The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a crafted xfs image.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows     local users to cause a denial of service (xfs_ilock_attr_map_shared invalid pointer dereference) via a     crafted xfs image. (CVE-2018-10322)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):A flaw was found in Linux     kernel in the ext4 filesystem code. A use-after-free is     possible in ext4_ext_remove_space() function when     mounting and operating a crafted ext4     image.(CVE-2018-10876)A flaw was found in the Linux     kernel. A use-after-free was found in the way the     console subsystem was using ioctls KDGKBSENT and     KDSKBSENT. A local user could use this flaw to get read     memory access out of bounds. The highest threat from     this vulnerability is to data     confidentiality.(CVE-2020-25656)A flaw was found in the     way RTAS handled memory accesses in userspace to kernel     communication. On a locked down (usually due to Secure     Boot) guest system running on top of PowerVM or KVM     hypervisors (pseries platform) a root like local user     could use this flaw to further increase their     privileges to that of a running     kernel.(CVE-2020-27777)A information disclosure     vulnerability in the Upstream kernel encrypted-keys.
    Product: Android. Versions: Android kernel. Android ID:
    A-70526974.(CVE-2017-13305)A race condition was found     in the Linux kernels implementation of the floppy disk     drive controller driver software. The impact of this     issue is lessened by the fact that the default     permissions on the floppy device (/dev/fd0) are     restricted to root. If the permissions on the device     have changed the impact changes greatly. In the default     configuration root (or equivalent) permissions are     required to attack this flaw.(CVE-2021-20261)An issue     was discovered in dlpar_parse_cc_property in     arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of     prop->name, which might allow an attacker to cause a     denial of service (NULL pointer dereference and system     crash).(CVE-2019-12614)An issue was discovered in     fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3.
    There is a NULL pointer dereference and panic in     lookup_slow() on a NULL inode->i_ops pointer when doing     pathwalks on a corrupted xfs image. This occurs because     of a lack of proper validation that cached inodes are     free during allocation.(CVE-2018-13093)An issue was     discovered in rds_tcp_kill_sock in net/rds/tcp.c in the     Linux kernel before 5.0.8. There is a race condition     leading to a use-after-free, related to net namespace     cleanup.(CVE-2019-11815)An issue was discovered in the     Linux kernel through 5.11.3. A kernel pointer leak can     be used to determine the address of the iscsi_transport     structure. When an iSCSI transport is registered with     the iSCSI subsystem, the transport's handle is     available to unprivileged users via the sysfs file     system, at     /sys/class/iscsi_transport/$TRANSPORT_NAME/handle. When     read, the show_transport_handle function (in     drivers/scsi/scsi_transport_iscsi.c) is called, which     leaks the handle. This handle is actually the pointer     to an iscsi_transport struct in the kernel module's     global variables.(CVE-2021-27363)An issue was     discovered in the Linux kernel through 5.11.3. Certain     iSCSI data structures do not have appropriate length     constraints or checks, and can exceed the PAGE_SIZE     value. An unprivileged user can send a Netlink message     that is associated with iSCSI, and has a length up to     the maximum length of a Netlink     message.(CVE-2021-27365)An issue was discovered in the     Linux kernel through 5.11.3.
    drivers/scsi/scsi_transport_iscsi.c is adversely     affected by the ability of an unprivileged user to     craft Netlink messages.(CVE-2021-27364)An issue was     discovered in yurex_read in drivers/usb/misc/yurex.c in     the Linux kernel before 4.17.7. Local attackers could     use user access read/writes with incorrect bounds     checking in the yurex USB driver to crash the kernel or     potentially escalate     privileges.(CVE-2018-16276)drivers/infiniband/core/ucma     .c in the Linux kernel through 4.17.11 allows     ucma_leave_multicast to access a certain data structure     after a cleanup step in ucma_process_join, which allows     attackers to cause a denial of service     (use-after-free).(CVE-2018-14734)In create_pinctrl of     core.c, there is a possible out of bounds read due to a     use after free. This could lead to local information     disclosure with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-140550171(CVE-2020-0427)In     do_epoll_ctl and ep_loop_check_proc of eventpoll.c,     there is a possible use after free due to a logic     error. This could lead to local escalation of privilege     with no additional execution privileges needed. User     interaction is not needed for exploitation.Product:
    AndroidVersions: Android kernelAndroid ID:
    A-147802478References: Upstream kernel(CVE-2020-0466)In     fs/ocfs2/cluster/ nodemanager.c in the Linux kernel     before 4.15, local users can cause a denial of service     (NULL pointer dereference and BUG) because a required     mutex is not used.(CVE-2017-18216)In the Linux kernel     before 5.2, a setxattr operation, after a mount of a     crafted ext4 image, can cause a slab-out-of-bounds     write access because of an ext4_xattr_set_entry     use-after-free in fs/ext4/xattr.c when a large old_size     value is used in a memset call, aka     CID-345c0dbf3a30.(CVE-2019-19319)In the Linux kernel     before version 4.12, Kerberos 5 tickets decoded when     using the RXRPC keys incorrectly assumes the size of a     field. This could lead to the size-remaining variable     wrapping and the data pointer going over the end of the     buffer. This could possibly lead to memory corruption     and possible privilege escalation.(CVE-2017-7482)In     uvc_scan_chain_forward of uvc_driver.c, there is a     possible linked list corruption due to an unusual root     cause. This could lead to local escalation of privilege     in the kernel with no additional execution privileges     needed. User interaction is not needed for     exploitation.Product: AndroidVersions: Android     kernelAndroid ID: A-111893654References: Upstream     kernel(CVE-2020-0404)In various methods of     hid-multitouch.c, there is a possible out of bounds     write due to a missing bounds check. This could lead to     local escalation of privilege with no additional     execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions:
    Android kernelAndroid ID: A-162844689References:
    Upstream kernel(CVE-2020-0465)It was found that the raw     midi kernel driver does not protect against concurrent     access which leads to a double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation.(CVE-2018-10902)Linux kernel ext4     filesystem is vulnerable to an out-of-bound access in     the ext4_ext_drop_refs() function when operating on a     crafted ext4 filesystem image.(CVE-2018-10877)Linux     kernel is vulnerable to a stack-out-of-bounds write in     the ext4 filesystem code when mounting and writing to a     crafted ext4 image in ext4_update_inline_data(). An     attacker could use this to cause a system crash and a     denial of service.(CVE-2018-10880)Linux Kernel contains     an out-of-bounds read flaw in the asn1_ber_decoder()     function in lib/asn1_decoder.c that is triggered when     decoding ASN.1 data. This may allow a remote attacker     to disclose potentially sensitive memory     contents.(CVE-2018-9383)use-after-free read in     sunkbd_reinit in     drivers/input/keyboard/sunkbd.c(CVE-2020-25669)mwifiex_     cmd_802_11_ad_hoc_start in drivers/     net/wireless/marvell/mwifiex/join.c in the Linux kernel     through 5.10.4 might allow remote attackers to execute     arbitrary code via a long SSID value, aka     CID-5c455c5ab332.(CVE-2020-36158)fs/ nfsd/ nfs3xdr.c in     the Linux kernel through 5.10.8, when there is an NFS     export of a subdirectory of a filesystem, allows remote     attackers to traverse to other parts of the filesystem     via READDIRPLUS. NOTE: some parties argue that such a     subdirectory export is not intended to prevent this     attack see also the exports(5) no_subtree_check default     behavior.(CVE-2021-3178)In the Linux kernel before     4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c     mishandles reference counting because of a race     condition, leading to a     use-after-free.(CVE-2019-6974)The KVM implementation in     the Linux kernel through 4.20.5 has a     Use-after-Free.(CVE-2019-7221)A flaw was found in the     JFS filesystem code. This flaw allows a local attacker     with the ability to set extended attributes to panic     the system, causing memory corruption or escalating     privileges. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2020-27815)An out-of-bounds (OOB)     memory access flaw was found in x25_bind in     net/x25/af_x25.c in the Linux kernel. A bounds check     failure allows a local attacker with a user account on     the system to gain access to out-of-bounds memory,     leading to a system crash or a leak of internal kernel     information. The highest threat from this vulnerability     is to confidentiality, integrity, as well as system     availability.(CVE-2020-35519)In     drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux     kernel through 5.11.8, the RPA PCI Hotplug driver has a     user-tolerable buffer overflow when writing a new     device name to the driver from userspace, allowing     userspace to write data to the kernel stack frame     directly. This occurs because add_slot_store and     remove_slot_store mishandle drc_name '\0' termination,     aka CID-cc7a0bb058b8.(CVE-2021-28972)A NULL pointer     dereference was found in the net/rds/rdma.c
    __rds_rdma_map() function in the Linux kernel before     4.14.7 allowing local attackers to cause a system panic     and a denial-of-service, related to RDS_GET_MR and     RDS_GET_MR_FOR_DEST.(CVE-2018-7492)The Siemens R3964     line discipline driver in drivers/tty/ n_r3964.c in the     Linux kernel before 5.0.8 has multiple race     conditions.(CVE-2019-11486)The kernel in Android before     2016-08-05 on Nexus 7 (2013) devices allows attackers     to gain privileges via a crafted application, aka     internal bug 28522518.(CVE-2016-3857)The KVM     implementation in the Linux kernel through 4.14.7     allows attackers to obtain potentially sensitive     information from kernel memory, aka a write_mmio     stack-based out-of-bounds read, related to     arch/x86/kvm/x86.c and     include/trace/events/kvm.h.(CVE-2017-17741)The     sctp_process_param function in net/sctp/sm_make_chunk.c     in the SCTP implementation in the Linux kernel before     3.17.4, when ASCONF is used, allows remote attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a malformed INIT     chunk.(CVE-2014-7841)The XFS subsystem in the Linux     kernel through 4.8.2 allows local users to cause a     denial of service (fdatasync failure and system hang)     by using the vfs syscall group in the trinity program,     related to a 'page lock order bug in the XFS seek     hole/data implementation.'(CVE-2016-8660)The     xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4578-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Wen Xu discovered that the XFS file system in the Linux kernel did not properly validate inode metadata in     some situations. An attacker could use this to construct a malicious XFS image that, when mounted, could     cause a denial of service (system crash). (CVE-2018-10322)

    It was discovered that the btrfs file system in the Linux kernel contained a use-after-free vulnerability     when merging free space. An attacker could use this to construct a malicious btrfs image that, when     mounted and operated on, could cause a denial of service (system crash). (CVE-2019-19448)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    Giuseppe Scrivano discovered that the overlay file system in the Linux kernel did not properly perform     permission checks in some situations. A local attacker could possibly use this to bypass intended     restrictions and gain read access to restricted files. (CVE-2020-16120)

    It was discovered that the NFS client implementation in the Linux kernel did not properly perform bounds     checking before copying security labels in some situations. A local attacker could use this to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2020-25212)

    It was discovered that the NFC implementation in the Linux kernel did not properly perform permissions     checks when opening raw sockets. A local attacker could use this to create or listen to NFC traffic.
    (CVE-2020-26088)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4579-1 advisory.

    Hadar Manor discovered that the DCCP protocol implementation in the Linux kernel improperly handled socket     reuse, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of     service (system crash) or possibly execute arbitrary code. (CVE-2020-16119)

    Wen Xu discovered that the XFS file system in the Linux kernel did not properly validate inode metadata in     some situations. An attacker could use this to construct a malicious XFS image that, when mounted, could     cause a denial of service (system crash). (CVE-2018-10322)

    Jay Shin discovered that the ext4 file system implementation in the Linux kernel did not properly handle     directory access with broken indexing, leading to an out-of-bounds read vulnerability. A local attacker     could use this to cause a denial of service (system crash). (CVE-2020-14314)

    It was discovered that a race condition existed in the hugetlb sysctl implementation in the Linux kernel.
    A privileged attacker could use this to cause a denial of service (system crash). (CVE-2020-25285)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The IPv6 SCTP implementation in net/sctp/ipv6.c in the     Linux kernel through 3.11.1 uses data structures and     function calls that do not trigger an intended     configuration of IPsec encryption, which allows remote     attackers to obtain sensitive information by sniffing     the network.(CVE-2013-4350i1/4%0

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel allows local users to cause a denial of service     (stack-based buffer overflow) or possibly have     unspecified other impacts via a large command size in     an SG_NEXT_CMD_LEN ioctl call, leading to out-of-bounds     write access in the sg_write function.(CVE-2017-7187i1/4%0

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection     fault).(CVE-2019-3701i1/4%0

  - net/rds/sysctl.c in the Linux kernel before 3.19 uses     an incorrect data type in a sysctl table, which allows     local users to obtain potentially sensitive information     from kernel memory or possibly have unspecified other     impact by accessing a sysctl entry.(CVE-2015-2042i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-8890i1/4%0

  - The overlayfs implementation in the linux (aka Linux     kernel) package before 3.19.0-21.21 in Ubuntu through     15.04 does not properly check permissions for file     creation in the upper filesystem directory, which     allows local users to obtain root access by leveraging     a configuration in which overlayfs is permitted in an     arbitrary mount namespace.(CVE-2015-1328i1/4%0

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel     through 4.16.3 allows local users to cause a denial of     service (xfs_ilock_attr_map_shared invalid pointer     dereference) via a crafted xfs image.(CVE-2018-10322i1/4%0

  - In the flush_tmregs_to_thread function in     arch/powerpc/kernel/ptrace.c in the Linux kernel before     4.13.5, a guest kernel crash can be triggered from     unprivileged userspace during a core dump on a POWER     host due to a missing processor feature check and an     erroneous use of transactional memory (TM) instructions     in the core dump path, leading to a denial of     service.(CVE-2018-1091i1/4%0

  - ** DISPUTED ** drivers/scsi/libsas/sas_scsi_host.c in     the Linux kernel before 4.16 allows local users to     cause a denial of service (ata qc leak) by triggering     certain failure conditions. NOTE: a third party     disputes the relevance of this report because the     failure can only occur for physically proximate     attackers who unplug SAS Host Bus Adapter     cables.(CVE-2018-10021i1/4%0

  - A use-after-free flaw was discovered in the Linux     kernel's tty subsystem, which allows for the disclosure     of uncontrolled memory location and possible kernel     panic. The information leak is caused by a race     condition when attempting to set and read the tty line     discipline. A local attacker could use the TIOCSETD     (via tty_set_ldisc ) to switch to a new line discipline     a concurrent call to a TIOCGETD ioctl performing a read     on a given tty could then access previously allocated     memory. Up to 4 bytes could be leaked when querying the     line discipline or the kernel could panic with a     NULL-pointer dereference.(CVE-2016-0723i1/4%0

  - An out-of-bounds read flaw was found in the way the     Logitech Unifying receiver driver handled HID reports     with an invalid device_index value. An attacker with     physical access to the system could use this flaw to     crash the system or, potentially, escalate their     privileges on the system.(CVE-2014-3182i1/4%0

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584i1/4%0

  - A flaw was found in the way the Linux kernel handled     IRET faults during the processing of NMIs. An     unprivileged, local user could use this flaw to crash     the system or, potentially (although highly unlikely),     escalate their privileges on the     system.(CVE-2015-5157i1/4%0

  - drivers/media/media-device.c in the Linux kernel before     3.11, as used in Android before 2016-08-05 on Nexus 5     and 7 (2013) devices, does not properly initialize     certain data structures, which allows local users to     obtain sensitive information via a crafted application,     aka Android internal bug 28750150 and Qualcomm internal     bug CR570757, a different vulnerability than     CVE-2014-1739.(CVE-2014-9895i1/4%0

  - A use-after-free vulnerability in sys_ioprio_get() was     found due to get_task_ioprio() accessing the     task-i1/4zio_context without holding the task lock and     could potentially race with exit_io_context(), leading     to a use-after-free.(CVE-2016-7911i1/4%0

  - A flaw was found in the Linux kernel which is related     to the user namespace lazily unmounting file systems.
    The fs_pin struct has two members (m_list and s_list)     which are usually initialized on use in the     pin_insert_group function. However, these members might     go unmodified in this case, the system panics when it     attempts to destroy or free them. This flaw could be     used to launch a denial-of-service     attack.(CVE-2015-4178i1/4%0

  - A flaw was found in the Linux kernel's implementation     of raw_sendmsg allowing a local attacker to panic the     kernel or possibly leak kernel addresses. A local     attacker, with the privilege of creating raw sockets,     can abuse a possible race condition when setting the     socket option to allow the kernel to automatically     create ip header values and thus potentially escalate     their privileges.(CVE-2017-17712i1/4%0

  - A flaw was discovered in the F2FS filesystem code in     fs/f2fs/super.c in the Linux kernel. A denial of     service, due to an out-of-bounds memory access, can     occur upon encountering an abnormal bitmap size when     mounting a crafted f2fs image.(CVE-2018-13096i1/4%0

  - A NULL pointer dereference flaw was found in the way     the Linux kernel's madvise MADV_WILLNEED functionality     handled page table locking. A local, unprivileged user     could use this flaw to crash the     system.(CVE-2014-8173i1/4%0

  - An out-of-bounds heap memory access leading to a Denial     of Service, heap disclosure, or further impact was     found in setsockopt(). The function call is normally     restricted to root, however some processes with     cap_sys_admin may also be able to trigger this flaw in     privileged container environments.(CVE-2016-4998i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The Linux kernel has an undefined behavior when an     argument of INT_MIN is passed to the     kernel/signal.c:kill_something_info() function. A local     attacker may be able to exploit this to cause a denial     of service.(CVE-2018-10124)

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of     service.(CVE-2018-10322)

  - A flaw was found in the Linux kernel's client-side     implementation of the cifs protocol. This flaw allows     an attacker controlling the server to kernel panic a     client which has the CIFS server     mounted.(CVE-2018-1066)

  - The do_get_mempolicy() function in mm/mempolicy.c in     the Linux kernel allows local users to hit a     use-after-free bug via crafted system calls and thus     cause a denial of service (DoS) or possibly have     unspecified other impact. Due to the nature of the     flaw, privilege escalation cannot be fully ruled     out.(CVE-2018-10675)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bounds write and a     denial of service or unspecified other impact is     possible by mounting and operating a crafted ext4     filesystem image.(CVE-2018-10878)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound access in     ext4_get_group_info function, a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10881)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in     jbd2_journal_dirty_metadata(), a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10883)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the     ext4/mballoc.c:ext4_process_freed_data() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a kernel panic.(CVE-2018-1092)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4     image.(CVE-2018-1094)

  - A flaw was found in the Linux kernel, before 4.16.6     where the cdrom_ioctl_media_changed function in     drivers/cdrom/cdrom.c allows local attackers to use a     incorrect bounds check in the CDROM driver     CDROM_MEDIA_CHANGED ioctl to read out kernel     memory.(CVE-2018-10940)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of     service.i1/4^CVE-2018-10322i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A security flaw was found in the ip_frag_reasm()     function in net/ipv4/ip_fragment.c in the Linux kernel     which can cause a later system crash in     ip_do_fragment(). With certain non-default, but     non-rare, configuration of a victim host, an attacker     can trigger this crash remotely, thus leading to a     remote denial of service.(CVE-2018-14641)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - The resv_map_release function in mm/hugetlb.c in the     Linux kernel, through 4.15.7, allows local users to     cause a denial of service (BUG) via a crafted     application that makes mmap system calls and has a     large pgoff argument to the remap_file_pages system     call. (CVE-2018-7740)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when     a L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

  - An information leakage issue was found in the way Linux     kernel's KVM hypervisor handled page fault exceptions     while emulating instructions like VMXON, VMCLEAR,     VMPTRLD, and VMWRITE with memory address as an operand.
    It occurs if the operand is a mmio address, as the     returned exception object holds uninitialized stack     memory contents. A guest user/process could use this     flaw to leak host's stack memory contents to a guest.
    (CVE-2019-7222)

  - The xfs_dinode_verify function in     fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can     cause a NULL pointer dereference in     xfs_ilock_attr_map_shared function. An attacker could     trick a legitimate user or a privileged attacker could     exploit this by mounting a crafted xfs filesystem image     to cause a kernel panic and thus a denial of service.
    (CVE-2018-10322)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the     ext4/mballoc.c:ext4_process_freed_data() function. An     attacker could trick a legitimate user or a privileged     attacker could exploit this by mounting a crafted ext4     image to cause a kernel panic.(CVE-2018-1092)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

  - An issue was discovered in the XFS filesystem in     fs/xfs/libxfs/xfs_attr_leaf.c in the Linux kernel. A     NULL pointer dereference may occur for a corrupted xfs     image after xfs_da_shrink_inode() is called with a NULL     bp. This can lead to a system crash and a denial of     service. (CVE-2018-13094)

  - A flaw was found in the Linux kernel with files on     tmpfs and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a     use-after-free issue. A user/process could use this     flaw to crash the guest VM resulting in a denial of     service issue or, potentially, gain privileged access     to a system. (CVE-2019-6974)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4509 advisory.

    - KVM: X86: Fix scan ioapic use-before-initialization (Wanpeng Li)  [Orabug: 29026132]  {CVE-2018-19407}
    - ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Hui Peng)  [Orabug:
    29042979]  {CVE-2018-19824}
    - xfs: enhance dinode verifier (Eric Sandeen)  [Orabug: 28997653]  {CVE-2018-10322}
    - xfs: move inode fork verifiers to xfs_dinode_verify (Darrick J. Wong)  [Orabug: 28997653]     {CVE-2018-10322}
    - net: phy: mdio-bcm-unimac: fix potential NULL dereference in unimac_mdio_probe() (Wei Yongjun)  [Orabug:
    27677743]  {CVE-2018-8043}
    - wil6210: missing length check in wmi_set_ie (Lior David)  [Orabug: 28951264]  {CVE-2018-5848}
    - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)   {CVE-2018-7755}     {CVE-2018-7755}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The v4.16.8 update contains important fixes across the tree

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4304 advisory.

    - RDS: null pointer dereference in rds_atomic_free_op (Mohamed Ghannam)  [Orabug: 28020694]     {CVE-2018-5333}
    - wil6210: missing length check in wmi_set_ie (Lior David)  [Orabug: 28951267]  {CVE-2018-5848}
    - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)  [Orabug:
    28956546]  {CVE-2018-7755} {CVE-2018-7755}
    - xfs: enhance dinode verifier (Eric Sandeen)  [Orabug: 28943579]  {CVE-2018-10322}
    - xfs: move inode fork verifiers to xfs_dinode_verify (Darrick J. Wong)  [Orabug: 28943579]     {CVE-2018-10322}
    - cdrom: fix improper type cast, which can leat to information leak. (Young_X)  [Orabug: 28929755]     {CVE-2018-16658} {CVE-2018-10940} {CVE-2018-18710}
    - bpf: 32-bit RSH verification must truncate input before the ALU op (Jann Horn)  [Orabug: 28861785]     {CVE-2018-18445}
    - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() (Alexander Potapenko)  [Orabug: 28884433]     {CVE-2018-1000204}
    - random: fix crng_ready() test (Theodore Ts'o)  [Orabug: 28863713]  {CVE-2018-1108} {CVE-2018-1108}
    - proc: do not access cmdline nor environ from file-backed areas (Willy Tarreau)  [Orabug: 28863722]     {CVE-2018-1120} {CVE-2018-1120}
    - vhost: correctly check the iova range when waking virtqueue (Jason Wang)  [Orabug: 28892623]     {CVE-2018-1118}
    - xfs: don't call xfs_da_shrink_inode with NULL bp (Eric Sandeen)  [Orabug: 28893785]  {CVE-2018-13094}
    - ALSA: rawmidi: Change resized buffers atomically (Takashi Iwai)  [Orabug: 28893798]  {CVE-2018-10902}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - kernel: out-of-bounds access in the show_timer function     in kernel/time /posix-timers.c (CVE-2017-18344)

  - kernel: Integer overflow in udl_fb_mmap() can allow     attackers to execute code in kernel space     (CVE-2018-8781)

  - kernel: MIDI driver race condition leads to a     double-free (CVE-2018-10902)

  - kernel: Missing check in inode_init_owner() does not     clear SGID bit on non-directories for non-members     (CVE-2018-13405)

  - kernel: AIO write triggers integer overflow in some     protocols (CVE-2015-8830)

  - kernel: Use-after-free in snd_pcm_info function in ALSA     subsystem potentially leads to privilege escalation     (CVE-2017-0861)

  - kernel: Handling of might_cancel queueing is not     properly pretected against race (CVE-2017-10661)

  - kernel: Salsa20 encryption algorithm does not correctly     handle zero- length inputs allowing local attackers to     cause denial of service (CVE-2017-17805)

  - kernel: Inifinite loop vulnerability in     madvise_willneed() function allows local denial of     service (CVE-2017-18208)

  - kernel: fuse-backed file mmap-ed onto process cmdline     arguments causes denial of service (CVE-2018-1120)

  - kernel: a NULL pointer dereference in dccp_write_xmit()     leads to a system crash (CVE-2018-1130)

  - kernel: drivers/block/loop.c mishandles lo_release     serialization allowing denial of service (CVE-2018-5344)

  - kernel: Missing length check of payload in
    _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

  - kernel: buffer overflow in     drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may     lead to memory corruption (CVE-2018-5848)

  - kernel: out-of-bound write in ext4_init_block_bitmap     function with a crafted ext4 image (CVE-2018-10878)

  - kernel: Improper validation in bnx2x network card driver     can allow for denial of service attacks via crafted     packet (CVE-2018-1000026)

  - kernel: Information leak when handling NM entries     containing NUL (CVE-2016-4913)

  - kernel: Mishandling mutex within libsas allowing local     Denial of Service (CVE-2017-18232)

  - kernel: NULL pointer dereference in     ext4_process_freed_data() when mounting crafted ext4     image (CVE-2018-1092)

  - kernel: NULL pointer dereference in     ext4_xattr_inode_hash() causes crash with crafted ext4     image (CVE-2018-1094)

  - kernel: vhost: Information disclosure in     vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

  - kernel: Denial of service in resv_map_release function     in mm/hugetlb.c (CVE-2018-7740)

  - kernel: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

  - kernel: Invalid pointer dereference in     xfs_ilock_attr_map_shared() when mounting crafted xfs     image allowing denial of service (CVE-2018-10322)

  - kernel: use-after-free detected in ext4_xattr_set_entry     with a crafted file (CVE-2018-10879)

  - kernel: out-of-bound access in ext4_get_group_info()     when mounting and operating a crafted ext4 image     (CVE-2018-10881)

  - kernel: stack-out-of-bounds write in     jbd2_journal_dirty_metadata function (CVE-2018-10883)

  - kernel: incorrect memory bounds check in     drivers/cdrom/cdrom.c (CVE-2018-10940)

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a denial of service on the system. (CVE-2018-5391)

* kernel: out-of-bounds access in the show_timer function in kernel/time/ posix-timers.c (CVE-2017-18344)

* kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space (CVE-2018-8781)

* kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

* kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members (CVE-2018-13405)

* kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

* kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege escalation (CVE-2017-0861)

* kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

* kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local attackers to cause denial of service (CVE-2017-17805)

* kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service (CVE-2017-18208)

* kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

* kernel: a NULL pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

* kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service (CVE-2018-5344)

* kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service (CVE-2018-5803)

* kernel: buffer overflow in drivers/net/wireless/ath/wil6210/ wmi.c:wmi_set_ie() may lead to memory corruption (CVE-2018-5848)

* kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

* kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via crafted packet (CVE-2018-1000026)

* kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

* kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

* kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image (CVE-2018-1092)

* kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image (CVE-2018-1094)

* kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

* kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

* kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/ libsas/sas_expander.c (CVE-2018-7757)

* kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service (CVE-2018-10322)

* kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

* kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image (CVE-2018-10881)

* kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

* kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120;
Evgenii Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3083 advisory.

    - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
    - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
    - [cdrom] information leak in cdrom_ioctl_media_changed() (Sanskriti Sharma) [1578207] {CVE-2018-10940}
    - [fs] fs: get_rock_ridge_filename(): handle malformed NM entries (Bill O'Donnell) [1340778]     {CVE-2016-4913}
    - [mm] madvise: fix madvise() infinite loop under special circumstances (Rafael Aquini) [1552982]     {CVE-2017-18208}
    - [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613711] {CVE-2017-18344}
    - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593087] {CVE-2018-10902}
    - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600953] {CVE-2018-13405}
    - [scsi] libsas: fix memory leak in sas_smp_get_phy_events() (Tomas Henzl) [1558582] {CVE-2018-7757}
    - [vhost] fix info leak due to uninitialized memory (Jason Wang) [1573705] {CVE-2018-1118}
    - [net] ip: process in-order fragments efficiently (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [net] ip: use rb trees for IP frag queue (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [net] revert ipv4: use skb coalescing in defragmentation (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [net] modify skb_rbtree_purge to return the truesize of all purged skbs (Sabrina Dubroca) [1613924]     {CVE-2018-5391}
    - [net] ip: discard IPv4 datagrams with overlapping segments (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [net] speed up skb_rbtree_purge() (Sabrina Dubroca) [1613924] {CVE-2018-5391}
    - [fs] timerfd: Protect the might cancel mechanism proper (Bill O'Donnell) [1485407] {CVE-2017-10661}
    - [netdrv] bnx2x: disable GSO where gso_size is too big for hardware (Jonathan Toppins) [1546760]     {CVE-2018-1000026}
    - [net] create skb_gso_validate_mac_len() (Jonathan Toppins) [1546760] {CVE-2018-1000026}
    - [fs] aio: properly check iovec sizes (Jeff Moyer) [1337518] {CVE-2015-8830}
    - [fs] ext4: avoid running out of journal credits when appending to an inline file (Lukas Czerner)     [1609759] {CVE-2018-10883}
    - [fs] jbd2: don't mark block as modified if the handle is out of credits (Lukas Czerner) [1609759]     {CVE-2018-10883}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3096 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3083 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2948 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

    * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and calculation expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within     ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system.
    Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open     port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/3658021

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for     reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200; and Wen Xu for reporting     CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer     (Red Hat) and Ondrej Mosnacek (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of 'linux', 'linux-esx' packages of Photon OS has been released.

ID	Name	Product	Family	Severity
245686	Linux Distros Unpatched Vulnerability : CVE-2018-10322	Nessus	Misc.	medium
149098	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2021-1808)	Nessus	Huawei Local Security Checks	high
141448	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4578-1)	Nessus	Ubuntu Local Security Checks	high
141447	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4579-1)	Nessus	Ubuntu Local Security Checks	high
131845	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-2353)	Nessus	Huawei Local Security Checks	critical
124972	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1519)	Nessus	Huawei Local Security Checks	high
124830	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1507)	Nessus	Huawei Local Security Checks	high
123912	EulerOS Virtualization 2.5.4 : kernel (EulerOS-SA-2019-1226)	Nessus	Huawei Local Security Checks	medium
122699	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1076)	Nessus	Huawei Local Security Checks	high
121967	Photon OS 2.0: Linux PHSA-2018-2.0-0073	Nessus	PhotonOS Local Security Checks	medium
121868	Photon OS 1.0: Linux PHSA-2018-1.0-0169	Nessus	PhotonOS Local Security Checks	medium
121201	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4509)	Nessus	Oracle Linux Local Security Checks	high
120700	Fedora 28 : kernel (2018-ac3b4c7605)	Nessus	Fedora Local Security Checks	medium
119638	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2018-4304)	Nessus	Oracle Linux Local Security Checks	high
119187	Scientific Linux Security Update : kernel on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118990	CentOS 7 : kernel (CESA-2018:3083)	Nessus	CentOS Local Security Checks	high
118770	Oracle Linux 7 : kernel (ELSA-2018-3083)	Nessus	Oracle Linux Local Security Checks	high
118528	RHEL 7 : kernel-rt (RHSA-2018:3096)	Nessus	Red Hat Local Security Checks	high
118525	RHEL 7 : kernel (RHSA-2018:3083)	Nessus	Red Hat Local Security Checks	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	high
111947	Photon OS 1.0: Linux PHSA-2018-1.0-0169 (deprecated)	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2018-10322

medium

Tenable Plugins

medium

high

high

high

critical

high

high

medium

high

medium

medium

high

medium

high

high

high

high

high

high

high

medium