kernel     memory by creating a packet filter and then loading     crafted BPF instructions.(CVE-2016-2383i1/4%0

  - System using the infiniband support module ib_srpt were     vulnerable to a denial of service by system crash by a     local attacker who is able to abort writes to a device     using this initiator.(CVE-2016-6327i1/4%0

  - A security flaw was found in the Linux kernel in the     mark_source_chains() function in     'net/ipv4/netfilter/ip_tables.c'. It is possible for a     user-supplied 'ipt_entry' structure to have a large     'next_offset' field. This field is not bounds checked     prior to writing to a counter value at the supplied     offset.(CVE-2016-3134i1/4%0

  - An out-of-bounds access issue was discovered in     yurex_read() in drivers/usb/misc/yurex.c in the Linux     kernel. A local attacker could use user access     read/writes with incorrect bounds checking in the yurex     USB driver to crash the kernel or potentially escalate     privileges.(CVE-2018-16276i1/4%0

  - drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux     kernel before 4.5.3 allows local users to cause a     denial of service (kernel memory write operation) or     possibly have unspecified other impact via a crafted     number of planes in a VIDIOC_DQBUF ioctl     call.(CVE-2016-4568i1/4%0

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525i1/4%0

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4532 advisory.

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.15.15 does not always     initialize the crc32c checksum driver, which allows attackers to cause a denial of service     (ext4_xattr_inode_hash NULL pointer dereference and system crash) via a crafted ext4 image.
    (CVE-2018-1094)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc     rb_trees when reloc control has not been initialized. (CVE-2018-14609)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3655-1 advisory.

  - The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users     to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial     of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.
    (CVE-2017-12134)

  - An elevation of privilege vulnerability in the Upstream kernel bluez. Product: Android. Versions: Android     kernel. Android ID: A-63527053. (CVE-2017-13220)

  - A information disclosure vulnerability in the Upstream kernel encrypted-keys. Product: Android. Versions:
    Android kernel. Android ID: A-70526974. (CVE-2017-13305)

  - The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4,     when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink activity on the system. (CVE-2017-17449)

  - drivers/input/serio/i8042.c in the Linux kernel before 4.12.4 allows attackers to cause a denial of     service (NULL pointer dereference and system crash) or possibly have unspecified other impact because the     port->exists value can change after it is validated. (CVE-2017-18079)

  - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to     cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and     removal of DM devices. (CVE-2017-18203)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to     cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - The __munlock_pagevec function in mm/mlock.c in the Linux kernel before 4.11.4 allows local users to cause     a denial of service (NR_MLOCK accounting corruption) via crafted use of mlockall and munlockall system     calls. (CVE-2017-18221)

  - Systems with microprocessors utilizing speculative execution and speculative execution of memory reads     before the addresses of all prior memory writes are known may allow unauthorized disclosure of information     to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB),     Variant 4. (CVE-2018-3639)

  - Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c in the Linux     kernel through 4.15.11, and in drivers/staging/ncpfs/ncplib_kernel.c in the Linux kernel 4.16-rc through     4.16-rc6, could be exploited by malicious NCPFS servers to crash the kernel or execute code.
    (CVE-2018-8822)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-2 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16528)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to     cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging     incorrect sign extension. (CVE-2017-16995)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4,     when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink activity on the system. (CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service. (CVE-2017-17862)

  - crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted sequence of system calls. (CVE-2017-18075)

  - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to     cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and     removal of DM devices. (CVE-2017-18203)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to     cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

  - The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to     cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a     negative wake or requeue value. (CVE-2018-6927)

  - A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel     before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST. (CVE-2018-7492)

  - The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8     does not validate certain resource availability, which allows local users to cause a denial of service     (NULL pointer dereference). (CVE-2018-8043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-1 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel before 4.12 does not     flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-11472)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - sound/core/seq_device.c in the Linux kernel before 4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16528)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (NULL pointer dereference and system crash) or     possibly have unspecified other impact via a crafted USB device. (CVE-2017-16536)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to     disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
    (CVE-2017-16911)

  - The get_pipe() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71,     and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB     over IP packet. (CVE-2017-16912)

  - The stub_recv_cmd_submit() function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version     4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted USB over IP packet. (CVE-2017-16913)

  - The stub_send_ret_submit() function (drivers/usb/usbip/stub_tx.c) in the Linux Kernel before version     4.14.8, 4.9.71, 4.1.49, and 4.4.107 allows attackers to cause a denial of service (NULL pointer     dereference) via a specially crafted USB over IP packet. (CVE-2017-16914)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to     cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging     incorrect sign extension. (CVE-2017-16995)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4,     when CONFIG_NLMON is enabled, does not restrict observations of Netlink messages to a single net     namespace, which allows local users to obtain sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink activity on the system. (CVE-2017-17449)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux     kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before     attempting to release resources, which allows local users to cause a denial of service (out-of-bounds     write access) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-17558)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service. (CVE-2017-17862)

  - crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user     able to access the AF_ALG-based AEAD interface (CONFIG_CRYPTO_USER_API_AEAD) and pcrypt     (CONFIG_CRYPTO_PCRYPT) to cause a denial of service (kfree of an incorrect pointer) or possibly have     unspecified other impact by executing a crafted sequence of system calls. (CVE-2017-18075)

  - The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to     cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and     removal of DM devices. (CVE-2017-18203)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - The madvise_willneed function in mm/madvise.c in the Linux kernel before 4.14.4 allows local users to     cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap     flag(TF) bit in EFLAGS during emulation of the syscall instruction, which leads to a debug exception(#DB)     being raised in the guest stack. A user/process inside a guest could use this flaw to potentially escalate     their privileges inside the guest. Linux guests are not affected by this. (CVE-2017-7518)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

  - The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to     cause a denial of service (integer overflow) or possibly have unspecified other impact by triggering a     negative wake or requeue value. (CVE-2018-6927)

  - A NULL pointer dereference was found in the net/rds/rdma.c __rds_rdma_map() function in the Linux kernel     before 4.14.7 allowing local attackers to cause a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST. (CVE-2018-7492)

  - The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c in the Linux kernel through 4.15.8     does not validate certain resource availability, which allows local users to cause a denial of service     (NULL pointer dereference). (CVE-2018-8043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15129)

Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532)

Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537)

Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16645)

Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly handle detach events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16646)

Andrey Konovalov discovered that the ASIX Ethernet USB driver in the Linux kernel did not properly handle suspend and resume events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16647)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16649)

Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16650)

It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb ranges. A local attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-16994)

It was discovered that the netfilter component of the Linux did not properly restrict access to the connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
(CVE-2017-17448)

It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform access control checks. A local attacker could improperly modify the system-wide OS fingerprint list. (CVE-2017-17450)

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
(CVE-2017-17741)

It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-17805)

It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17806)

It was discovered that the keyring implementation in the Linux kernel did not properly check permissions when a key request was performed on a tasks' default keyring. A local attacker could use this to add keys to unauthorized keyrings. (CVE-2017-17807)

It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of service (interface unavailability). (CVE-2018-1000026)

It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an out-of-bounds during RDMA page allocation. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-5332)

Mohamed Ghannam discovered a NULL pointer dereference in the RDS (Reliable Datagram Sockets) protocol implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5333)

Fan Long Fei  discovered that a race condition existed in loop block device implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5344).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3617-2 advisory.

  - Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows     attackers to gain privileges via unspecified vectors. (CVE-2017-0861)

  - The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port     0x80 an exception can be triggered leading to a kernel panic. (CVE-2017-1000407)

  - A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before     4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count     value after it has found a peer network in netns_ids idr, which could lead to double free and memory     corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption     on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely. (CVE-2017-15129)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - The imon_probe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users     to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16537)

  - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact via a crafted USB device. (CVE-2017-16645)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - drivers/net/usb/asix_devices.c in the Linux kernel through 4.13.11 allows local users to cause a denial of     service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16647)

  - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11     allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16649)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

  - The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel before 4.14.2 mishandles holes in     hugetlb ranges, which allows local users to obtain sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call. (CVE-2017-16994)

  - net/netfilter/nfnetlink_cthelper.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN     capability for new, get, and del operations, which allows local users to bypass intended access     restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.
    (CVE-2017-17448)

  - net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations, which allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure is shared across all net namespaces.
    (CVE-2017-17450)

  - The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and include/trace/events/kvm.h. (CVE-2017-17741)

  - The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel     crash) or have unspecified other impact by executing a crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. (CVE-2017-17805)

  - The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the     underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based     hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a     kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing     SHA-3 initialization. (CVE-2017-17806)

  - The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to     the current task's default request-key keyring via the request_key() system call, allowing a local user     to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write     permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c.
    (CVE-2017-17807)

  - The ocfs2_setattr function in fs/ocfs2/file.c in the Linux kernel before 4.14.2 allows local users to     cause a denial of service (deadlock) via DIO requests. (CVE-2017-18204)

  - Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input     validation vulnerability in bnx2x network card driver that can result in DoS: Network card firmware     assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very     large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM..
    (CVE-2018-1000026)

  - In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is     used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c). (CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where     page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer     dereference. (CVE-2018-5333)

  - In the Linux kernel through 4.14.13, drivers/block/loop.c mishandles lo_release serialization, which     allows attackers to cause a denial of service (__lock_acquire use-after-free) or possibly have unspecified     other impact. (CVE-2018-5344)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0861)

It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the host OS. (CVE-2017-1000407)

It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15129)

Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16532)

Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly validate device metadata. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16537)

Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16645)

Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly handle detach events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16646)

Andrey Konovalov discovered that the ASIX Ethernet USB driver in the Linux kernel did not properly handle suspend and resume events. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16647)

Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16649)

Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16650)

It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb ranges. A local attacker could use this to expose sensitive information (kernel memory).
(CVE-2017-16994)

It was discovered that the netfilter component of the Linux did not properly restrict access to the connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
(CVE-2017-17448)

It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform access control checks. A local attacker could improperly modify the system-wide OS fingerprint list. (CVE-2017-17450)

Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
(CVE-2017-17741)

It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-17805)

It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17806)

It was discovered that the keyring implementation in the Linux kernel did not properly check permissions when a key request was performed on a tasks' default keyring. A local attacker could use this to add keys to unauthorized keyrings. (CVE-2017-17807)

It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of service (interface unavailability). (CVE-2018-1000026)

It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an out-of-bounds during RDMA page allocation. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2018-5332)

Mohamed Ghannam discovered a NULL pointer dereference in the RDS (Reliable Datagram Sockets) protocol implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5333)

Fan Long Fei  discovered that a race condition existed in loop block device implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5344).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1068: Fixed flaw in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2017-18221: The __munlock_pagevec function allowed     local users to cause a denial of service (NR_MLOCK     accounting corruption) via crafted use of mlockall and     munlockall system calls (bnc#1084323).

  - CVE-2018-1066: Prevent NULL pointer dereference in     fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an     attacker controlling a CIFS server to kernel panic a     client that has this server mounted, because an empty     TargetInfo field in an NTLMSSP setup negotiation     response was mishandled during session recovery     (bnc#1083640).

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the kernel v4l2 video driver     (bnc#1072865).

  - CVE-2017-16911: The vhci_hcd driver allowed local     attackers to disclose kernel memory addresses.
    Successful exploitation required that a USB device was     attached over IP (bnc#1078674).

  - CVE-2017-15299: The KEYS subsystem mishandled use of     add_key for a key that already exists but is     uninstantiated, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted system call (bnc#1063416).

  - CVE-2017-18208: The madvise_willneed function kernel     allowed local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping (bnc#1083494).

  - CVE-2018-7566: The ALSA sequencer core initializes the     event pool on demand by invoking snd_seq_pool_init()     when the first write happens and the pool is empty. A     user could have reset the pool size manually via ioctl     concurrently, which may have lead UAF or out-of-bound     access (bsc#1083483).

  - CVE-2017-18204: The ocfs2_setattr function allowed local     users to cause a denial of service (deadlock) via DIO     requests (bnc#1083244).

  - CVE-2017-16644: The hdpvr_probe function allowed local     users to cause a denial of service (improper error     handling and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function allowed     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact by     triggering a negative wake or requeue value     (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     allowed attackers to cause a denial of service (NULL     pointer dereference) via a specially crafted USB over IP     packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function allowed     physically proximate attackers to obtain sensitive     information from kernel memory or cause a denial of     service (out-of-bounds read) by connecting a device     (bnc#1010470).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions did unbalanced refcounting when a SCSI I/O     vector had small consecutive buffers belonging to the     same page. The bio_add_pc_page function merged them into     one, but the page reference was never dropped. This     caused a memory leak and possible system lockup     (exploitable against the host OS by a guest OS user, if     a SCSI disk is passed through to a virtual machine) due     to an out-of-memory condition (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function allowed     attackers to cause a denial of service (out-of-bounds     read) via a specially crafted USB over IP packet     (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     when handling CMD_SUBMIT packets allowed attackers to     cause a denial of service (arbitrary memory allocation)     via a specially crafted USB over IP packet     (bnc#1078672).

  - CVE-2018-5332: The rds_message_alloc_sgs() function did     not validate a value that is used during DMA page     allocation, leading to a heap-based out-of-bounds write     (related to the rds_rdma_extra_size function in     net/rds/rdma.c) (bnc#1075621).

  - CVE-2018-5333: The rds_cmsg_atomic function in     net/rds/rdma.c mishandled cases where page pinning fails     or an invalid address is supplied, leading to an     rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function     allowed remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1068: Fixed flaw in the implementation of     32-bit syscall interface for bridging. This allowed a     privileged user to arbitrarily write to a limited range     of kernel memory (bnc#1085107).

  - CVE-2017-18221: The __munlock_pagevec function allowed     local users to cause a denial of service (NR_MLOCK     accounting corruption) via crafted use of mlockall and     munlockall system calls (bnc#1084323).

  - CVE-2018-1066: Prevent NULL pointer dereference in     fs/cifs/cifsencrypt.c:setup_ntlmv2_rsp() that allowed an     attacker controlling a CIFS server to kernel panic a     client that has this server mounted, because an empty     TargetInfo field in an NTLMSSP setup negotiation     response was mishandled during session recovery     (bnc#1083640).

  - CVE-2017-13166: Prevent elevation of privilege     vulnerability in the kernel v4l2 video driver     (bnc#1072865).

  - CVE-2017-16911: The vhci_hcd driver allowed local     attackers to disclose kernel memory addresses.
    Successful exploitation required that a USB device was     attached over IP (bnc#1078674).

  - CVE-2017-15299: The KEYS subsystem mishandled use of     add_key for a key that already exists but is     uninstantiated, which allowed local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted system call (bnc#1063416).

  - CVE-2017-18208: The madvise_willneed function kernel     allowed local users to cause a denial of service     (infinite loop) by triggering use of MADVISE_WILLNEED     for a DAX mapping (bnc#1083494).

  - CVE-2018-7566: The ALSA sequencer core initializes the     event pool on demand by invoking snd_seq_pool_init()     when the first write happens and the pool is empty. A     user could have reset the pool size manually via ioctl     concurrently, which may have lead UAF or out-of-bound     access (bsc#1083483).

  - CVE-2017-18204: The ocfs2_setattr function allowed local     users to cause a denial of service (deadlock) via DIO     requests (bnc#1083244).

  - CVE-2017-16644: The hdpvr_probe function allowed local     users to cause a denial of service (improper error     handling and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function allowed     attackers to cause a denial of service (integer     overflow) or possibly have unspecified other impact by     triggering a negative wake or requeue value     (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     allowed attackers to cause a denial of service (NULL     pointer dereference) via a specially crafted USB over IP     packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function allowed     physically proximate attackers to obtain sensitive     information from kernel memory or cause a denial of     service (out-of-bounds read) by connecting a device     (bnc#1010470).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions did unbalanced refcounting when a SCSI I/O     vector had small consecutive buffers belonging to the     same page. The bio_add_pc_page function merged them into     one, but the page reference was never dropped. This     caused a memory leak and possible system lockup     (exploitable against the host OS by a guest OS user, if     a SCSI disk is passed through to a virtual machine) due     to an out-of-memory condition (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function allowed     attackers to cause a denial of service (out-of-bounds     read) via a specially crafted USB over IP packet     (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     when handling CMD_SUBMIT packets allowed attackers to     cause a denial of service (arbitrary memory allocation)     via a specially crafted USB over IP packet     (bnc#1078672).

  - CVE-2018-5332: The rds_message_alloc_sgs() function did     not validate a value that is used during DMA page     allocation, leading to a heap-based out-of-bounds write     (related to the rds_rdma_extra_size function in     net/rds/rdma.c) (bnc#1075621).

  - CVE-2018-5333: The rds_cmsg_atomic function in     net/rds/rdma.c mishandled cases where page pinning fails     or an invalid address is supplied, leading to an     rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2017-18017: The tcpmss_mangle_packet function     allowed remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
143654	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3501-1)	Nessus	SuSE Local Security Checks	high
143639	SUSE SLES12 Security Update : kernel (SUSE-SU-2020:3503-1)	Nessus	SuSE Local Security Checks	high
124796	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1472)	Nessus	Huawei Local Security Checks	high
122044	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4532)	Nessus	Oracle Linux Local Security Checks	medium
110050	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3655-1)	Nessus	Ubuntu Local Security Checks	high
108878	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3619-2)	Nessus	Ubuntu Local Security Checks	high
108842	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3619-1)	Nessus	Ubuntu Local Security Checks	high
108840	Ubuntu 17.10 : linux-raspi2 vulnerabilities (USN-3617-3)	Nessus	Ubuntu Local Security Checks	high
108835	Ubuntu 16.04 LTS : Linux (HWE) vulnerabilities (USN-3617-2)	Nessus	Ubuntu Local Security Checks	high
108834	Ubuntu 17.10 : linux vulnerabilities (USN-3617-1)	Nessus	Ubuntu Local Security Checks	high
108748	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0848-1)	Nessus	SuSE Local Security Checks	critical
108705	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0834-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-18204

medium

Tenable Plugins

high

high

high

medium

high

high

high

high

high

high

critical

critical