A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2     Voice Service driver for the Linux kernel 3.x, as used     in Qualcomm Innovation Center (QuIC) Android     contributions for MSM devices and other products,     allows attackers to cause a denial of service (memory     corruption) or possibly have unspecified other impact     via a write request, as demonstrated by a     voice_svc_send_req buffer overflow.(CVE-2016-5343i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled user controls. A local,     privileged user could use this flaw to crash the     system.(CVE-2014-4655i1/4%0

  - Race condition in the handle_to_path function in     fs/fhandle.c in the Linux kernel through 3.19.1 allows     local users to bypass intended size restrictions and     trigger read operations on additional memory locations     by changing the handle_bytes value of a file handle     during the execution of this function.(CVE-2015-1420i1/4%0

  - A flaw was found in the way the Linux kernel's keys     subsystem handled the termination condition in the     associative array garbage collection functionality. A     local, unprivileged user could use this flaw to crash     the system.(CVE-2014-3631i1/4%0

  - A flaw was found in the ext4 subsystem. This     vulnerability is a use after free vulnerability was     found in __ext4_journal_stop(). Attackers could abuse     this to allow any code which attempts to deal with the     journal failure to be mishandled or not fail at all.
    This could lead to data corruption or     crashes.(CVE-2015-8961i1/4%0

  - Buffer overflow in the oz_cdev_write function in     drivers/staging/ozwpan/ozcdev.c in the Linux kernel     before 3.12 allows local users to cause a denial of     service or possibly have unspecified other impact via a     crafted write operation.(CVE-2013-4513i1/4%0

  - The nfnetlink_rcv_batch() function in     'net/netfilter/nfnetlink.c' in the Linux kernel before     4.5 does not check whether a batch message's length     field is large enough, which allows local users to     obtain sensitive information from kernel memory or     cause a denial of service (infinite loop or     out-of-bounds read) by leveraging the CAP_NET_ADMIN     capability.(CVE-2016-7917i1/4%0

  - Array index error in the kvm_vm_ioctl_create_vcpu     function in virt/kvm/kvm_main.c in the KVM subsystem in     the Linux kernel through 3.12.5 allows local users to     gain privileges via a large id value.(CVE-2013-4587i1/4%0

  - A leak of information was possible when issuing a     netlink command of the stack memory area leading up to     this function call. An attacker could use this to     determine stack information for use in a later     exploit.(CVE-2016-5243i1/4%0

  - An issue was discovered in the Linux kernel in the F2FS     filesystem code. A NULL pointer dereference in     fscrypt_do_page_crypto() in the fs/crypto/crypto.c     function can occur when operating on a file on a     corrupted f2fs image.(CVE-2018-14616i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the sco_sock_bind() function (bluetooth/sco) did not     check the length of its sockaddr parameter. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8575i1/4%0

  - A denial of service vulnerability was found in the     WhiteHEAT USB Serial Driver (whiteheat_attach function     in drivers/usb/serial/whiteheat.c). In the driver, the     COMMAND_PORT variable was hard coded and set to 4 (5th     element). The driver assumed that the number of ports     would always be 5 and used port number 5 as the command     port. However, when using a USB device in which the     number of ports was set to a number less than 5 (for     example, 3), the driver triggered a kernel NULL-pointer     dereference. A non-privileged attacker could use this     flaw to panic the host.(CVE-2015-5257i1/4%0

  - The LLC subsystem in the Linux kernel does not ensure     that a certain destructor exists in required     circumstances, which allows local users to cause a     denial of service (BUG_ON) or possibly have unspecified     other impact via crafted system calls.(CVE-2017-6345i1/4%0

  - A vulnerability was found in Linux kernel. There is an     information leak in file sound/core/timer.c of the     latest mainline Linux kernel. The stack object aEURoer1aEUR     has a total size of 32 bytes. Its field aEURoeeventaEUR and     aEURoevalaEUR both contain 4 bytes padding. These 8 bytes     padding bytes are sent to user without being     initialized.(CVE-2016-4578i1/4%0

  - An information leak flaw was found in the way the Linux     kernel changed certain segment registers and     thread-local storage (TLS) during a context switch. A     local, unprivileged user could use this flaw to leak     the user space TLS base address of an arbitrary     process.(CVE-2014-9419i1/4%0

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364i1/4%0

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory.(CVE-2017-2618i1/4%0

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794i1/4%0

  - A flaw was found in the way the Linux kernel's floppy     driver handled user space provided data in certain     error code paths while processing FDRAWCMD IOCTL     commands. A local user with write access to /dev/fdX     could use this flaw to free (using the kfree()     function) arbitrary kernel memory. (CVE-2014-1737,     Important)t was found that the Linux kernel's floppy     driver leaked internal kernel memory addresses to user     space during the processing of the FDRAWCMD IOCTL     command. A local user with write access to /dev/fdX     could use this flaw to obtain information about the     kernel heap arrangement. (CVE-2014-1738, Low)Note: A     local user with write access to /dev/fdX could use     these two flaws (CVE-2014-1737 in combination with     CVE-2014-1738) to escalate their privileges on the     system.(CVE-2014-1737i1/4%0

  - An out-of-bounds memory access flaw was found in the     Linux kernel's aiptek USB tablet driver (aiptek_probe()     function in drivers/input/tablet/aiptek.c). The driver     assumed that the interface always had at least one     endpoint. By using a specially crafted USB device with     no endpoints on one of its interfaces, an unprivileged     user with physical access to the system could trigger a     kernel NULL pointer dereference, causing the system to     panic.(CVE-2015-7515i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4071 advisory.

  - The x86/fpu (Floating Point Unit) subsystem in the Linux kernel before 4.13.5, when a processor supports     the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in     the xstate header via the ptrace() or rt_sigreturn() system call, allowing local users to read the FPU     registers of other processes on the system, related to arch/x86/kernel/fpu/regset.c and     arch/x86/kernel/fpu/signal.c. (CVE-2017-15537)

  - drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel through 4.13.11 allows local users to     cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted     USB device. (CVE-2017-16646)

  - The get_endpoints function in drivers/usb/misc/usbtest.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (NULL pointer dereference and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16532)

  - A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This     allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0174 for details.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-3659 advisory.

  - A missing authorization check in the fscrypt_process_policy function in fs/crypto/policy.c in the ext4 and     f2fs filesystem encryption support in the Linux kernel before 4.7.4 allows a user to assign an encryption     policy to a directory owned by a different user, potentially creating a denial of service.
    (CVE-2016-10318)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - mm, thp: Do not make page table dirty unconditionally in     follow_trans_huge_pmd (Kirill A. Shutemov) [Orabug:
    27200879] (CVE-2017-1000405)

  - NFS: Add static NFS I/O tracepoints (Chuck Lever)

  - storvsc: don't assume SG list is contiguous (Aruna     Ramakrishna) 

  - fix unbalanced page refcounting in bio_map_user_iov     (Vitaly Mayatskikh) [Orabug: 27069038] (CVE-2017-12190)

  - more bio_map_user_iov leak fixes (Al Viro) [Orabug:
    27069038] (CVE-2017-12190)

  - packet: in packet_do_bind, test fanout with bind_lock     held (Willem de Bruijn) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: hold bind lock when rebinding to fanout hook     (Willem de Bruijn) [Orabug: 27069065] (CVE-2017-15649)

  - net: convert packet_fanout.sk_ref from atomic_t to     refcount_t (Reshetova, Elena) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: fix races in fanout_add (Eric Dumazet) [Orabug:
    27069065] (CVE-2017-15649)

  - refcount_t: Introduce a special purpose refcount type     (Peter Zijlstra) [Orabug: 27069065] (CVE-2017-15649)

  - locking/atomics: Add _[acquire|release|relaxed] variants     of some atomic operations (Will Deacon) [Orabug:
    27069065] (CVE-2017-15649)

  - net: qmi_wwan: fix divide by 0 on bad descriptors     (Bj&oslash rn Mork) [Orabug: 27215225] (CVE-2017-16650)

  - ALSA: usb-audio: Kill stray URB at exiting (Takashi     Iwai) [Orabug: 27148276] (CVE-2017-16527)

  - scsi: Add STARGET_CREATED_REMOVE state to     scsi_target_state (Ewan D. Milne) [Orabug: 27187217]

  - ocfs2: fix posix_acl_create deadlock (Junxiao Bi)     [Orabug: 27126129]

  - scsi: Don't abort scsi_scan due to unexpected response     (John Sobecki) 

  - ocfs2: code clean up for direct io (Ryan Ding)

  - xscore: add dma address check (Zhu Yanjun) [Orabug:
    27076919]

  - KVM: nVMX: Fix loss of L2's NMI blocking state (Wanpeng     Li) [Orabug: 27062498]

  - KVM: nVMX: track NMI blocking state separately for each     VMCS (Paolo Bonzini) [Orabug: 27062498]

  - KVM: VMX: require virtual NMI support (Paolo Bonzini)     [Orabug: 27062498]

  - KVM: nVMX: Fix the NMI IDT-vectoring handling (Wanpeng     Li) [Orabug: 27062498]

  - uek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED     (Fred Herard) 

  - thp: run vma_adjust_trans_huge outside i_mmap_rwsem     (Kirill A. Shutemov) [Orabug: 27026180]

  - selinux: fix off-by-one in setprocattr (Stephen Smalley)     [Orabug: 27001717] (CVE-2017-2618) (CVE-2017-2618)     (CVE-2017-2618)

  - sysctl: Drop reference added by grab_header in     proc_sys_readdir (Zhou Chengming) [Orabug: 27036903]     (CVE-2016-9191) (CVE-2016-9191) (CVE-2016-9191)

  - KEYS: prevent KEYCTL_READ on negative key (Eric Biggers)     [Orabug: 27050248] (CVE-2017-12192)

  - IB/ipoib: For sendonly join free the multicast group on     leave (Christoph Lameter) [Orabug: 27077718]

  - IB/ipoib: increase the max mcast backlog queue (Doug     Ledford) 

  - IB/ipoib: Make sendonly multicast joins create the mcast     group (Doug Ledford) [Orabug: 27077718]

  - IB/ipoib: Expire sendonly multicast joins (Christoph     Lameter) 

  - IB/ipoib: Suppress warning for send only join failures     (Jason Gunthorpe) [Orabug: 27077718]

  - IB/ipoib: Clean up send-only multicast joins (Doug     Ledford) [Orabug: 27077718]

  - netlink: allow to listen 'all' netns (Nicolas Dichtel)     [Orabug: 27077944]

  - netlink: rename private flags and states (Nicolas     Dichtel) [Orabug: 27077944]

  - netns: use a spin_lock to protect nsid management     (Nicolas Dichtel) 

  - netns: notify new nsid outside __peernet2id (Nicolas     Dichtel) 

  - netns: rename peernet2id to peernet2id_alloc (Nicolas     Dichtel) 

  - netns: always provide the id to rtnl_net_fill (Nicolas     Dichtel) 

  - netns: returns always an id in __peernet2id (Nicolas     Dichtel) 

  - Hang/soft lockup in d_invalidate with simultaneous calls     (Al Viro) 

  - Revert 'drivers/char/mem.c: deny access in open     operation when securelevel is set' (Brian Maly) [Orabug:
    27037811]

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3651 advisory.

  - The Linux Kernel versions 2.6.38 through 4.14 have a problematic use of pmd_mkdirty() in the touch_pmd()     function inside the THP implementation. touch_pmd() can be reached by get_user_pages(). In such case, the     pmd will become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd can become dirty     without going through a COW cycle. This bug is not as severe as the original Dirty cow because an ext4     file (or any other regular file) cannot be mapped using THP. Nevertheless, it does allow us to overwrite     read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since     their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it     will be replaced with a new fresh (and zeroed) thp. (CVE-2017-1000405)

  - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page.
    The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a     memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk     is passed through to a virtual machine) due to an out-of-memory condition. (CVE-2017-12190)

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8 allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a     crafted USB device. (CVE-2017-16527)

  - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local     users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified     other impact via a crafted USB device. (CVE-2017-16650)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - thp: run vma_adjust_trans_huge outside i_mmap_rwsem     (Kirill A. Shutemov) [Orabug: 27026180]

  - selinux: fix off-by-one in setprocattr (Stephen Smalley)     [Orabug: 27001717] (CVE-2017-2618) (CVE-2017-2618)     (CVE-2017-2618)

  - sysctl: Drop reference added by grab_header in     proc_sys_readdir (Zhou Chengming) [Orabug: 27036903]     (CVE-2016-9191) (CVE-2016-9191) (CVE-2016-9191)

  - KEYS: prevent KEYCTL_READ on negative key (Eric Biggers)     [Orabug: 27050248] (CVE-2017-12192)

  - IB/ipoib: For sendonly join free the multicast group on     leave (Christoph Lameter) [Orabug: 27077718]

  - IB/ipoib: increase the max mcast backlog queue (Doug     Ledford) 

  - IB/ipoib: Make sendonly multicast joins create the mcast     group (Doug Ledford) [Orabug: 27077718]

  - IB/ipoib: Expire sendonly multicast joins (Christoph     Lameter) 

  - IB/ipoib: Suppress warning for send only join failures     (Jason Gunthorpe) [Orabug: 27077718]

  - IB/ipoib: Clean up send-only multicast joins (Doug     Ledford) [Orabug: 27077718]

  - netlink: allow to listen 'all' netns (Nicolas Dichtel)     [Orabug: 27077944]

  - netlink: rename private flags and states (Nicolas     Dichtel) [Orabug: 27077944]

  - netns: use a spin_lock to protect nsid management     (Nicolas Dichtel) 

  - netns: notify new nsid outside __peernet2id (Nicolas     Dichtel) 

  - netns: rename peernet2id to peernet2id_alloc (Nicolas     Dichtel) 

  - netns: always provide the id to rtnl_net_fill (Nicolas     Dichtel) 

  - netns: returns always an id in __peernet2id (Nicolas     Dichtel) 

  - Hang/soft lockup in d_invalidate with simultaneous calls     (Al Viro)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3640 advisory.

  - A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files     before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to     access unmapped kernel memory. (CVE-2017-2618)

  - The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations,     which allows local users to cause a denial of service (system hang) by leveraging access to a container     environment for executing a crafted application, as demonstrated by trinity. (CVE-2016-9191)

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux host is missing a security update for the kernel package(s).

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3381-1 advisory.

  - An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB     driver and networking subsystem could enable a local malicious application to access data outside of its     permission levels. This issue is rated as Moderate because it first requires compromising a privileged     process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31651010. (CVE-2016-8405)

  - The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through     RLIMIT_STACK/RLIM_INFINITY (1/4 of the size), but does not take the argument and environment pointers into     account, which allows attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and     earlier. It appears that this feature was introduced in the Linux Kernel version 2.6.23.
    (CVE-2017-1000365)

  - A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files     before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to     access unmapped kernel memory. (CVE-2017-2618)

  - In the Linux kernel before version 4.12, Kerberos 5 tickets decoded when using the RXRPC keys incorrectly     assumes the size of a field. This could lead to the size-remaining variable wrapping and the data pointer     going over the end of the buffer. This could possibly lead to memory corruption and possible privilege     escalation. (CVE-2017-7482)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3361-1 advisory.

  - The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr     operations that underspecifies removing extended privilege attributes, which allows local users to cause a     denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by     using chown to remove a capability from the ping or Wireshark dumpcap program. (CVE-2015-1350)

  - The ext4_fill_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly     validate meta block groups, which allows physically proximate attackers to cause a denial of service (out-     of-bounds read and system crash) via a crafted ext4 image. (CVE-2016-10208)

  - An information disclosure vulnerability in kernel components including the ION subsystem, Binder, USB     driver and networking subsystem could enable a local malicious application to access data outside of its     permission levels. This issue is rated as Moderate because it first requires compromising a privileged     process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31651010. (CVE-2016-8405)

  - Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel     before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive     information from kernel memory, or possibly have unspecified other impact via a write or read request     involving the RDMA protocol over infiniband (aka Soft RoCE) technology. (CVE-2016-8636)

  - drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer     overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by     leveraging access to a vfio PCI device file for a VFIO_DEVICE_SET_IRQS ioctl call, aka a state machine     confusion bug. (CVE-2016-9083)

  - drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which     allows local users to cause a denial of service (integer overflow) or have unspecified other impact by     leveraging access to a vfio PCI device file. (CVE-2016-9084)

  - The cgroup offline implementation in the Linux kernel through 4.8.11 mishandles certain drain operations,     which allows local users to cause a denial of service (system hang) by leveraging access to a container     environment for executing a crafted application, as demonstrated by trinity. (CVE-2016-9191)

  - It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal     keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its     session keyring. This allows root to bypass module signature verification by adding a new public key of     its own devising to the keyring. (CVE-2016-9604)

  - The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local     users to cause a denial of service (integer overflow, out-of-bounds write, and GPF) or possibly have     unspecified other impact via a crafted application that makes socket, connect, and writev system calls,     related to net/ipv6/netfilter/nf_conntrack_reasm.c and net/ipv6/netfilter/nf_defrag_ipv6_hooks.c.
    (CVE-2016-9755)

  - The load_segment_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5     improperly emulates a MOV SS, NULL selector instruction, which allows guest OS users to cause a denial     of service (guest OS crash) or gain guest OS privileges via a crafted application. (CVE-2017-2583)

  - arch/x86/kvm/emulate.c in the Linux kernel through 4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of service (use-after-free) via a crafted application     that leverages instruction emulation for fxrstor, fxsave, sgdt, and sidt. (CVE-2017-2584)

  - The nested_vmx_check_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly     emulates the VMXON instruction, which allows KVM L1 guest OS users to cause a denial of service (host OS     memory consumption) by leveraging the mishandling of page references. (CVE-2017-2596)

  - A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files     before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to     access unmapped kernel memory. (CVE-2017-2618)

  - The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a     certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local     users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a     socket system call. (CVE-2017-2671)

  - The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows     local users to cause a denial of service (duplicate freelist entries and system crash) or possibly have     unspecified other impact in opportunistic circumstances by leveraging the selection of a large value for a     random number. (CVE-2017-5546)

  - The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5     places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which     allows local users to obtain sensitive information by reading the log. (CVE-2017-5549)

  - Off-by-one error in the pipe_advance function in lib/iov_iter.c in the Linux kernel before 4.9.5 allows     local users to obtain sensitive information from uninitialized heap-memory locations in opportunistic     circumstances by reading from a pipe after an incorrect buffer-release decision. (CVE-2017-5550)

  - The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit     during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by     leveraging the existence of a setgid program with restrictions on execute permissions. NOTE: this     vulnerability exists because of an incomplete fix for CVE-2016-7097. (CVE-2017-5551)

  - Integer overflow in the vc4_get_bcl function in drivers/gpu/drm/vc4/vc4_gem.c in the VideoCore DRM driver     in the Linux kernel before 4.9.7 allows local users to cause a denial of service or possibly have     unspecified other impact via a crafted size value in a VC4_SUBMIT_CL ioctl call. (CVE-2017-5576)

  - The do_shmat function in ipc/shm.c in the Linux kernel through 4.9.12 does not restrict the address     calculated by a certain rounding operation, which allows local users to map page zero, and consequently     bypass a protection mechanism that exists for the mmap system call, by making crafted shmget and shmat     system calls in a privileged context. (CVE-2017-5669)

  - The ip6gre_err function in net/ipv6/ip6_gre.c in the Linux kernel allows remote attackers to have     unspecified impact via vectors involving GRE flags in an IPv6 packet, which trigger an out-of-bounds     access. (CVE-2017-5897)

  - The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in the Linux kernel through 4.9.9 allows     attackers to cause a denial of service (system crash) via (1) an application that makes crafted system     calls or possibly (2) IPv4 traffic with invalid IP options. (CVE-2017-5970)

  - Race condition in kernel/events/core.c in the Linux kernel before 4.9.7 allows local users to gain     privileges via a crafted application that makes concurrent perf_event_open system calls for moving a     software group into a hardware context. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2016-6786. (CVE-2017-6001)

  - The tcp_splice_read function in net/ipv4/tcp.c in the Linux kernel before 4.9.11 allows remote attackers     to cause a denial of service (infinite loop and soft lockup) via vectors involving a TCP packet with the     URG flag. (CVE-2017-6214)

  - The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in     required circumstances, which allows local users to cause a denial of service (BUG_ON) or possibly have     unspecified other impact via crafted system calls. (CVE-2017-6345)

  - Race condition in net/packet/af_packet.c in the Linux kernel before 4.9.13 allows local users to cause a     denial of service (use-after-free) or possibly have unspecified other impact via a multithreaded     application that makes PACKET_FANOUT setsockopt system calls. (CVE-2017-6346)

  - The ip_cmsg_recv_checksum function in net/ipv4/ip_sockglue.c in the Linux kernel before 4.10.1 has     incorrect expectations about skb data layout, which allows local users to cause a denial of service     (buffer over-read) or possibly have unspecified other impact via crafted system calls, as demonstrated by     use of the MSG_MORE flag in conjunction with loopback UDP transmission. (CVE-2017-6347)

  - The hashbin_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages     lock dropping, which allows local users to cause a denial of service (deadlock) via crafted operations on     IrDA devices. (CVE-2017-6348)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel through 4.10.4 allows local users to cause     a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a large     command size in an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds write access in the sg_write     function. (CVE-2017-7187)

  - The vmw_surface_define_ioctl function in drivers/gpu/drm/vmwgfx/vmwgfx_surface.c in the Linux kernel     through 4.10.5 does not check for a zero value of certain levels data, which allows local users to cause a     denial of service (ZERO_SIZE_PTR dereference, and GPF and possibly panic) via a crafted ioctl call for a     /dev/dri/renderD* device. (CVE-2017-7261)

  - The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4     allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have     unspecified other impact via a crafted HID report. (CVE-2017-7273)

  - The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service     (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
    (CVE-2017-7472)

  - Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux     kernel through 4.10.9 allows local users to obtain sensitive information from uninitialized stack data by     triggering failure of a certain bitmap operation. (CVE-2017-7616)

  - crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to cause a denial of service (API     operation calling its own callback, and infinite recursion) by triggering EBUSY on a full queue.
    (CVE-2017-7618)

  - The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel through 4.10.11 allows remote attackers     to cause a denial of service (system crash) via a long RPC reply, related to net/sunrpc/svc.c,     fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c. (CVE-2017-7645)

  - The mm subsystem in the Linux kernel through 3.2 does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access restrictions) via an application that opens the /dev/mem file,     related to arch/x86/mm/init.c and drivers/char/mem.c. (CVE-2017-7889)

  - The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the     end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have     unspecified other impact via crafted requests, related to fs/nfsd/nfs3xdr.c and fs/nfsd/nfsxdr.c.
    (CVE-2017-7895)

  - The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows     local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer     underflow. (CVE-2017-8924)

  - The omninet_open function in drivers/usb/serial/omninet.c in the Linux kernel before 4.10.4 allows local     users to cause a denial of service (tty exhaustion) by leveraging reference count mishandling.
    (CVE-2017-8925)

  - The do_check function in kernel/bpf/verifier.c in the Linux kernel before 4.11.1 does not make the     allow_ptr_leaks value available for restricting the output of the print_bpf_insn function, which allows     local users to obtain sensitive address information via crafted bpf system calls. (CVE-2017-9150)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated kernel packages include several security issues and numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. To see the complete list of bug fixes, users are directed to the related Knowledge Article:
https://access.redhat.com/articles/2986951.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

* A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

* A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
(CVE-2016-9793, Moderate)

* A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. (CVE-2017-2618, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636 and Ralf Spenneberg for reporting CVE-2016-8650. The CVE-2017-2618 issue was discovered by Paul Moore (Red Hat Engineering).

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted     RSA key. This flaw panics the machine during the     verification of the RSA key. (CVE-2016-8650)

  - A flaw was found in the Linux kernel's implementation     of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non-namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption. (CVE-2016-9793)

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory. (CVE-2017-2618)

  - The keyring_search_aux function in     security/keys/keyring.c in the Linux kernel through     3.14.79 allows local users to cause a denial of service     (NULL pointer dereference and OOPS) via a request_key     system call for the 'dead' type.(CVE-2017-6951)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Description of changes:

- [3.10.0-514.16.1.0.1.el7.OL7]
- [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]
- Oracle Linux certificates (Alexey Petrenko)
- Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(<A HREF='https://oss.oracle.com/mailman/listinfo/el-errata'>alexey.petrenko at oracle.com</A>)
- Update x509.genkey [bug 24817676]

[3.10.0-514.16.1.el7]
- [tty] n_hdlc: get rid of racy n_hdlc.tbuf ('Herton R. Krzesinski') [1429919 1429920] {CVE-2017-2636}
- [md] dm rq: cope with DM device destruction while in dm_old_request_fn() (Mike Snitzer) [1430334 1412854]
- [fs] nfs: Fix inode corruption in nfs_prime_dcache() (Benjamin Coddington) [1429514 1416532]
- [fs] nfs: Don't let readdirplus revalidate an inode that was marked as stale (Benjamin Coddington) [1429514 1416532]
- [block] Copy a user iovec if it includes gaps (Jeff Moyer) [1429508 1421263]
- [kernel] percpu-refcount: fix reference leak during percpu-atomic transition (Jeff Moyer) [1429507 1418333]
- [powerpc] eeh: eeh_pci_enable(): fix checking of post-request state (Steve Best) [1425538 1383670]
- [s390] mm: handle PTE-mapped tail pages in fast gup (Hendrik Brueckner) [1423438 1391532]
- [net] skbuff: Fix skb checksum partial check (Lance Richardson) [1422964 1411480]
- [net] skbuff: Fix skb checksum flag on skb pull (Lance Richardson) [1422964 1411480]
- [security] selinux: fix off-by-one in setprocattr (Paul Moore) [1422368 1422369] {CVE-2017-2618}
- [virtio] balloon: check the number of available pages in leak balloon (David Hildenbrand) [1417194 1401615]
- [infiniband] ib/rdmavt: Only put mmap_info ref if it exists (Jonathan Toppins) [1417191 1391299]
- [x86] kvm: x86: make lapic hrtimer pinned (Luiz Capitulino) [1416373 1392593]
- [kernel] sched/nohz: Fix affine unpinned timers mess (Luiz Capitulino) [1416373 1392593]
- [kernel] nohz: Affine unpinned timers to housekeepers (Luiz Capitulino) [1416373 1392593]
- [kernel] tick-sched: add housekeeping_mask cpumask (Luiz Capitulino) [1416373 1392593]
- [x86] platform/uv/bau: Add UV4-specific functions (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Fix payload queue setup on UV4 hardware (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Disable software timeout on UV4 hardware (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Populate ->uvhub_version with UV4 version information (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Use generic function pointers (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Add generic function pointers (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Convert uv_physnodeaddr() use to uv_gpa_to_offset() (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Clean up pq_init() (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Clean up and update printks (Frank Ramsay) [1414715 1386692]
- [x86] platform/uv/bau: Clean up vertical alignment (Frank Ramsay) [1414715 1386692]
- [virtio] virtio-pci: alloc only resources actually used (Laurent Vivier) [1413093 1375153]
- [net] avoid signed overflows for SO_{SND|RCV}BUFFORCE (Sabrina Dubroca) [1412473 1412474] {CVE-2016-9793}
- [netdrv] sfc: clear napi_hash state when copying channels (Jarod Wilson) [1401461 1394304]
- [lib] mpi: Fix NULL ptr dereference in mpi_powm() (Mateusz Guzik) [1398457 1398458] {CVE-2016-8650}
- [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Ewan Milne) [1430687 1366564]
- [md] dm round robin: revert 'use percpu 'repeat_count' and 'current_path'' (Mike Snitzer) [1430689 1422567]
- [md] dm round robin: do not use this_cpu_ptr() without having preemption disabled (Mike Snitzer) [1430689 1422567]
- Revert: [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
- Revert: [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
- Revert: [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
- Revert: [x86] revert 'perf/uncore: Disable uncore on kdump kernel' (Prarit Bhargava) [1426633 1373738]
- Revert: [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

These updated kernel packages include several security issues and numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. To see the complete list of bug fixes, users are directed to the related Knowledge Article:
https://access.redhat.com/articles/2986951.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

* A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

* A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
(CVE-2016-9793, Moderate)

* A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. (CVE-2017-2618, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636 and Ralf Spenneberg for reporting CVE-2016-8650. The CVE-2017-2618 issue was discovered by Paul Moore (Red Hat Engineering).

Security Fix(es) :

  - A race condition flaw was found in the N_HLDC Linux     kernel driver when accessing n_hdlc.tbuf list that can     lead to double free. A local, unprivileged user able to     set the HDLC line discipline on the tty device could use     this flaw to increase their privileges on the system.
    (CVE-2017-2636, Important)

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted RSA     key. This flaw panics the machine during the     verification of the RSA key. (CVE-2016-8650, Moderate)

  - A flaw was found in the Linux kernel's implementation of     setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non- namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption. (CVE-2016-9793, Moderate)

  - A flaw was found in the Linux kernel's handling of     clearing SELinux attributes on /proc/pid/attr files. An     empty (null) write to this file can crash the system by     causing the system to attempt to access unmapped kernel     memory. (CVE-2017-2618, Moderate)

An update for kernel-rt is now available for Red Hat Enterprise MRG 2.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

* A use-after-free flaw was found in the way the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation freed SKB (socket buffer) resources for a DCCP_PKT_REQUEST packet when the IPV6_RECVPKTINFO option is set on the socket. A local, unprivileged user could use this flaw to alter the kernel memory, allowing them to escalate their privileges on the system. (CVE-2017-6074, Important)

* A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

* A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
(CVE-2016-9793, Moderate)

* A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. (CVE-2017-2618, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636; Andrey Konovalov (Google) for reporting CVE-2017-6074;
and Ralf Spenneberg for reporting CVE-2016-8650. The CVE-2017-2618 issue was discovered by Paul Moore (Red Hat Engineering).

Bug Fix(es) :

* The kernel-rt packages have been upgraded to version 3.10.0-514.rt56.219, which provides a number of bug fix updates over the previous version. (BZ# 1429613)

An update for kernel-rt is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es) :

* A race condition flaw was found in the N_HLDC Linux kernel driver when accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged user able to set the HDLC line discipline on the tty device could use this flaw to increase their privileges on the system.
(CVE-2017-2636, Important)

* A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key. (CVE-2016-8650, Moderate)

* A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
(CVE-2016-9793, Moderate)

* A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. (CVE-2017-2618, Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636 and Ralf Spenneberg for reporting CVE-2016-8650. The CVE-2017-2618 issue was discovered by Paul Moore (Red Hat Engineering).

Bug Fix(es) :

* Previously, a cgroups data structure was sometimes corrupted due to a race condition in the kernel-rt cgroups code. Consequently, several system tasks were blocked, and the operating system became unresponsive. This update adds a lock that prevents the race condition. As a result, the cgroups data structure no longer gets corrupted and the operating system no longer hangs under the described circumstances. (BZ#1420784)

* The kernel-rt packages have been upgraded to the 3.10.0-514.16.1 source tree, which provides a number of bug fixes over the previous version. (BZ# 1430749)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-0933 advisory.

  - The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory     is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption     and panic) via an add_key system call for an RSA key with a zero exponent. (CVE-2016-8650)

  - The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative     values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory     corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN     capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.
    (CVE-2016-9793)

  - Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain     privileges or cause a denial of service (double free) by setting the HDLC line discipline. (CVE-2017-2636)

  - A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files     before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to     access unmapped kernel memory. (CVE-2017-2618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or have other impacts.

  - CVE-2016-6786 / CVE-2016-6787     It was discovered that the performance events subsystem     does not properly manage locks during certain     migrations, allowing a local attacker to escalate     privileges. This can be mitigated by disabling     unprivileged use of performance events:sysctl     kernel.perf_event_paranoid=3

  - CVE-2016-8405     Peter Pi of Trend Micro discovered that the frame buffer     video subsystem does not properly check bounds while     copying color maps to userspace, causing a heap buffer     out-of-bounds read, leading to information disclosure.

  - CVE-2016-9191     CAI Qian discovered that reference counting is not     properly handled within proc_sys_readdir in the sysctl     implementation, allowing a local denial of service     (system hang) or possibly privilege escalation.

  - CVE-2017-2583     Xiaohan Zhang reported that KVM for amd64 does not     correctly emulate loading of a null stack selector. This     can be used by a user in a guest VM for denial of     service (on an Intel CPU) or to escalate privileges     within the VM (on an AMD CPU).

  - CVE-2017-2584     Dmitry Vyukov reported that KVM for x86 does not     correctly emulate memory access by the SGDT and SIDT     instructions, which can result in a use-after-free and     information leak.

  - CVE-2017-2596     Dmitry Vyukov reported that KVM leaks page references     when emulating a VMON for a nested hypervisor. This can     be used by a privileged user in a guest VM for denial of     service or possibly to gain privileges in the host.

  - CVE-2017-2618     It was discovered that an off-by-one in the handling of     SELinux attributes in /proc/pid/attr could result in     local denial of service.

  - CVE-2017-5549     It was discovered that the KLSI KL5KUSB105 serial USB     device driver could log the contents of uninitialised     kernel memory, resulting in an information leak.

  - CVE-2017-5551     Jan Kara found that changing the POSIX ACL of a file on     tmpfs never cleared its set-group-ID flag, which should     be done if the user changing it is not a member of the     group-owner. In some cases, this would allow the     user-owner of an executable to gain the privileges of     the group-owner.

  - CVE-2017-5897     Andrey Konovalov discovered an out-of-bounds read flaw     in the ip6gre_err function in the IPv6 networking code.

  - CVE-2017-5970     Andrey Konovalov discovered a denial-of-service flaw in     the IPv4 networking code. This can be triggered by a     local or remote attacker if a local UDP or raw socket     has the IP_RETOPTS option enabled.

  - CVE-2017-6001     Di Shen discovered a race condition between concurrent     calls to the performance events subsystem, allowing a     local attacker to escalate privileges. This flaw exists     because of an incomplete fix of CVE-2016-6786. This can     be mitigated by disabling unprivileged use of     performance events: sysctl kernel.perf_event_paranoid=3

  - CVE-2017-6074     Andrey Konovalov discovered a use-after-free     vulnerability in the DCCP networking code, which could     result in denial of service or local privilege     escalation. On systems that do not already have the dccp     module loaded, this can be mitigated by disabling     it:echo >> /etc/modprobe.d/disable-dccp.conf install     dccp false

ID	Name	Product	Family	Severity
125301	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1508)	Nessus	Huawei Local Security Checks	critical
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	high
109156	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4071)	Nessus	Oracle Linux Local Security Checks	high
105248	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0174) (BlueBorne) (Dirty COW) (Stack Clash)	Nessus	OracleVM Local Security Checks	high
105247	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3659)	Nessus	Oracle Linux Local Security Checks	high
105146	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0172) (Dirty COW)	Nessus	OracleVM Local Security Checks	high
105143	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3651)	Nessus	Oracle Linux Local Security Checks	high
104619	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0169)	Nessus	OracleVM Local Security Checks	medium
104565	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3640)	Nessus	Oracle Linux Local Security Checks	medium
102511	Oracle Linux 7 : kernel (ELSA-2017-1842-1) (Stack Clash)	Nessus	Oracle Linux Local Security Checks	critical
102261	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3381-1)	Nessus	Ubuntu Local Security Checks	high
101929	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3361-1)	Nessus	Ubuntu Local Security Checks	critical
101449	Virtuozzo 7 : kernel / kernel-abi-whitelists / kernel-debug / etc (VZLSA-2017-0933)	Nessus	Virtuozzo Local Security Checks	high
99938	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1072)	Nessus	Huawei Local Security Checks	high
99937	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1071)	Nessus	Huawei Local Security Checks	high
99386	Oracle Linux 7 : kernel (ELSA-2017-0933-1)	Nessus	Oracle Linux Local Security Checks	high
99383	CentOS 7 : kernel (CESA-2017:0933)	Nessus	CentOS Local Security Checks	high
99351	Scientific Linux Security Update : kernel on SL7.x x86_64 (20170412)	Nessus	Scientific Linux Local Security Checks	high
99346	RHEL 7 : kernel (RHSA-2017:0933)	Nessus	Red Hat Local Security Checks	high
99345	RHEL 6 : MRG (RHSA-2017:0932)	Nessus	Red Hat Local Security Checks	high
99344	RHEL 7 : kernel-rt (RHSA-2017:0931)	Nessus	Red Hat Local Security Checks	high
99333	Oracle Linux 7 : kernel (ELSA-2017-0933)	Nessus	Oracle Linux Local Security Checks	high
97357	Debian DSA-3791-1 : linux - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-2618

medium

Tenable Plugins

critical

high

high

high

high

high

high

medium

medium

critical

high

critical

high

high

high

high

high

high

high

high

high

high

critical