An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free. This will cause a denial of service.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:1769 advisory.

  - kernel: nfs: NULL pointer dereference due to an anomalized NFS message sequence (CVE-2018-16871)

  - Kernel: net: using kernel space address bits to derive IP ID may potentially break KASLR (CVE-2019-10639)

  - kernel: use-after-free in function __mdiobus_register() in drivers/net/phy/mdio_bus.c (CVE-2019-12819)

  - kernel: An out-of-bounds read in drivers/scsi/qedi/qedi_dbg.c leading to crash or information disclosure     (CVE-2019-15090)

  - kernel: a NULL pointer dereference in drivers/net/wireless/ath/ath10k/usb.c leads to a crash     (CVE-2019-15099)

  - kernel: Null pointer dereference in the sound/usb/line6/pcm.c (CVE-2019-15221)

  - kernel: Null pointer dereference in the sound/usb/line6/driver.c (CVE-2019-15223)

  - kernel: null pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c (CVE-2019-16234)

  - kernel: unprivileged users able to create RAW sockets in AF_IEEE802154 network protocol (CVE-2019-17053)

  - kernel: unprivileged users able to create RAW sockets in AF_ISDN network protocol (CVE-2019-17055)

  - kernel: The flow_dissector feature allows device tracking (CVE-2019-18282)

  - kernel: integer overflow in tcp_ack_update_rtt in net/ipv4/tcp_input.c (CVE-2019-18805)

  - kernel: dos in mlx5_fpga_conn_create_cq() function in drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c     (CVE-2019-19045)

  - kernel: dos in mlx5_fw_fatal_reporter_dump() function in drivers/net/ethernet/mellanox/mlx5/core/health.c     (CVE-2019-19047)

  - kernel: memory leak in the nl80211_get_ftm_responder_stats() function in net/wireless/nl80211.c allows DoS     (CVE-2019-19055)

  - kernel: Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c allows for a DoS (CVE-2019-19057)

  - kernel: A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c     allows for a DoS (CVE-2019-19058)

  - kernel: Multiple memory leaks in the iwl_pcie_ctxt_info_gen3_init() function in     drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c allows for a DoS (CVE-2019-19059)

  - kernel: A memory leak in the sdma_init() function in drivers/infiniband/hw/hfi1/sdma.c allows for a DoS     (CVE-2019-19065)

  - kernel: Four memory leaks in the acp_hw_init() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c allow     for a DoS (CVE-2019-19067)

  - kernel: Memory leaks in drivers/net/wireless/ath/ath9k/htc_hst.c in the Linux kernel (DOS)     (CVE-2019-19073)

  - kernel: a memory leak in the ath9k management function in allows local DoS (CVE-2019-19074)

  - kernel: memory leak in bnxt_re_create_srq function in drivers/infiniband/hw/bnxt_re/ib_verbs.c     (CVE-2019-19077)

  - kernel: malicious USB devices can lead to multiple out-of-bounds write (CVE-2019-19532)

  - kernel: information leak bug caused by a malicious USB device in the     drivers/net/can/usb/peak_usb/pcan_usb_core.c driver (CVE-2019-19534)

  - kernel: use-after-free in __blk_add_trace in kernel/trace/blktrace.c (CVE-2019-19768)

  - kernel: when cpu.cfs_quota_us is used allows attackers to cause a denial of service against non-cpu-bound     applications (CVE-2019-19922)

  - kernel: memory leak in the kernel_read_file function in fs/exec.c allows to cause a denial of service     (CVE-2019-8980)

  - kernel: use-after-free in cdev_put() when a PTP device is removed while it's chardev is open     (CVE-2020-10690)

  - kernel: some ipv6 protocols not encrypted over ipsec tunnel (CVE-2020-1749)

  - kernel: use-after-free in i915_ppgtt_close in drivers/gpu/drm/i915/i915_gem_gtt.c (CVE-2020-7053)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5715 advisory.

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - The Broadcom brcmfmac WiFi driver prior to commit 1b5e2423164b3670e8bc9174e4762d297990deff is vulnerable     to a heap buffer overflow. If the Wake-up on Wireless LAN functionality is configured, a malicious event     frame can be constructed to trigger an heap buffer overflow in the brcmf_wowl_nd_results function. This     vulnerability can be exploited with compromised chipsets to compromise the host, or when used in     combination with CVE-2019-9503, can be used remotely. In the worst case scenario, by sending specially-     crafted WiFi packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a     vulnerable system. More typically, this vulnerability will result in denial-of-service conditions.
    (CVE-2019-9500)

  - The Broadcom brcmfmac WiFi driver prior to commit a4176ec356c73a46c07c181c6d04039fafa34a9f is vulnerable     to a frame validation bypass. If the brcmfmac driver receives a firmware event frame from a remote source,     the is_wlc_event_frame function will cause this frame to be discarded and unprocessed. If the driver     receives the firmware event frame from the host, the appropriate handler is called. This frame validation     can be bypassed if the bus used is USB (for instance by a wifi dongle). This can allow firmware event     frames from a remote source to be processed. In the worst case scenario, by sending specially-crafted WiFi     packets, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system.
    More typically, this vulnerability will result in denial-of-service conditions. (CVE-2019-9503)

  - A memory leak in the mwifiex_pcie_alloc_cmdrsp_buf() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allows attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka CID-     db8fd2cde932. (CVE-2019-19056)

  - An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1.
    drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle     invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93. (CVE-2020-11609)

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip     driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary     code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and     connects to another STA. (CVE-2019-14897)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka     CID-d10dcb615c8e. (CVE-2019-19057)

  - A heap-based buffer overflow vulnerability was found in the Linux kernel, version kernel-2.6.32, in     Marvell WiFi chip driver. A remote attacker could cause a denial of service (system crash) or, possibly     execute arbitrary code, when the lbs_ibss_join_existing function is called after a STA connects to an AP.
    (CVE-2019-14896)

  - drivers/media/usb/dvb-usb/technisat-usb2.c in the Linux kernel through 5.2.9 has an out-of-bounds read via     crafted USB device traffic (which may be remote via usbip or usbredir). (CVE-2019-15505)

  - The flow_dissector feature in the Linux kernel 4.3 through 5.x before 5.3.10 has a device tracking     vulnerability, aka CID-55667441c84f. This occurs because the auto flowlabel of a UDP IPv6 packet relies on     a 32-bit hashrnd value as a secret, and because jhash (instead of siphash) is used. The hashrnd value     remains the same starting from boot time, and can be inferred by an attacker. This affects     net/core/flow_dissector.c and related code. (CVE-2019-18282)

  - The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors     in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka     CID-4ea99936a163. (CVE-2019-19767)

  - Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

  - ** DISPUTED ** An issue was discovered in the Linux kernel before 5.6. svm_cpu_uninit in     arch/x86/kvm/svm.c has a memory leak, aka CID-d80b64ff297e. NOTE: third parties dispute this issue because     it's a one-time leak at the boot, the size is negligible, and it can't be triggered at will.
    (CVE-2020-12768)

  - A memory leak in the mlx5_fpga_conn_create_cq() function in     drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c in the Linux kernel before 5.3.11 allows attackers to     cause a denial of service (memory consumption) by triggering mlx5_vector2eqn() failures, aka     CID-c8c2a057fdc7. (CVE-2019-19045)

  - A memory leak in the alloc_sgtable() function in drivers/net/wireless/intel/iwlwifi/fw/dbg.c in the Linux     kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering     alloc_page() failures, aka CID-b4b814fec1a5. (CVE-2019-19058)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Input: ff-memless - kill timer in destroy (Oliver     Neukum) [Orabug: 31213691] (CVE-2019-19524)

  - libertas: Fix two buffer overflows at parsing bss     descriptor (Wen Huang) [Orabug: 31351307]     (CVE-2019-14896) (CVE-2019-14897) (CVE-2019-14897)

  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Kees Cook)     [Orabug: 31352068] (CVE-2017-1000370) (CVE-2017-1000371)     (CVE-2017-1000370)

  - NFSv4.0: Remove transport protocol name from non-UCS     client ID (Chuck Lever) [Orabug: 31357212]

  - NFSv4.0: Remove cl_ipaddr from non-UCS client ID (Chuck     Lever) 

  - xen/manage: enable C_A_D to force reboot (Dongli Zhang)     [Orabug: 31387466]

  - acpi: disable erst (Wengang Wang) [Orabug: 31194253]

  - mdio_bus: Fix use-after-free on device_register fails     (YueHaibing) [Orabug: 31222292] (CVE-2019-12819)

  - rds: ib: Fix dysfunctional long address resolve timeout     (Hakon Bugge) 

  - vxlan: don't migrate permanent fdb entries during learn     (Roopa Prabhu) 

  - USB: iowarrior: fix use-after-free on disconnect (Johan     Hovold) [Orabug: 31351061] (CVE-2019-19528)

  - usb: iowarrior: fix deadlock on disconnect (Oliver     Neukum) [Orabug: 31351061] (CVE-2019-19528)

  - mremap: properly flush TLB before releasing the page     (Linus Torvalds) [Orabug: 31352011] (CVE-2018-18281)

  - Input: add safety guards to input_set_keycode (Dmitry     Torokhov) [Orabug: 31200558] (CVE-2019-20636)

  - media: stv06xx: add missing descriptor sanity checks     (Johan Hovold) [Orabug: 31200579] (CVE-2020-11609)

  - media: ov519: add missing endpoint sanity checks (Johan     Hovold) [Orabug: 31213758] (CVE-2020-11608)

  - media: xirlink_cit: add missing descriptor sanity checks     (Johan Hovold) [Orabug: 31213767] (CVE-2020-11668)

  - mwifiex: pcie: Fix memory leak in     mwifiex_pcie_init_evt_ring (Navid Emamdoost) [Orabug:
    31263147] (CVE-2019-19057)

  - USB: core: Fix races in character device registration     and deregistraion (Alan Stern) [Orabug: 31317667]     (CVE-2019-19537)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5708 advisory.

  - Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks.
    If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of     mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it     has been released back to the page allocator and reused. This is fixed in the following kernel versions:
    4.9.135, 4.14.78, 4.18.16, 4.19. (CVE-2018-18281)

  - An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL     pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka     CID-998912346c0d. (CVE-2020-11608)

  - An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1.
    drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle     invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93. (CVE-2020-11609)

  - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB     driver) mishandles invalid descriptors, aka CID-a246b4d54770. (CVE-2020-11668)

  - The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be     execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000     and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This     affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This     issue appears to be limited to i386 based systems. (CVE-2017-1000370)

  - A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip     driver. An attacker is able to cause a denial of service (system crash) or, possibly execute arbitrary     code, when a STA works in IBSS mode (allows connecting stations together without the use of an AP) and     connects to another STA. (CVE-2019-14897)

  - In the Linux kernel before 5.3.12, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/input/ff-memless.c driver, aka CID-fa3a5a1880c9. (CVE-2019-19524)

  - In the Linux kernel before 5.3.7, there is a use-after-free bug that can be caused by a malicious USB     device in the drivers/usb/misc/iowarrior.c driver, aka CID-edc4746f253d. (CVE-2019-19528)

  - In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB     device in the USB character device driver layer, aka CID-303911cfc5b9. This affects     drivers/usb/core/file.c. (CVE-2019-19537)

  - In the Linux kernel before 5.4.12, drivers/input/input.c has out-of-bounds writes via a crafted keycode     table, as demonstrated by input_set_keycode, aka CID-cb222aed03d7. (CVE-2019-20636)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - Two memory leaks in the mwifiex_pcie_init_evt_ring() function in     drivers/net/wireless/marvell/mwifiex/pcie.c in the Linux kernel through 5.3.11 allow attackers to cause a     denial of service (memory consumption) by triggering mwifiex_map_pci_memory() failures, aka     CID-d10dcb615c8e. (CVE-2019-19057)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc.Security Fix(es):In the Linux kernel     5.0.21, mounting a crafted ext4 filesystem image,     performing some operations, and unmounting can lead to     a use-after-free in ext4_put_super in fs/ext4/super.c,     related to dump_orphan_list in     fs/ext4/super.c.(CVE-2019-19447)Linux kernel CIFS     implementation, version 4.9.0 is vulnerable to a     relative paths injection in directory entry     lists.(CVE-2019-10220)** DISPUTED ** In kernel/compat.c     in the Linux kernel before 3.17, as used in Google     Chrome OS and other products, there is a possible     out-of-bounds read. restart_syscall uses uninitialized     data when restarting compat_sys_nanosleep. NOTE: this     is disputed because the code path is     unreachable.(CVE-2014-3180)In the Linux kernel before     5.0.6, there is a NULL pointer dereference in     drop_sysctl_table() in fs/proc/proc_sysctl.c, related     to put_links, aka     CID-23da9588037e(CVE-2019-20054)pointer dereference in     drivers/scsi/libsas/sas_discover.c because of     mishandling of port disconnection during discovery,     related to a PHY down race condition, aka     CID-f70267f379b5.(CVE-2019-19965)'In the Linux kernel     before 5.2.10, there is a race condition bug that can     be caused by a malicious USB device in the USB     character device driver layer, aka CID-303911cfc5b9.
    This affects     drivers/usb/core/file.c.(CVE-2019-19537)Linux Linux     kernel version at least v4.8 onwards, probably well     before contains a Insufficient input validation     vulnerability in bnx2x network card driver that can     result in DoS: Network card firmware assertion takes     card off-line. This attack appear to be exploitable via     An attacker on a must pass a very large, specially     crafted packet to the bnx2x card. This can be done from     an untrusted guest     VM..(CVE-2018-1000026)drivers/scsi/qla2xxx/qla_os.c in     the Linux kernel 5.2.14 does not check the     alloc_workqueue return value, leading to a NULL pointer     dereference.(CVE-2019-16233)The SCTP socket buffer used     by a userspace application is not accounted by the     cgroups subsystem. An attacker can use this flaw to     cause a denial of service attack. Kernel 3.10.x and     4.18.x branches are believed to be     vulnerable.(CVE-2019-3874)fs/ext4/extents.c in the     Linux kernel through 5.1.2 does not zero out the unused     memory region in the extent tree block, which might     allow local users to obtain sensitive information by     reading uninitialized data in the     filesystem.(CVE-2019-11833)A memory leak in the     ql_alloc_large_buffers() function in     driverset/ethernet/qlogic/qla3xxx.c in the Linux kernel     before 5.3.5 allows local users to cause a denial of     service (memory consumption) by triggering     pci_dma_mapping_error() failures, aka     CID-1acb8f2a7a9f.(CVE-2019-18806)An issue was     discovered in the Linux kernel before 5.0.11.
    fm10k_init_module in     driverset/ethernet/intel/fm10k/fm10k_main.c has a NULL     pointer dereference because there is no -ENOMEM upon an     alloc_workqueue failure.(CVE-2019-15924)An issue was     discovered in the Linux kernel before 5.0.1. There is a     memory leak in register_queue_kobjects() in     net/coreet-sysfs.c, which will cause denial of     service.(CVE-2019-15916)An issue was discovered in the     Linux kernel before 5.0.14. There is a NULL pointer     dereference caused by a malicious USB device in the     drivers/usb/misc/yurex.c driver.(CVE-2019-15216)An     issue was discovered in the Linux kernel before 5.1.8.
    There is a double-free caused by a malicious USB device     in the drivers/usb/misc/rio500.c     driver.(CVE-2019-15212)An issue was discovered in     drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before     5.1.12. In the qedi_dbg_* family of functions, there is     an out-of-bounds read.(CVE-2019-15090)An issue was     discovered in the Linux kernel before 5.0. The function
    __mdiobus_register() in driverset/phy/mdio_bus.c calls     put_device(), which will trigger a fixed_mdio_bus_init     use-after-free. This will cause a denial of     service.(CVE-2019-12819)** DISPUTED ** An issue was     discovered in the MPT3COMMAND case in _ctl_ioctl_main     in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux     kernel through 5.1.5. It allows local users to cause a     denial of service or possibly have unspecified other     impact by changing the value of ioc_number between two     kernel reads of that value, aka a 'double fetch'     vulnerability. NOTE: a third party reports that this is     unexploitable because the doubly fetched value is not     used.(CVE-2019-12456)An issue was discovered in     drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c in the Linux kernel     through 5.1.5. There is an unchecked kstrdup of fwstr,     which might allow an attacker to cause a denial of     service (NULL pointer dereference and system crash).
    NOTE: The vendor disputes this issues as not being a     vulnerability because kstrdup() returning NULL is     handled sufficiently and there is no chance for a NULL     pointer dereference.(CVE-2019-12382)In the Linux Kernel     before version 4.15.8, 4.14.25, 4.9.87, 4.4.121,     4.1.51, and 3.2.102, an error in the     '_sctp_make_chunk()' function     (net/sctp/sm_make_chunk.c) when handling SCTP packets     length can be exploited to cause a kernel     crash.(CVE-2018-5803)An issue was discovered in the     Linux kernel before 4.14.11. A double free may be     caused by the function allocate_trace_buffer in the     file kernel/trace/trace.c.(CVE-2017-18595)An issue was     discovered in drivers/i2c/i2c-core-smbus.c in the Linux     kernel before 4.14.15. There is an out of bounds write     in the function     i2c_smbus_xfer_emulated.(CVE-2017-18551)An issue was     discovered in drivers/scsi/aacraid/commctrl.c in the     Linux kernel before 4.13. There is potential exposure     of kernel stack memory because aac_get_hba_info does     not initialize the hbainfo structure.(CVE-2017-18550)An     issue was discovered in drivers/scsi/aacraid/commctrl.c     in the Linux kernel before 4.13. There is potential     exposure of kernel stack memory because     aac_send_raw_srb does not initialize the reply     structure.(CVE-2017-18549)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 15 SP1 RT kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1103186)CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1111331)CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash). (bsc#1136586)

CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699).

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)

CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)

CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests.
(bsc#1133190)

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)

CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)

CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)

CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice. This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)

CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848)

CVE-2019-9500: An issue was discovered that lead to brcmfmac heap buffer overflow. (bsc#1132681)

CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access.
(bsc#1135278)

CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bsc#1135278)

CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may have lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out. (bsc#1122767)

CVE-2019-12819: The function __mdiobus_register() called put_device(), which triggered a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bsc#1138291)

CVE-2019-3882: A flaw was found in the Linux kernel's vfio interface implementation that permitted violation of the user's locked memory limit. If a device was bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may have caused a system memory exhaustion and thus a denial of service (DoS). (bsc#1131427)

CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bsc#1136424)

CVE-2019-8564: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132673)

CVE-2019-9503: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132828)

CVE-2019-9003: In the Linux kernel, attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop. (bsc#1126704)

CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data.
Further, it would consume additional resources such as CPU and NIC processing power.

CVE-2018-16871: A NULL pointer dereference due to an anomalized NFS message sequence was fixed. (bnc#1137103).

CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c. There was an unchecked kstrdup of prop->name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).

CVE-2019-12817: On the PowerPC architecture, local attackers could access other users processes memory (bnc#1138263).

CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).

CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses (bnc#1140575 1140577).

CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image was exposed. This attack could be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable because IP ID generation was changed to have a dependency on an address associated with a network namespace (bnc#1140577).

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c (bnc#1131645 1133738).

CVE-2019-13233: In arch/x86/lib/insn-eval.c in the Linux kernel, there was a use-after-free for access to an LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds violation (bnc#1140454).

CVE-2018-20855: An issue was discovered in the Linux kernel In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).

CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).

CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasas_create_frame_pool() failed in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).

CVE-2019-13631: In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame.
(bnc#1142254)

CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default.
(bnc#1143191)

CVE-2019-14284: In the Linux kernel, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-zero.
(bnc#1143189)

CVE-2019-12456: An issue was discovered in the MPT3COMMAND case in
_ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux. It allows local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a 'double fetch' vulnerability.
NOTE: a third-party reports that this is unexploitable because the doubly fetched value is not used. (bsc#1136922)

CVE-2019-12380: An issue was discovered in the efi subsystem in the Linux kernel phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures.
(bsc#1136598)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The kernel package contains the Linux kernel (vmlinuz),     the core of any Linux operating system. The kernel     handles the basic functions of the operating system:
    memory allocation, process allocation, device input and     output, etc. Security Fix(es):A flaw was found in the     Linux kernel's NFS implementation, all versions 3.x and     all versions 4.x up to 4.20. An attacker, who is able     to mount an exported NFS filesystem, is able to trigger     a null pointer dereference by using an invalid NFS     sequence. This can panic the machine and deny access to     the NFS server. Any outstanding disk writes to the NFS     server will be lost.(CVE-2018-16871)An issue was     discovered in the Linux kernel before 4.18.7. In     create_qp_common in drivers/infiniband/hw/mlx5/qp.c,     mlx5_ib_create_qp_resp was never initialized, resulting     in a leak of stack memory to     userspace.(CVE-2018-20855)An issue was discovered in     the Linux kernel before 4.18.7. In block/blk-core.c,     there is an __blk_drain_queue() use-after-free because     a certain error case is mishandled.(CVE-2018-20856)The     Linux kernel 4.x (starting from 4.1) and 5.x before     5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass.
    Specifically, it is possible to extract the KASLR     kernel image offset using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a     static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is     exposed. This attack can be carried out remotely, by     the attacker forcing the target device to send UDP or     ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is     trivial if the server is a DNS server. ICMP traffic is     trivial if the server answers ICMP Echo requests     (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used     to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became     viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a     network namespace.(CVE-2019-10639)** DISPUTED ** An     issue was discovered in ip6_ra_control in     net/ipv6/ipv6_sockglue.c in the Linux kernel through     5.1.5. There is an unchecked kmalloc of new_ra, which     might allow an attacker to cause a denial of service     (NULL pointer dereference and system crash). NOTE: This     has been disputed as not an     issue.(CVE-2019-12378)**DISPUTED** An issue was     discovered in the efi subsystem in the Linux kernel     through 5.1.5. phys_efi_set_virtual_address_map in     arch/x86/platform/efi/efi.c and efi_call_phys_prolog in     arch/x86/platform/efi/efi_64.c mishandle memory     allocation failures. NOTE: This id is disputed as not     being an issue because ?All the code touched by the     referenced commit runs only at boot, before any user     processes are started. Therefore, there is no     possibility for an unprivileged user to control     it.?.(CVE-2019-12380)** DISPUTED ** An issue was     discovered in ip_ra_control in net/ipv4/ip_sockglue.c     in the Linux kernel through 5.1.5. There is an     unchecked kmalloc of new_ra, which might allow an     attacker to cause a denial of service (NULL pointer     dereference and system crash). NOTE: this is disputed     because new_ra is never used if it is     NULL.(CVE-2019-12381)** DISPUTED ** An issue was     discovered in the MPT3COMMAND case in _ctl_ioctl_main     in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux     kernel through 5.1.5. It allows local users to cause a     denial of service or possibly have unspecified other     impact by changing the value of ioc_number between two     kernel reads of that value, aka a 'double fetch'     vulnerability. NOTE: a third party reports that this is     unexploitable because the doubly fetched value is not     used.(CVE-2019-12456)An issue was discovered in the     Linux kernel before 4.20.15. The nfc_llcp_build_tlv     function in netfc/llcp_commands.c may return NULL. If     the caller does not check for this, it will trigger a     NULL pointer dereference. This will cause denial of     service. This affects nfc_llcp_build_gb in     netfc/llcp_core.c.(CVE-2019-12818)An issue was     discovered in the Linux kernel before 5.0. The function
    __mdiobus_register() in driverset/phy/mdio_bus.c calls     put_device(), which will trigger a fixed_mdio_bus_init     use-after-free. This will cause a denial of     service.(CVE-2019-12819)A NULL pointer dereference     vulnerability in the function     nfc_genl_deactivate_target() in netfcetlink.c in the     Linux kernel before 5.1.13 can be triggered by a     malicious user-mode program that omits certain NFC     attributes, leading to denial of     service.(CVE-2019-12984)In the Linux kernel before     5.1.17, ptrace_link in kernel/ptrace.c mishandles the     recording of the credentials of a process that wants to     create a ptrace relationship, which allows local users     to obtain root access by leveraging certain scenarios     with a parent-child process relationship, where a     parent drops privileges and calls execve (potentially     allowing control by an attacker). One contributing     factor is an object lifetime issue (which can also     cause a panic). Another contributing factor is     incorrect marking of a ptrace relationship as     privileged, which is exploitable through (for example)     Polkit's pkexec helper with PTRACE_TRACEME. NOTE:
    SELinux deny_ptrace might be a usable workaround in     some environments.(CVE-2019-13272)In     parse_hid_report_descriptor in     drivers/input/tablet/gtco.c in the Linux kernel through     5.2.1, a malicious USB device can send an HID report     that triggers an out-of-bounds write during generation     of debugging messages.(CVE-2019-13631)In the Linux     kernel through 5.2.1 on the powerpc platform, when     hardware transactional memory is disabled, a local user     can cause a denial of service (TM Bad Thing exception     and system crash) via a sigreturn() system call that     sends a crafted signal frame. This affects     arch/powerpc/kernel/signal_32.c and     arch/powerpc/kernel/signal_64.c.(CVE-2019-13648)In the     Linux kernel before 5.2.3, set_geometry in     drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and     out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been     inserted. NOTE: QEMU creates the floppy device by     default.(CVE-2019-14283)In the Linux kernel before     5.2.3, drivers/block/floppy.c allows a denial of     service by setup_format_params division-by-zero. Two     consecutive ioctls can trigger the bug: the first one     should set the drive geometry with .sect and .rate     values that make F_SECT_PER_TRACK be zero. Next, the     floppy format operation should be called. It can be     triggered by an unprivileged local user even when a     floppy disk has not been inserted. NOTE: QEMU creates     the floppy device by default.(CVE-2019-14284)In the     Linux kernel before 4.16.4, a double-locking error in     drivers/usb/dwc3/gadget.c may potentially cause a     deadlock with f_hid.(CVE-2019-14763)An issue was     discovered in the Linux kernel before 5.2.6. There is a     use-after-free caused by a malicious USB device in the     drivers/media/v4l2-core/v4l2-dev.c driver because     drivers/media/radio/radio-raremono.c does not properly     allocate memory.(CVE-2019-15211)An issue was discovered     in the Linux kernel before 5.0.9. There is a     use-after-free in atalk_proc_exit, related to     net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and     net/appletalk/sysctl_net_atalk.c.(CVE-2019-15292)A flaw     was found in the way the sit_init_net function in the     Linux kernel handled resource cleanup on errors. This     flaw allows an attacker to use the error conditions to     crash the system.(CVE-2019-16994)Note:
    kernel-4.19.36-vhulk1907.1.0.h529 and earlier versions     in EulerOS Virtualization for ARM 64 3.0.2.0 return     incorrect time information when executing the uname -a     command.

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4118-1 advisory.

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

  - An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer     dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted     xfs image. This occurs because of a lack of proper validation that cached inodes are free during     allocation. (CVE-2018-13093)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-     bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted     f2fs image. (CVE-2018-13096)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds     read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a     denial of service (BUG). (CVE-2018-13097)

  - An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab     out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set     in an inode. (CVE-2018-13098)

  - An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-     bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode     contains an invalid reserved blkaddr. (CVE-2018-13099)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly     validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.
    (CVE-2018-13100)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc     rb_trees when reloc control has not been initialized. (CVE-2018-14609)

  - An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in     write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification     that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in     fs/btrfs/extent-tree.c. (CVE-2018-14610)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in     try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in     btrfs_check_chunk_valid in fs/btrfs/volumes.c. (CVE-2018-14611)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping     validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in     check_leaf in fs/btrfs/tree-checker.c. (CVE-2018-14612)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item     validation in check_leaf_item in fs/btrfs/tree-checker.c. (CVE-2018-14613)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in
    __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image. (CVE-2018-14614)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in     truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be     negative. (CVE-2018-14615)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in     fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.
    (CVE-2018-14616)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic     in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
    (CVE-2018-14617)

  - A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after     the final file truncation (removal). The new file created with the same inode may contain leftover pages     from cleancache and the old file data instead of the new one. (CVE-2018-16862)

  - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num     from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds     (OOB) read that potentially allows arbitrary read in the kernel address space. (CVE-2018-19985)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to     cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other     impact by inducing a high load. (CVE-2018-20784)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

  - Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and     iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate     elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may     allow a remote attacker to obtain the encryption key used by the device. (CVE-2018-5383)

  - Insufficient access control in the Intel(R) PROSet/Wireless WiFi Software driver before version 21.10 may     allow an unauthenticated user to potentially enable denial of service via adjacent access. (CVE-2019-0136)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before     4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware     could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.
    (CVE-2019-10207)

  - In the Linux kernel before 5.1.7, a device can be tracked by an attacker using the IP ID values the kernel     produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple     destination IP addresses, it is possible to obtain hash collisions (of indices to the counter array) and     thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page     that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (CVE-2019-10638)

  - The Linux kernel 4.x (starting from 4.1) and 5.x before 5.0.8 allows Information Exposure (partial kernel     address disclosure), leading to a KASLR bypass. Specifically, it is possible to extract the KASLR kernel     image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and     ICMP). When such traffic is sent to multiple destination IP addresses, it is possible to obtain hash     collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This     key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via     enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the     attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled     IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic     is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the     attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP     addresses. NOTE: this attack against KASLR became viable in 4.1 because IP ID generation was changed to     have a dependency on an address associated with a network namespace. (CVE-2019-10639)

  - Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux before version 5.0     may allow an authenticated user to potentially enable escalation of privilege via local access.
    (CVE-2019-11085)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - The coredump implementation in the Linux kernel before 5.0.10 does not use locking or other mechanisms to     prevent vma layout or vma flags changes while it runs, which allows local users to obtain sensitive     information, cause a denial of service, or possibly have unspecified other impact by triggering a race     condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c,     fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c. (CVE-2019-11599)

  - An issue was discovered in the Linux kernel before 5.0.7. A NULL pointer dereference can occur when     megasas_create_frame_pool() fails in megasas_alloc_cmds() in drivers/scsi/megaraid/megaraid_sas_base.c.
    This causes a Denial of Service, related to a use-after-free. (CVE-2019-11810)

  - An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel before 5.0.8. There is a     race condition leading to a use-after-free, related to net namespace cleanup. (CVE-2019-11815)

  - fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the     extent tree block, which might allow local users to obtain sensitive information by reading uninitialized     data in the filesystem. (CVE-2019-11833)

  - The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a     local user to obtain potentially sensitive information from kernel stack memory via a HIDPCONNADD command,     because a name field may not end with a '\0' character. (CVE-2019-11884)

  - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL     pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in     net/nfc/llcp_core.c. (CVE-2019-12818)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c     in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC     attributes, leading to denial of service. (CVE-2019-12984)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the     credentials of a process that wants to create a ptrace relationship, which allows local users to obtain     root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops     privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an     object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of     a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper     with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
    (CVE-2019-13272)

  - In parse_hid_report_descriptor in drivers/input/tablet/gtco.c in the Linux kernel through 5.2.1, a     malicious USB device can send an HID report that triggers an out-of-bounds write during generation of     debugging messages. (CVE-2019-13631)

  - In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and     head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an     unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by     default. (CVE-2019-14283)

  - In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params     division-by-zero. Two consecutive ioctls can trigger the bug: the first one should set the drive geometry     with .sect and .rate values that make F_SECT_PER_TRACK be zero. Next, the floppy format operation should     be called. It can be triggered by an unprivileged local user even when a floppy disk has not been     inserted. NOTE: QEMU creates the floppy device by default. (CVE-2019-14284)

  - In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially     cause a deadlock with f_hid. (CVE-2019-14763)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the     qedi_dbg_* family of functions, there is an out-of-bounds read. (CVE-2019-15090)

  - An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c     does not properly allocate memory. (CVE-2019-15211)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c driver. (CVE-2019-15212)

  - An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound     subsystem because card disconnection causes certain data structures to be deleted too early. This is     related to sound/core/init.c and sound/core/info.c. (CVE-2019-15214)

  - An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver. (CVE-2019-15215)

  - An issue was discovered in the Linux kernel before 5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c driver. (CVE-2019-15216)

  - An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/media/usb/siano/smsusb.c driver. (CVE-2019-15218)

  - An issue was discovered in the Linux kernel before 5.2.1. There is a use-after-free caused by a malicious     USB device in the drivers/net/wireless/intersil/p54/p54usb.c driver. (CVE-2019-15220)

  - An issue was discovered in the Linux kernel before 5.1.17. There is a NULL pointer dereference caused by a     malicious USB device in the sound/usb/line6/pcm.c driver. (CVE-2019-15221)

  - An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit,     related to net/appletalk/atalk_proc.c, net/appletalk/ddp.c, and net/appletalk/sysctl_net_atalk.c.
    (CVE-2019-15292)

  - In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to     local escalation of privilege with no additional execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References:
    Upstream kernel (CVE-2019-2024)

  - In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input     validation. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel.
    Android ID: A-111760968. (CVE-2019-2101)

  - An issue was discovered in can_can_gw_rcv in net/can/gw.c in the Linux kernel through 4.19.13. The CAN     frame modification rules allow bitwise logical operations that can be also applied to the can_dlc field.
    The privileged user root with CAP_NET_ADMIN can create a CAN frame modification rule that makes the data     length code a higher value than the available CAN frame data size. In combination with a configured     checksum calculation where the result is stored relatively to the end of the data (e.g. cgw_csum_xor_rel)     the tail of the skb (e.g. frag_list pointer in skb_shared_info) can be rewritten which finally can cause a     system crash. Because of a missing check, the CAN drivers may write arbitrary content beyond the data     registers in the CAN controller's I/O memory when processing can-gw manipulated outgoing frames.
    (CVE-2019-3701)

  - A flaw was found in the Linux kernel in the function hid_debug_events_read() in drivers/hid/hid-debug.c     file which may enter an infinite loop with certain parameters passed from a userspace. A local privileged     user (root) can cause a system lock up and a denial of service. Versions from v4.18 and newer are     vulnerable. (CVE-2019-3819)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing the key length negotiation. This allows practical     brute-force attacks (aka KNOB) that can decrypt traffic and inject arbitrary ciphertext without the     victim noticing. (CVE-2019-9506)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4094-1 advisory.

  - The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an     integer overflow via a large relative timeout because ktime_add_safe is not used. (CVE-2018-13053)

  - An issue was discovered in fs/xfs/xfs_icache.c in the Linux kernel through 4.17.3. There is a NULL pointer     dereference and panic in lookup_slow() on a NULL inode->i_ops pointer when doing pathwalks on a corrupted     xfs image. This occurs because of a lack of proper validation that cached inodes are free during     allocation. (CVE-2018-13093)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.14. A denial of service (out-of-     bounds memory access and BUG) can occur upon encountering an abnormal bitmap size when mounting a crafted     f2fs image. (CVE-2018-13096)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3. There is an out-of-bounds     read or a divide-by-zero error for an incorrect user_block_count in a corrupted f2fs image, leading to a     denial of service (BUG). (CVE-2018-13097)

  - An issue was discovered in fs/f2fs/inode.c in the Linux kernel through 4.17.3. A denial of service (slab     out-of-bounds read and BUG) can occur for a modified f2fs filesystem image in which FI_EXTRA_ATTR is set     in an inode. (CVE-2018-13098)

  - An issue was discovered in fs/f2fs/inline.c in the Linux kernel through 4.4. A denial of service (out-of-     bounds memory access and BUG) can occur for a modified f2fs filesystem image in which an inline inode     contains an invalid reserved blkaddr. (CVE-2018-13099)

  - An issue was discovered in fs/f2fs/super.c in the Linux kernel through 4.17.3, which does not properly     validate secs_per_zone in a corrupted f2fs image, as demonstrated by a divide-by-zero error.
    (CVE-2018-13100)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in
    __del_reloc_root() in fs/btrfs/relocation.c when mounting a crafted btrfs image, related to removing reloc     rb_trees when reloc control has not been initialized. (CVE-2018-14609)

  - An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in     write_extent_buffer() when mounting and operating a crafted btrfs image, because of a lack of verification     that each block group has a corresponding chunk at mount time, within btrfs_read_block_groups in     fs/btrfs/extent-tree.c. (CVE-2018-14610)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in     try_merge_free_space() when mounting a crafted btrfs image, because of a lack of chunk type flag checks in     btrfs_check_chunk_valid in fs/btrfs/volumes.c. (CVE-2018-14611)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     btrfs_root_node() when mounting a crafted btrfs image, because of a lack of chunk block group mapping     validation in btrfs_read_block_groups in fs/btrfs/extent-tree.c, and a lack of empty-tree checks in     check_leaf in fs/btrfs/tree-checker.c. (CVE-2018-14612)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in     io_ctl_map_page() when mounting and operating a crafted btrfs image, because of a lack of block group item     validation in check_leaf_item in fs/btrfs/tree-checker.c. (CVE-2018-14613)

  - An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in
    __remove_dirty_segment() in fs/f2fs/segment.c when mounting an f2fs image. (CVE-2018-14614)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in     truncate_inline_inode() in fs/f2fs/inline.c when umounting an f2fs image, because a length value may be     negative. (CVE-2018-14615)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in     fscrypt_do_page_crypto() in fs/crypto/crypto.c when operating on a file in a corrupted f2fs image.
    (CVE-2018-14616)

  - An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic     in hfsplus_lookup() in fs/hfsplus/dir.c when opening a file (that is purportedly a hard link) in an hfs+     filesystem that has malformed catalog data, and is mounted read-only without a metadata directory.
    (CVE-2018-14617)

  - A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after     the final file truncation (removal). The new file created with the same inode may contain leftover pages     from cleancache and the old file data instead of the new one. (CVE-2018-16862)

  - An issue was discovered in the Linux kernel before 4.19.9. The USB subsystem mishandles size checks during     the reading of an extra descriptor, related to __usb_get_extra_descriptor in drivers/usb/core/usb.c.
    (CVE-2018-20169)

  - An issue was discovered in the Linux kernel before 4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain error case is mishandled. (CVE-2018-20856)

  - Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and     iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate     elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may     allow a remote attacker to obtain the encryption key used by the device. (CVE-2018-5383)

  - A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead to memory corruption and possibly other     consequences. (CVE-2019-10126)

  - An information disclosure vulnerability exists when certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL     pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in     net/nfc/llcp_core.c. (CVE-2019-12818)

  - An issue was discovered in the Linux kernel before 5.0. The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which will trigger a fixed_mdio_bus_init use-after-free.
    This will cause a denial of service. (CVE-2019-12819)

  - A NULL pointer dereference vulnerability in the function nfc_genl_deactivate_target() in net/nfc/netlink.c     in the Linux kernel before 5.1.13 can be triggered by a malicious user-mode program that omits certain NFC     attributes, leading to denial of service. (CVE-2019-12984)

  - In arch/x86/lib/insn-eval.c in the Linux kernel before 5.1.9, there is a use-after-free for access to an     LDT entry because of a race condition between modify_ldt() and a #BR exception for an MPX bounds     violation. (CVE-2019-13233)

  - In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the     credentials of a process that wants to create a ptrace relationship, which allows local users to obtain     root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops     privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an     object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of     a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper     with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.
    (CVE-2019-13272)

  - In em28xx_unregister_dvb of em28xx-dvb.c, there is a possible use after free issue. This could lead to     local escalation of privilege with no additional execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-111761954References:
    Upstream kernel (CVE-2019-2024)

  - In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input     validation. This could lead to local information disclosure with no additional execution privileges     needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel.
    Android ID: A-111760968. (CVE-2019-2101)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 15 kernel version 4.12.14 was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-10638: Attackers used to be able to track the Linux kernel by the IP ID values the kernel produces for connection-less protocols.
When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack could have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. [bnc#1140575]

CVE-2019-10639: The Linux kernel used to allow Information Exposure (partial kernel address disclosure), leading to a KASLR bypass.
Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols. When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image was exposed. This attack could be carried out remotely by the attacker forcing the target device to send UDP or ICMP traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server.
ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visits the attacker's web page, then WebRTC or gQUIC can be used to force UDP traffic to attacker-controlled IP addresses. [bnc#1140577]

CVE-2018-20836: A race condition used to exist in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. [bnc#1134395]

CVE-2019-10126: A heap-based buffer overflow in the wireless driver code was fixed. This issue might have lead to memory corruption and possibly other consequences. [bnc#1136935]

CVE-2019-11599: The coredump implementation did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls.
[bnc#1131645].

CVE-2019-12614: There was an unchecked kstrdup of prop->name on PowerPC platforms, which allowed an attacker to cause a denial of service (NULL pointer dereference and system crash). [bnc#1137194]

CVE-2018-16871: A flaw was found in the NFS implementation. An attacker who was able to mount an exported NFS filesystem was able to trigger a NULL pointer dereference by an invalid NFS sequence. This could panic the machine and deny access to the NFS server. Any outstanding disk writes to the NFS server will were lost.
[bnc#1137103]

CVE-2019-12819: The function __mdiobus_register() used to call put_device(), which would trigger a fixed_mdio_bus_init use-after-free error. This would cause a denial of service. [bnc#1138291]

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller did not check for this, it could trigger a NULL pointer dereference. This would cause denial of service. [bnc#1138293]

CVE-2019-12456: An issue in the MPT3COMMAND case in _ctl_ioctl_main() allowed local users to cause a denial of service or possibly have unspecified other impact by changing the value of ioc_number between two kernel reads of that value, aka a 'double fetch' vulnerability.
[bsc#1136922]

CVE-2019-12380: An issue was in the EFI subsystem existed that mishandled memory allocation failures. Note, however, that all relevant code runs only at boot-time, before any user processes are started. Therefore, there was no possibility for an unprivileged user to exploit this issue. [bnc#1136598]

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses (bnc#1140575 1140577).

CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), that lead to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic is sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image is exposed. This attack could be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses.
Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visited the attacker's web page, then WebRTC or gQUIC could be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable because IP ID generation was changed to have a dependency on an address associated with a network namespace (bnc#1140577).

CVE-2019-10126: A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might have lead to memory corruption and possibly other consequences (bnc#1136935).

CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free (bnc#1134395).

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm call. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c (bnc#1131645 1133738).

CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel There was an unchecked kstrdup of prop-name, which might have allowed an attacker to cause a denial of service (NULL pointer dereference and system crash) (bnc#1137194).

CVE-2019-12819: An issue was discovered in the Linux kernel The function __mdiobus_register() in drivers/net/phy/mdio_bus.c calls put_device(), which would trigger a fixed_mdio_bus_init use-after-free. This would cause a denial of service (bnc#1138291).

CVE-2019-12818: An issue was discovered in the Linux kernel The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller did not check for this, it would trigger a NULL pointer dereference. This would cause a denial of service. This affected nfc_llcp_build_gb in net/nfc/llcp_core.c (bnc#1138293).

CVE-2019-12456: A double-fetch bug in _ctl_ioctl_main() could lead to a local denial of service attack (bsc#1136922 CVE-2019-12456).

CVE-2019-12380: An issue was discovered in the efi subsystem in the Linux kernel phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures.
NOTE: This id is disputed as not being an issue because ;All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it (bnc#1136598).

CVE-2019-11487: The Linux kernel before allowed page-_refcount reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests (bnc#1133190 1133191).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-10638: A device could have been tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may have been conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)

CVE-2019-10639: Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP).
When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key is extracted (via enumeration), the offset of the kernel image was exposed. This attack could have been carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses. Forcing a server to send UDP traffic is trivial if the server is a DNS server.
ICMP traffic was trivial if the server answered ICMP Echo requests (ping). For client targets, if the target visited the attacker's web page, then WebRTC or gQUIC could be used to force UDP traffic to attacker-controlled IP addresses. (bnc#1140577)

CVE-2018-20836: A race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, could have lead to a use-after-free. (bnc#1134395)

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it runs, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.
(bnc#1133738)

CVE-2019-12614: An unchecked kstrdup might have allowed an attacker to cause denial of service (a NULL pointer dereference and system crash).
(bnc#1137194)

CVE-2019-12819: The function __mdiobus_register() in drivers/net/phy/mdio_bus.c called put_device() which would trigger a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bnc#1138291)

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may have returned NULL. If the caller did not check for this, it would trigger a NULL pointer dereference. This would cause denial of service. (bnc#1138293)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP 2 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-10638: In the Linux kernel, a device could be tracked by an attacker using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). An attack may be conducted by hosting a crafted web page that uses WebRTC or gQUIC to force UDP traffic to attacker-controlled IP addresses. (bnc#1140575)

CVE-2019-10639: The Linux kernel allowed Information Exposure (partial kernel address disclosure), leading to a KASLR bypass. Specifically, it was possible to extract the KASLR kernel image offset using the IP ID values the kernel produces for connection-less protocols (e.g., UDP and ICMP). When such traffic was sent to multiple destination IP addresses, it was possible to obtain hash collisions (of indices to the counter array) and thereby obtain the hashing key (via enumeration). This key contains enough bits from a kernel address (of a static variable) so when the key was extracted (via enumeration), the offset of the kernel image is exposed. This attack can be carried out remotely, by the attacker forcing the target device to send UDP or ICMP (or certain other) traffic to attacker-controlled IP addresses.
Forcing a server to send UDP traffic is trivial if the server is a DNS server. ICMP traffic is trivial if the server answers ICMP Echo requests (ping). For client targets, if the target visited the attacker's web page, then WebRTC or gQUIC could be used to force UDP traffic to attacker-controlled IP addresses. NOTE: this attack against KASLR became viable because IP ID generation was changed to have a dependency on an address associated with a network namespace. (bnc#)

CVE-2019-10126: A flaw was found in the Linux kernel that might lead to memory corruption in the marvell mwifiex driver. (bnc#1136935)

CVE-2018-20836: An issue was discovered in the Linux kernel There was a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free.
(bnc#1134395)

CVE-2019-11599: The coredump implementation in the Linux kernel did not use locking or other mechanisms to prevent vma layout or vma flags changes while it ran, which allowed local users to obtain sensitive information, cause a denial of service, or possibly have unspecified other impact by triggering a race condition with mmget_not_zero or get_task_mm calls. This is related to fs/userfaultfd.c, mm/mmap.c, fs/proc/task_mmu.c, and drivers/infiniband/core/uverbs_main.c.
(bnc#1133738)

CVE-2019-12614: An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel There was an unchecked kstrdup of prop-name, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
(bnc#)

CVE-2019-12818: An issue was discovered in the Linux kernel The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller did not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This affects nfc_llcp_build_gb in net/nfc/llcp_core.c. (bnc#1137194)

CVE-2019-12819: An issue was discovered in the Linux kernel The function __mdiobus_register() in drivers/net/phy/mdio_bus.c called put_device(), which would trigger a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bnc#1138291)

CVE-2019-12456 a double-fetch bug in _ctl_ioctl_main() could allow local users to create a denial of service (bsc#1136922).

CVE-2019-12380: An issue was discovered in the efi subsystem in the Linux kernel phys_efi_set_virtual_address_map in arch/x86/platform/efi/efi.c and efi_call_phys_prolog in arch/x86/platform/efi/efi_64.c mishandle memory allocation failures.
NOTE: This id is disputed as not being an issue because All the code touched by the referenced commit runs only at boot, before any user processes are started. Therefore, there is no possibility for an unprivileged user to control it. (bnc#)

CVE-2019-11487: The Linux kernel allowed page-_refcount reference count to overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can occur with FUSE requests. (bnc#1133190)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The openSUSE Leap 15.1 was updated to receive various security and bugfixes.

The following security bugs were fixed :

  - CVE-2019-11477: A sequence of SACKs may have been     crafted by a remote attacker such that one can trigger     an integer overflow, leading to a kernel panic.
    (bsc#1137586).

  - CVE-2019-11478: It was possible to send a crafted     sequence of SACKs which would fragment the TCP     retransmission queue. A remote attacker may have been     able to further exploit the fragmented queue to cause an     expensive linked-list walk for subsequent SACKs received     for that same TCP connection. (bsc#1137586)

  - CVE-2019-11479: It was possible to send a crafted     sequence of SACKs which would fragment the RACK send     map. A remote attacker may be able to further exploit     the fragmented send map to cause an expensive     linked-list walk for subsequent SACKs received for that     same TCP connection. This would have resulted in excess     resource consumption due to low mss values.
    (bsc#1137586)

  - CVE-2019-12819: The function __mdiobus_register() in     drivers/net/phy/mdio_bus.c calls put_device(), which     will trigger a fixed_mdio_bus_init use-after-free. This     will cause a denial of service (bnc#1138291).

  - CVE-2019-12818: The nfc_llcp_build_tlv function in     net/nfc/llcp_commands.c may return NULL. If the caller     did not check for this, it will trigger a NULL pointer     dereference. This will cause denial of service. This     affects nfc_llcp_build_gb in net/nfc/llcp_core.c     (bnc#1138293).

  - CVE-2019-12456: An issue was discovered in the     MPT3COMMAND case in _ctl_ioctl_main in     drivers/scsi/mpt3sas/mpt3sas_ctl.c that allowed local     users to cause a denial of service or possibly have     unspecified other impact by changing the value of     ioc_number between two kernel reads of that value, aka a     'double fetch' vulnerability. (bnc#1136922)

  - CVE-2019-12380: An issue was discovered in the efi     subsystem in the Linux kernel     phys_efi_set_virtual_address_map in     arch/x86/platform/efi/efi.c and efi_call_phys_prolog in     arch/x86/platform/efi/efi_64.c mishandle memory     allocation failures (bnc#1136598).

  - CVE-2019-3846: A flaw that allowed an attacker to     corrupt memory and possibly escalate privileges was     found in the mwifiex kernel module while connecting to a     malicious wireless network (bnc#1136424).

  - CVE-2019-10124: An attacker could exploit an issue in     the hwpoison implementation to cause a denial of service     (BUG). (bsc#1130699)

  - CVE-2019-12382: In the drm_load_edid_firmware in     drivers/gpu/drm/drm_edid_load.c was an unchecked kstrdup     of fwstr, which might allow an attacker to cause a     denial of service (NULL pointer dereference and system     crash) (bnc#1136586).

  - CVE-2019-11487: The Linux kernel allowed page->_refcount     reference count overflow, with resultant use-after-free     issues, if about 140 GiB of RAM exists. This is related     to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h,     kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests (bnc#1133190).

The SUSE Linux Enterprise 15 SP1 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2019-12819: The function __mdiobus_register() called put_device(), which triggered a fixed_mdio_bus_init use-after-free. This would cause a denial of service. (bsc#1138291)

CVE-2019-12818: The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c may return NULL. If the caller does not check for this, it will trigger a NULL pointer dereference. This will cause denial of service. This used to affect nfc_llcp_build_gb in net/nfc/llcp_core.c. (bsc#1138293)

CVE-2019-11477: A sequence of SACKs may have been crafted such that one can trigger an integer overflow, leading to a kernel panic.

CVE-2019-11478: It was possible to send a crafted sequence of SACKs which will fragment the TCP retransmission queue. An attacker may have been able to further exploit the fragmented queue to cause an expensive linked-list walk for subsequent SACKs received for that same TCP connection.

CVE-2019-11479: An attacker could force the Linux kernel to segment its responses into multiple TCP segments. This would drastically increased the bandwidth required to deliver the same amount of data.
Further, it would consume additional resources such as CPU and NIC processing power.

CVE-2019-3846: A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network. (bsc#1136424)

CVE-2019-10124: An issue was discovered in the hwpoison implementation in mm/memory-failure.c in the Linux kernel. When soft_offline_in_use_page() runs on a thp tail page after pmd is split, an attacker could cause a denial of service (bsc#1130699, CVE-2019-10124).

CVE-2019-12382: An issue was discovered in drm_load_edid_firmware in drivers/gpu/drm/drm_edid_load.c in the Linux kernel There was an unchecked kstrdup of fwstr, which might allow an attacker to cause a denial of service (NULL pointer dereference and system crash).
(bsc#1136586)

CVE-2019-11487: The Linux kernel allowed page reference count overflow, with resultant use-after-free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c, include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It could occur with FUSE requests.
(bbsc#1133190)

CVE-2019-5489: The mincore() implementation in mm/mincore.c in the Linux kernel allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server. (bsc#1120843)

CVE-2019-11833: fs/ext4/extents.c in the Linux kernel did not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive information by reading uninitialized data in the filesystem. (bsc#1135281)

CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc##1111331) CVE-2018-7191: In the tun subsystem in the Linux kernel, dev_get_valid_name was not called before register_netdevice.
This allowed local users to cause a denial of service (NULL pointer dereference and panic) via an ioctl(TUNSETIFF) call with a dev name containing a / character. (bsc#1135603)

CVE-2018-12126 CVE-2018-12127 CVE-2018-12130: Microarchitectural Store Buffer Data Sampling (MSBDS): Stored buffers on some microprocessors utilizing speculative execution which may have allowed an authenticated user to potentially enable information disclosure via a side channel with local access. A list of impacted products can be found here :

https://www.intel.com/content/dam/www/public/us/en/documents/corporate
-info rmation/SA00233-microcode-update-guidance_05132019.
(bsc#1103186) CVE-2019-11085: Insufficient input validation in Kernel Mode Driver in Intel(R) i915 Graphics for Linux may have allowed an authenticated user to potentially enable escalation of privilege via local access. (bsc#1135278)

CVE-2019-11815: An issue was discovered in rds_tcp_kill_sock in net/rds/tcp.c in the Linux kernel There was a race condition leading to a use-after-free, related to net namespace cleanup. (bsc#1135278)

CVE-2019-11884: The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel allowed a local user to obtain potentially sensitive information from kernel stack memory via a hidPCONNADD command, because a name field may not end with a '\0' character. (bsc#1134848)

CVE-2019-11811: An issue was discovered in the Linux kernel There was a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module was removed, related to drivers/char/ipmi/ipmi_si_intf.c, drivers/char/ipmi/ipmi_si_mem_io.c, and drivers/char/ipmi/ipmi_si_port_io.c. (bsc#1134397)

CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c in the Linux kernel has multiple race conditions. (bsc#1133188)

CVE-2019-9003: In the Linux kernel, attackers could trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a 'service ipmievd restart' loop. (bsc#1126704)

CVE-2018-16880: A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under specific conditions, could trigger an out-of-bounds write in a kmalloc-8 slab on a virtual host which may have lead to a kernel memory corruption and a system panic. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.(bsc#1122767)

CVE-2019-9503: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132828)

CVE-2019-9500: An issue was discovered that lead to brcmfmac heap buffer overflow. (bsc#1132681)

CVE-2019-8564: An issue was discoved which meant that brcmfmac frame validation could be bypassed. (bsc#1132673)

CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may have allowed unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.

CVE-2019-3882: A flaw was found in the Linux kernel's vfio interface implementation that permitted violation of the user's locked memory limit. If a device was bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may have caused a system memory exhaustion and thus a denial of service (DoS). (bsc#1131427)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
145850	CentOS 8 : kernel (CESA-2020:1769)	Nessus	CentOS Local Security Checks	critical
137291	Oracle Linux 7 : Unbreakable Enterprise kernel (ELSA-2020-5715)	Nessus	Oracle Linux Local Security Checks	critical
137217	OracleVM 3.4 : Unbreakable / etc (OVMSA-2020-0020) (Stack Clash)	Nessus	OracleVM Local Security Checks	critical
137173	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5708)	Nessus	Oracle Linux Local Security Checks	critical
135614	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-1452)	Nessus	Huawei Local Security Checks	critical
129284	SUSE SLED15 / SLES15 Security Update : kernel-source-rt (SUSE-SU-2019:2430-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)	Nessus	SuSE Local Security Checks	high
128929	EulerOS Virtualization for ARM 64 3.0.2.0 : kernel (EulerOS-SA-2019-1926)	Nessus	Huawei Local Security Checks	high
128478	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel (AWS) vulnerabilities (USN-4118-1)	Nessus	Ubuntu Local Security Checks	critical
127889	Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-4094-1)	Nessus	Ubuntu Local Security Checks	critical
126744	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1855-1) (SACK Slowness)	Nessus	SuSE Local Security Checks	critical
126742	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1852-1)	Nessus	SuSE Local Security Checks	critical
126741	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2019:1851-1) (SACK Slowness)	Nessus	SuSE Local Security Checks	critical
126691	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1829-1)	Nessus	SuSE Local Security Checks	critical
126688	SUSE SLES12 Security Update : kernel (SUSE-SU-2019:1823-1)	Nessus	SuSE Local Security Checks	critical
126059	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1571) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	high
126045	SUSE SLED15 / SLES15 Security Update : kernel (SUSE-SU-2019:1550-1) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (SACK Panic) (SACK Slowness) (Spectre)	Nessus	SuSE Local Security Checks	high
126040	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1579) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	high
126033	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1570) (SACK Panic) (SACK Slowness)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2019-12819

medium

Tenable Plugins

critical

critical

critical

critical

critical

high

high

critical

critical

critical

critical

critical

critical

critical

high

high

high

high