A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before 4.14.91 and before 4.19.13 are vulnerable.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3929-1 advisory.

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a     use after free. This could lead to local escalation of privilege with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-152735806 (CVE-2020-0429)

  - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
    Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767. (CVE-2020-12655)

  - An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection     tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote     user to crash the system, causing a denial of service. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-14305)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux     kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by     exhausting available memory. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20265)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - A flaw was found in the Linux kernel's CAPI over Bluetooth connection code. An attacker with a local     account can escalate privileges when CAPI (ISDN) hardware connection fails. (CVE-2021-34981)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking     subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the     system. The highest threat from this vulnerability is to system availability. (CVE-2021-3659)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem     with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be     accessible. (CVE-2021-3732)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may     cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl     (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3753)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat     to confidentiality, integrity, and system availability. (CVE-2021-3760)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user     calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or     escalate privileges on the system. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42739)

  - An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in     the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (CVE-2021-43389)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3935-1 advisory.

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 ignores unreachable code, even though it would     still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic     issue, could possibly be used by local users for denial of service. (CVE-2017-17862)

  - kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially     sensitive address information, aka a pointer leak. (CVE-2017-17864)

  - The inode_init_owner function in fs/inode.c in the Linux kernel through 3.16 allows local users to create     files with an unintended group ownership, in a scenario where a directory is SGID to a certain group and     is writable by a user who is not a member of that group. Here, the non-member can trigger creation of a     plain file whose group ownership is that group. The intended behavior was that the non-member can trigger     creation of a directory (but not a plain file) whose group ownership is that group. The non-member can     escalate privileges by making the plain file executable and SGID. (CVE-2018-13405)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a     use after free. This could lead to local escalation of privilege with System execution privileges needed.
    User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:
    A-152735806 (CVE-2020-0429)

  - An issue was discovered in xfs_agf_verify in fs/xfs/libxfs/xfs_alloc.c in the Linux kernel through 5.6.10.
    Attackers may trigger a sync of excessive duration via an XFS v5 image with crafted metadata, aka     CID-d0c7feaf8767. (CVE-2020-12655)

  - An out-of-bounds memory write flaw was found in how the Linux kernel's Voice Over IP H.323 connection     tracking functionality handled connections on ipv6 port 1720. This flaw allows an unauthenticated remote     user to crash the system, causing a denial of service. The highest threat from this vulnerability is to     confidentiality, integrity, as well as system availability. (CVE-2020-14305)

  - u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to     improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for     a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon     Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon     Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W,     MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150 (CVE-2020-3702)

  - IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive     information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
    (CVE-2020-4788)

  - A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux     kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by     exhausting available memory. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20265)

  - A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux     kernel functionality was found to allow the ability to quickly scan open UDP ports. This flaw allows an     off-path remote user to effectively bypass the source port UDP randomization. The highest threat from this     vulnerability is to confidentiality and possibly integrity, because software that relies on UDP source     port randomization are indirectly affected as well. (CVE-2021-20322)

  - An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-     device driver module in the Linux kernel before 5.12. A bound check failure allows an attacker with     special user (CAP_SYS_ADMIN) privilege to gain access to out-of-bounds memory leading to a system crash or     a leak of internal kernel information. The highest threat from this vulnerability is to system     availability. (CVE-2021-31916)

  - The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because     the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads     to writing an arbitrary value. (CVE-2021-33033)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects     the possibility of uninitialized memory locations on the BPF stack. (CVE-2021-34556)

  - A flaw was found in the Linux kernel's CAPI over Bluetooth connection code. An attacker with a local     account can escalate privileges when CAPI (ISDN) hardware connection fails. (CVE-2021-34981)

  - In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from     kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store     operation does not necessarily occur before a store operation that has an attacker-controlled value.
    (CVE-2021-35477)

  - A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the     way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del()     together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A     privileged local user could use this flaw to crash the system or escalate their privileges on the system.
    (CVE-2021-3640)

  - A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when     processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested     guest (L2). Due to improper validation of the int_ctl field, this issue could allow a malicious L1 to     enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest     would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak     of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to     5.14-rc7. (CVE-2021-3653)

  - A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on     inbound SCTP packets may allow the kernel to read uninitialized memory. (CVE-2021-3655)

  - A NULL pointer dereference flaw was found in the Linux kernel's IEEE 802.15.4 wireless networking     subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the     system. The highest threat from this vulnerability is to system availability. (CVE-2021-3659)

  - A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was     found in the way user uses trace ring buffer in a specific way. Only privileged local users (with     CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.
    (CVE-2021-3679)

  - A flaw was found in the Routing decision classifier in the Linux kernel's Traffic Control networking     subsystem in the way it handled changing of classification filters, leading to a use-after-free condition.
    This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat     from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2021-3715)

  - hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev     without checking for the NETREG_REGISTERED state, leading to a use-after-free and a double free.
    (CVE-2021-37159)

  - A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem     with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be     accessible. (CVE-2021-3732)

  - A use-after-free flaw was found in the Linux kernel's Bluetooth subsystem in the way user calls connect to     the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the     system or escalate their privileges. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-3752)

  - A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may     cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl     (KDSETMDE). The highest threat from this vulnerability is to data confidentiality. (CVE-2021-3753)

  - arch/powerpc/kvm/book3s_rtas.c in the Linux kernel through 5.13.5 on the powerpc platform allows KVM guest     OS users to cause host OS memory corruption via rtas_args.nargs, aka CID-f62f3c20647e. (CVE-2021-37576)

  - A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat     to confidentiality, integrity, and system availability. (CVE-2021-3760)

  - A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP     association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and     the attacker can send packets with spoofed IP addresses. (CVE-2021-3772)

  - ** DISPUTED ** In drivers/char/virtio_console.c in the Linux kernel before 5.13.4, data corruption or loss     can be triggered by an untrusted device that supplies a buf->len value exceeding the buffer size. NOTE:
    the vendor indicates that the cited data corruption is not a vulnerability in any existing use case; the     length validation was added solely for robustness in the face of anomalous host OS behavior.
    (CVE-2021-38160)

  - arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access     permissions of a shadow page, leading to a missing guest protection page fault. (CVE-2021-38198)

  - drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to     cause a denial of service (use-after-free and panic) by removing a MAX-3421 USB device in certain     situations. (CVE-2021-38204)

  - A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in     the Linux kernel through 5.13.13. (CVE-2021-40490)

  - The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab     out-of-bounds write. Input from a process that has the CAP_NET_ADMIN capability can lead to root access.
    (CVE-2021-42008)

  - A heap-based buffer overflow flaw was found in the Linux kernel FireDTV media card driver, where the user     calls the CA_SEND_MSG ioctl. This flaw allows a local user of the host machine to crash the system or     escalate privileges on the system. The highest threat from this vulnerability is to confidentiality,     integrity, as well as system availability. (CVE-2021-42739)

  - An issue was discovered in the Linux kernel before 5.14.15. There is an array-index-out-of-bounds flaw in     the detach_capi_ctr function in drivers/isdn/capi/kcapi.c. (CVE-2021-43389)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was found that the parse_rock_ridge_inode_internal()     function of the Linux kernel's ISOFS implementation did     not correctly check relocated directories when     processing Rock Ridge child link (CL) tags. An attacker     with physical access to the system could use a     specially crafted ISO image to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-5472i1/4%0

  - An issue was discovered in the Linux kernel's F2FS     filesystem code. An out-of-bounds access vulnerability     is possible the in __remove_dirty_segment() in     fs/f2fs/segment.c function when mounting a crafted f2fs     image.(CVE-2018-14614i1/4%0

  - Race condition in kernel/events/core.c in the Linux     kernel before 4.4 allows local users to gain privileges     or cause a denial of service via use-after-free     vulnerability by leveraging incorrect handling of an     swevent data structure during a CPU unplug     operation.(CVE-2015-8963i1/4%0

  - The skbs processed by ip_cmsg_recv() are not guaranteed     to be linear (e.g. when sending UDP packets over     loopback with MSGMORE). Using csum_partial() on     potentially the whole skb len is dangerous instead be     on the safe side and use skb_checksum(). This may lead     to an infoleak as the kernel memory may be checksummed     and sent as part of the packet.(CVE-2017-6347i1/4%0

  - The apic_get_tmcct function in arch/x86/kvm/lapic.c in     the KVM subsystem in the Linux kernel through 3.12.5     allows guest OS users to cause a denial of service     (divide-by-zero error and host OS crash) via crafted     modifications of the TMICT value.(CVE-2013-6367i1/4%0

  - A use-after-free issue was found in the way the Linux     kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In     nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the     'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on().
    A guest user/process could use this flaw to crash the     host kernel resulting in DoS or potentially gain     privileged access to a system.(CVE-2018-16882i1/4%0

  - It was discovered that the atl2_probe() function in the     Atheros L2 Ethernet driver in the Linux kernel     incorrectly enabled scatter/gather I/O. A remote     attacker could use this flaw to obtain potentially     sensitive information from the kernel     memory.(CVE-2016-2117i1/4%0

  - A flaw was found in the way the nft_flush_table()     function of the Linux kernel's netfilter tables     implementation flushed rules that were referencing     deleted chains. A local user who has the CAP_NET_ADMIN     capability could use this flaw to crash the     system.(CVE-2015-1573i1/4%0

  - The powermate_probe function in     drivers/input/misc/powermate.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2186i1/4%0

  - It was found that KVM's Write to Model Specific     Register (WRMSR) instruction emulation would write     non-canonical values passed in by the guest to certain     MSRs in the host's context. A privileged guest user     could use this flaw to crash the host.(CVE-2014-3610i1/4%0

  - The BPF_S_ANC_NLATTR_NEST extension implementation in     the sk_run_filter function in net/core/filter.c in the     Linux kernel through 3.14.3 uses the reverse order in a     certain subtraction, which allows local users to cause     a denial of service (over-read and system crash) via     crafted BPF instructions. NOTE: the affected code was     moved to the __skb_get_nlattr_nest function before the     vulnerability was announced.(CVE-2014-3145i1/4%0

  - The yam_ioctl function in drivers/net/hamradio/yam.c in     the Linux kernel before 3.12.8 does not initialize a     certain structure member, which allows local users to     obtain sensitive information from kernel memory by     leveraging the CAP_NET_ADMIN capability for an     SIOCYAMGCFG ioctl call.(CVE-2014-1446i1/4%0

  - A race condition flaw was found in the N_HLDC Linux     kernel driver when accessing n_hdlc.tbuf list that can     lead to double free. A local, unprivileged user able to     set the HDLC line discipline on the tty device could     use this flaw to increase their privileges on the     system.(CVE-2017-2636i1/4%0

  - A flaw was found in the way Linux kernel's Transparent     Huge Pages (THP) implementation handled non-huge page     migration. A local, unprivileged user could use this     flaw to crash the kernel by migrating transparent     hugepages.(CVE-2014-3940i1/4%0

  - A security flaw was found in the     chap_server_compute_md5() function in the ISCSI target     code in the Linux kernel in a way an authentication     request from an ISCSI initiator is processed. An     unauthenticated remote attacker can cause a stack     buffer overflow and smash up to 17 bytes of the stack.
    The attack requires the iSCSI target to be enabled on     the victim host. Depending on how the target's code was     built (i.e. depending on a compiler, compile flags and     hardware architecture) an attack may lead to a system     crash and thus to a denial of service or possibly to a     non-authorized access to data exported by an iSCSI     target. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is highly unlikely.(CVE-2018-14633i1/4%0

  - A vulnerability was found in the Linux kernel where     filesystems mounted with data=ordered mode may allow an     attacker to read stale data from recently allocated     blocks in new files after a system 'reset' by abusing     ext4 mechanics of delayed allocation.(CVE-2017-7495i1/4%0

  - drivers/media/platform/msm/broadcast/tsc.c in the TSC     driver for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allows attackers to cause a     denial of service (invalid pointer dereference) or     possibly have unspecified other impact via a crafted     application that makes a TSC_GET_CARD_STATUS ioctl     call.(CVE-2015-0573i1/4%0

  - It was found that the unlink and rename functionality     in overlayfs did not verify the upper dentry for     staleness. A local, unprivileged user could use the     rename syscall on overlayfs on top of xfs to panic or     crash the system.(CVE-2016-6197i1/4%0

  - In net/socket.c in the Linux kernel through 4.17.1,     there is a race condition between fchownat and close in     cases where they target the same socket file     descriptor, related to the sock_close and     sockfs_setattr functions. fchownat does not increment     the file descriptor reference count, which allows close     to set the socket to NULL during fchownat's execution,     leading to a NULL pointer dereference and system     crash.(CVE-2018-12232i1/4%0

  - The ath9k_htc_set_bssid_mask function in     drivers/net/wireless/ath/ath9k/htc_drv_main.c in the     Linux kernel through 3.12 uses a BSSID masking approach     to determine the set of MAC addresses on which a Wi-Fi     device is listening, which allows remote attackers to     discover the original MAC address after spoofing by     sending a series of packets to MAC addresses with     certain bit manipulations.(CVE-2013-4579i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the linux package has been released.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4541 advisory.

  - The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers     to observe page cache access patterns of other processes on the same system, potentially allowing sniffing     of secret information. (Fixing this affects the output of the fincore program.) Limited remote     exploitation may be possible, as demonstrated by latency differences in accessing public files from an     Apache HTTP Server. (CVE-2019-5489)

  - The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain     UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if     the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and     mm/userfaultfd.c. (CVE-2018-18397)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that a race condition existed in the vsock address family implementation of the Linux kernel that could lead to a use-after-free condition. A local attacker in a guest virtual machine could use this to expose sensitive information (host machine kernel memory). (CVE-2018-14625)

Cfir Cohen discovered that a use-after-free vulnerability existed in the KVM implementation of the Linux kernel, when handling interrupts in environments where nested virtualization is in use (nested KVM virtualization is not enabled by default in Ubuntu kernels). A local attacker in a guest VM could possibly use this to gain administrative privileges in a host machine. (CVE-2018-16882)

Wei Wu discovered that the KVM implementation in the Linux kernel did not properly ensure that ioapics were initialized. A local attacker could use this to cause a denial of service (system crash).
(CVE-2018-19407)

It was discovered that the crypto subsystem of the Linux kernel leaked uninitialized memory to user space in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-19854).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3871-5 advisory.

  - A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (CVE-2018-10876)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and     a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4     filesystem image. (CVE-2018-10878)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem image. (CVE-2018-10879)

  - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and     writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system     crash and a denial of service. (CVE-2018-10880)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in     fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4     filesystem image. (CVE-2018-10882)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in     jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10883)

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users     to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a     situation where ioapic is uninitialized. (CVE-2018-19407)

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3871-4 advisory.

  - A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (CVE-2018-10876)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and     a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4     filesystem image. (CVE-2018-10878)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem image. (CVE-2018-10879)

  - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and     writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system     crash and a denial of service. (CVE-2018-10880)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in     fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4     filesystem image. (CVE-2018-10882)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in     jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10883)

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users     to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a     situation where ioapic is uninitialized. (CVE-2018-19407)

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3871-3 advisory.

  - A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (CVE-2018-10876)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and     a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4     filesystem image. (CVE-2018-10878)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem image. (CVE-2018-10879)

  - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and     writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system     crash and a denial of service. (CVE-2018-10880)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in     fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4     filesystem image. (CVE-2018-10882)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in     jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10883)

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users     to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a     situation where ioapic is uninitialized. (CVE-2018-19407)

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3871-2 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3872-1 advisory.

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users     to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a     situation where ioapic is uninitialized. (CVE-2018-19407)

  - An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in     crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are     copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547     regression but with easier exploitability because the attacker does not need a capability (however, the     system must have the CONFIG_CRYPTO_USER kconfig option). (CVE-2018-19854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3871-1 advisory.

  - A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and operating a crafted ext4 image. (CVE-2018-10876)

  - Linux kernel ext4 filesystem is vulnerable to an out-of-bound access in the ext4_ext_drop_refs() function     when operating on a crafted ext4 filesystem image. (CVE-2018-10877)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write and     a denial of service or unspecified other impact is possible by mounting and operating a crafted ext4     filesystem image. (CVE-2018-10878)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem image. (CVE-2018-10879)

  - Linux kernel is vulnerable to a stack-out-of-bounds write in the ext4 filesystem code when mounting and     writing to a crafted ext4 image in ext4_update_inline_data(). An attacker could use this to cause a system     crash and a denial of service. (CVE-2018-10880)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in     fs/jbd2/transaction.c code, a denial of service, and a system crash by unmounting a crafted ext4     filesystem image. (CVE-2018-10882)

  - A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in     jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a     crafted ext4 filesystem image. (CVE-2018-10883)

  - A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-     memory from within a vm guest. A race condition between connect() and close() function may allow an     attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt     AF_VSOCK messages destined to other clients. (CVE-2018-14625)

  - A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts     when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while     processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor     address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash     the host kernel resulting in DoS or potentially gain privileged access to a system. Kernel versions before     4.14.91 and before 4.19.13 are vulnerable. (CVE-2018-16882)

  - An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through     4.18.11. It does not ensure that only root may inspect the kernel stack of an arbitrary task, allowing a     local attacker to exploit racy stack unwinding and leak kernel task stack contents. (CVE-2018-17972)

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - The vcpu_scan_ioapic function in arch/x86/kvm/x86.c in the Linux kernel through 4.19.2 allows local users     to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a     situation where ioapic is uninitialized. (CVE-2018-19407)

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
155910	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3929-1)	Nessus	SuSE Local Security Checks	high
155902	SUSE SLES12 Security Update : kernel (SUSE-SU-2021:3935-1)	Nessus	SuSE Local Security Checks	high
124810	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1486)	Nessus	Huawei Local Security Checks	critical
122919	Photon OS 2.0: Linux PHSA-2019-2.0-0138	Nessus	PhotonOS Local Security Checks	high
122894	Photon OS 1.0: Linux PHSA-2019-1.0-0211	Nessus	PhotonOS Local Security Checks	high
122141	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2019-4541)	Nessus	Oracle Linux Local Security Checks	high
122053	Ubuntu 18.10 : linux-azure vulnerabilities (USN-3878-2)	Nessus	Ubuntu Local Security Checks	high
122052	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Linux kernel (Azure) vulnerabilities (USN-3871-5)	Nessus	Ubuntu Local Security Checks	high
121595	Ubuntu 18.10 : linux, linux-aws, linux-gcp, linux-kvm, linux-raspi2 vulnerabilities (USN-3878-1)	Nessus	Ubuntu Local Security Checks	high
121594	Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3871-4)	Nessus	Ubuntu Local Security Checks	high
121593	Ubuntu 18.04 LTS : Linux kernel (AWS, GCP, KVM, OEM, Raspberry Pi 2) vulnerabilities (USN-3871-3)	Nessus	Ubuntu Local Security Checks	high
121592	Ubuntu 18.04 LTS : Linux kernel regression (USN-3871-2)	Nessus	Ubuntu Local Security Checks	high
121470	Ubuntu 18.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3872-1)	Nessus	Ubuntu Local Security Checks	high
121469	Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-3871-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2018-16882

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high