The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before munlocking (to determine if any other vmas share the memory and are mlocked).

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes. The following new feature was added :

  - NVDIMM memory error notification (ACPI 6.2) The     following security bugs were fixed :

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function could have result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1100418)

  - CVE-2018-13053: The alarm_timer_nsleep function had an     integer overflow via a large relative timeout because     ktime_add_safe was not used (bnc#1099924)

  - CVE-2018-9385: Prevent overread of the 'driver_override'     buffer (bsc#1100491)

  - CVE-2018-13405: The inode_init_owner function allowed     local users to create files with an unintended group     ownership allowing attackers to escalate privileges by     making a plain file executable and SGID (bnc#1100416)

  - CVE-2017-5753: Systems with microprocessors utilizing     speculative execution and branch prediction may have     allowed unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bsc#1068032)

  - CVE-2018-1118: Linux kernel vhost did not properly     initialize memory in messages passed between virtual     guests and the host operating system. This could have     allowed local privileged users to read some kernel     memory contents when reading from the /dev/vhost-net     device file (bsc#1092472)

  - CVE-2018-12233: A memory corruption bug in JFS could     have been triggered by calling setxattr twice with two     different extended attribute names on the same file.
    This vulnerability could be triggered by an unprivileged     user with the ability to create files and execute     programs (bsc#1097234)

  - CVE-2018-5848: In the function wmi_set_ie(), the length     validation code did not handle unsigned integer overflow     properly. As a result, a large value of the 'ie_len'     argument could have caused a buffer overflow     (bnc#1097356)

  - CVE-2018-1000204: Prevent infoleak caused by incorrect     handling of the SG_IO ioctl (bsc#1096728)

  - CVE-2018-3639: Systems with microprocessors utilizing     speculative execution and speculative execution of     memory reads the addresses of all prior memory writes     are known may have allowed unauthorized disclosure of     information to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4 (bsc#1087082)

  - CVE-2018-1120: By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or     environment strings), an attacker could have caused     utilities from psutils or procps (such as ps, w) to     block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for     other attacks) (bsc#1093158)

  - CVE-2018-1094: The ext4_fill_super function did not     always initialize the crc32c checksum driver, which     allowed attackers to cause a denial of service     (ext4_xattr_inode_hash NULL pointer dereference and     system crash) via a crafted ext4 image (bsc#1087007)

  - CVE-2018-1092: The ext4_iget function mishandled the     case of a root directory with a zero i_links_count,     which allowed attackers to cause a denial of service     (ext4_process_freed_data NULL pointer dereference and     OOPS) via a crafted ext4 image (bsc#1087012)

  - 1093: The ext4_valid_block_bitmap function allowed     attackers to cause a denial of service (out-of-bounds     read and system crash) via a crafted ext4 image because     balloc.c and ialloc.c do not validate bitmap block     numbers (bsc#1087095)

  - CVE-2018-1000200: Prevent NULL pointer dereference which     could have resulted in an out of memory (OOM) killing of     large mlocked processes (bsc#1090150)

  - CVE-2018-1130: NULL pointer dereference in     dccp_write_xmit() function that allowed a local user to     cause a denial of service by a number of certain crafted     system calls (bsc#1092904)

  - CVE-2018-5803: Prevent error in the '_sctp_make_chunk()'     function when handling SCTP packets length that could     have been exploited to cause a kernel crash     (bnc#1083900)

  - CVE-2018-7492: Prevent NULL pointer dereference in the     net/rds/rdma.c __rds_rdma_map() function that allowed     local attackers to cause a system panic and a     denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST (bsc#1082962)

  - CVE-2018-8781: The udl_fb_mmap function had an     integer-overflow vulnerability allowing local users with     access to the udldrmfb driver to obtain full read and     write permissions on kernel physical pages, resulting in     a code execution in kernel space (bsc#1090643)

  - CVE-2018-10124: The kill_something_info function in     kernel/signal.c might have allowed local users to cause     a denial of service via an INT_MIN argument     (bnc#1089752)

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might have allowed local users to cause a     denial of service by triggering an attempted use of the

-INT_MIN value (bnc#1089608)

  - CVE-2017-5715: Prevent unauthorized disclosure of     information to an attacker with local user access caused     by speculative execution and indirect branch prediction     (bsc#1068032)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2948 advisory.

  - kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166)

  - kernel: Use-after-free in drivers/media/dvb-core/dvb_frontend.c (CVE-2017-16648)

  - kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers     to cause denial-of-service (CVE-2017-17805)

  - kernel: HMAC implementation does not validate that the underlying cryptographic hash algorithm is unkeyed     allowing local attackers to cause denial-of-service (CVE-2017-17806)

  - kernel: Mishandled freeing of instances in pcrypt.c can allow a local user to cause a denial of service     (CVE-2017-18075)

  - kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of     service (CVE-2017-18208)

  - kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

  - kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash     (CVE-2018-1065)

  - kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

  - kernel: NULL pointer dereference in ext4/mballoc.c:ext4_process_freed_data() when mounting crafted ext4     image (CVE-2018-1092)

  - kernel: NULL pointer dereference in ext4/xattr.c:ext4_xattr_inode_hash() causes crash with crafted ext4     image (CVE-2018-1094)

  - kernel: out-of-bound access in fs/posix_acl.c:get_acl() causes crash with crafted ext4 image     (CVE-2018-1095)

  - kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

  - kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

  - hw: cpu: speculative store bypass (CVE-2018-3639)

  - kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial-of-service     (CVE-2018-5344)

  - kernel: TCP segments with random offsets allow a remote denial of service (SegmentSmack) (CVE-2018-5390)

  - kernel: IP fragments with random offsets allow a remote denial of service (FragmentSmack) (CVE-2018-5391)

  - kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially     allowing KASLR bypass (CVE-2018-5750)

  - kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows     denial of service (CVE-2018-5803)

  - kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

  - kernel: race condition in snd_seq_write() may lead to UAF or OOB-access (CVE-2018-7566)

  - kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

  - kernel: Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code     in kernel space (CVE-2018-8781)

  - kernel: Buffer overflow in hidp_process_report (CVE-2018-9363)

  - kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

  - kernel: out-of-bound access in ext4_ext_drop_refs function with a crafted ext4 image (CVE-2018-10877)

  - kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

  - kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

  - kernel: stack-out-of-bounds write in ext4_update_inline_data function (CVE-2018-10880)

  - kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

  - kernel: stack-out-of-bounds write infs/jbd2/transaction.c (CVE-2018-10882)

  - kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

  - kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

  - kernel: Stack-based buffer overflow in drivers/scsi/sr_ioctl.c allows denial of service or other     unspecified impact (CVE-2018-11506)

  - kernel: NULL pointer dereference if close and fchownat system calls share a socket file descriptor     (CVE-2018-12232)

  - kernel: Missing check in fs/inode.c:inode_init_owner() does not clear SGID bit on non-directories for non-     members (CVE-2018-13405)

  - kernel: crash (possible privesc) in kernel crypto api. (CVE-2018-14619)

  - kernel: a bug in ip_frag_reasm() can cause a crash in ip_do_fragment() (CVE-2018-14641)

  - kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

  - kernel: NULL pointer dereference on OOM kill of large mlocked process (CVE-2018-1000200)

  - kernel: Infoleak caused by incorrect handling of the SG_IO ioctl (CVE-2018-1000204)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-3 advisory.

  - The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out     of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final     thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen     synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before     munlocking (to determine if any other vmas share the memory and are mlocked). (CVE-2018-1000200)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry()     function. An attacker could exploit this by operating on a mounted crafted ext4 image. (CVE-2018-10840)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation     of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed     before it was sufficiently generated. (CVE-2018-1108)

  - A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or environment strings), an attacker can cause     utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the     /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for other attacks). (CVE-2018-1120)

  - In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy     with an untrusted length value in certain circumstances involving a crafted filesystem that stores the     system.data extended attribute value in a dedicated inode. (CVE-2018-11412)

  - The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users     to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact     because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a     CDROMREADMODE2 ioctl call. (CVE-2018-11506)

  - In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close     in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr     functions. fchownat does not increment the file descriptor reference count, which allows close to set the     socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
    (CVE-2018-12232)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local     attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of     service attacks due to lack of checking of CPL. (CVE-2018-12904)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

  - In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors     when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free     condition or a NULL pointer dereference by sending multiple USB over IP packets. (CVE-2018-5814)

  - In driver_override_store and driver_override_show of bus.c, there is a possible double free due to     improper locking. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-69129004 References: Upstream kernel. (CVE-2018-9415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-2 advisory.

  - The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out     of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final     thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen     synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before     munlocking (to determine if any other vmas share the memory and are mlocked). (CVE-2018-1000200)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry()     function. An attacker could exploit this by operating on a mounted crafted ext4 image. (CVE-2018-10840)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation     of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed     before it was sufficiently generated. (CVE-2018-1108)

  - A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or environment strings), an attacker can cause     utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the     /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for other attacks). (CVE-2018-1120)

  - In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy     with an untrusted length value in certain circumstances involving a crafted filesystem that stores the     system.data extended attribute value in a dedicated inode. (CVE-2018-11412)

  - The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users     to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact     because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a     CDROMREADMODE2 ioctl call. (CVE-2018-11506)

  - In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close     in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr     functions. fchownat does not increment the file descriptor reference count, which allows close to set the     socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
    (CVE-2018-12232)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local     attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of     service attacks due to lack of checking of CPL. (CVE-2018-12904)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

  - In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors     when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free     condition or a NULL pointer dereference by sending multiple USB over IP packets. (CVE-2018-5814)

  - In driver_override_store and driver_override_show of bus.c, there is a possible double free due to     improper locking. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-69129004 References: Upstream kernel. (CVE-2018-9415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3752-1 advisory.

  - The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out     of memory (OOM) killing of large mlocked processes. The issue arises from an oom killed process's final     thread calling exit_mmap(), which calls munlock_vma_pages_all() for mlocked vmas.This can happen     synchronously with the oom reaper's unmap_page_range() since the vma's VM_LOCKED bit is cleared before     munlocking (to determine if any other vmas share the memory and are mlocked). (CVE-2018-1000200)

  - Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with     dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel     heap pages to the userspace. This has been fixed upstream in     https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has     limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the     Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties     dispute the relevance of this report, noting that the requirement for an attacker to have both the     CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it virtually impossible to exploit. (CVE-2018-1000204)

  - The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through 4.16.3     allows local users to cause a denial of service (xfs_bmapi_write NULL pointer dereference) via a crafted     xfs image. (CVE-2018-10323)

  - Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry()     function. An attacker could exploit this by operating on a mounted crafted ext4 image. (CVE-2018-10840)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10881)

  - The ext4_valid_block_bitmap function in fs/ext4/balloc.c in the Linux kernel through 4.15.15 allows     attackers to cause a denial of service (out-of-bounds read and system crash) via a crafted ext4 image     because balloc.c and ialloc.c do not validate bitmap block numbers. (CVE-2018-1093)

  - kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation     of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed     before it was sufficiently generated. (CVE-2018-1108)

  - A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a     process's memory containing command line arguments (or environment strings), an attacker can cause     utilities from psutils or procps (such as ps, w) or any other program which makes a read() call to the     /proc/<pid>/cmdline (or /proc/<pid>/environ) files to block indefinitely (denial of service) or for some     controlled time (as a synchronization primitive for other attacks). (CVE-2018-1120)

  - In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy     with an untrusted length value in certain circumstances involving a crafted filesystem that stores the     system.data extended attribute value in a dedicated inode. (CVE-2018-11412)

  - The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users     to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact     because sense buffers have different sizes at the CDROM layer and the SCSI layer, as demonstrated by a     CDROMREADMODE2 ioctl call. (CVE-2018-11506)

  - In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close     in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr     functions. fchownat does not increment the file descriptor reference count, which allows close to set the     socket to NULL during fchownat's execution, leading to a NULL pointer dereference and system crash.
    (CVE-2018-12232)

  - In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in     JFS can be triggered by calling setxattr twice with two different extended attribute names on the same     file. This vulnerability can be triggered by an unprivileged user with the ability to create files and     execute programs. A kmalloc call is incorrect, leading to slab-out-of-bounds in jfs_xattr.
    (CVE-2018-12233)

  - In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local     attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of     service attacks due to lack of checking of CPL. (CVE-2018-12904)

  - An issue was discovered in fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel through 4.17.3. An OOPS may     occur for a corrupted xfs image after xfs_da_shrink_inode() is called with a NULL bp. (CVE-2018-13094)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - An integer overflow in the uvesafb_setcmap function in drivers/video/fbdev/uvesafb.c in the Linux kernel     before 4.17.4 could result in local attackers being able to crash the kernel or potentially elevate     privileges because kmalloc_array is not used. (CVE-2018-13406)

  - In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors     when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free     condition or a NULL pointer dereference by sending multiple USB over IP packets. (CVE-2018-5814)

  - In driver_override_store and driver_override_show of bus.c, there is a possible double free due to     improper locking. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-69129004 References: Upstream kernel. (CVE-2018-9415)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
123226	openSUSE Security Update : the Linux Kernel (openSUSE-2019-536) (Spectre)	Nessus	SuSE Local Security Checks	high
120067	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2018:2092-1) (Spectre)	Nessus	SuSE Local Security Checks	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	high
112189	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (Azure, GCP, OEM) vulnerabilities (USN-3752-3)	Nessus	Ubuntu Local Security Checks	high
112110	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3752-2)	Nessus	Ubuntu Local Security Checks	high
112109	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3752-1)	Nessus	Ubuntu Local Security Checks	high
111414	openSUSE Security Update : the Linux Kernel (openSUSE-2018-762) (Spectre)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-1000200

medium

Tenable Plugins

high

high

high

high

high

high

high