A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service (DoS).

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14127-1 advisory.

  - An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout()     and smp_task_done() in drivers/scsi/libsas/sas_expander.c, leading to a use-after-free. (CVE-2018-20836)

  - Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and     tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service. (CVE-2018-5390)

  - An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux     kernel through 5.1.6. There is an unchecked kstrdup of prop->name, which might allow an attacker to cause     a denial of service (NULL pointer dereference and system crash). (CVE-2019-12614)

  - A heap address information leak while using L2CAP_GET_CONF_OPT was discovered in the Linux kernel before     5.1-rc1. (CVE-2019-3459)

  - A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel     before 5.1-rc1. (CVE-2019-3460)

  - A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the     mwifiex kernel module while connecting to a malicious wireless network. (CVE-2019-3846)

  - A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged     local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service     (DoS). (CVE-2019-3896)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - The Salsa20 encryption algorithm in the Linux kernel     before 4.14.8 does not correctly handle zero-length     inputs, allowing a local attacker able to use the     AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable. (CVE-2017-17805)

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes on     the same system, potentially allowing sniffing of secret     information. (Fixing this affects the output of the     fincore program.) Limited remote exploitation may be     possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP Server.
    (CVE-2019-5489)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel through 4.18.11.
    It does not ensure that only root may inspect the kernel     stack of an arbitrary task, allowing a local attacker to     exploit racy stack unwinding and leak kernel task stack     contents. (CVE-2018-17972)

  - Jonathan Looney discovered that the     TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an     integer overflow in the Linux kernel when handling TCP     Selective Acknowledgments (SACKs). A remote attacker     could use this to cause a denial of service. This has     been fixed in stable kernel releases 4.4.182, 4.9.182,     4.14.127, 4.19.52, 5.1.11, and is fixed in commit     3b4929f65b0d8249f19a50245cd88ed1a2f78cff.
    (CVE-2019-11477)

  - A double-free can happen in idr_remove_all() in     lib/idr.c in the Linux kernel 2.6 branch. An     unprivileged local attacker can use this flaw for a     privilege escalation or for a system crash and a denial     of service (DoS). (CVE-2019-3896)

  - An information disclosure vulnerability exists when     certain central processing units (CPU) speculatively     access memory, aka 'Windows Kernel Information     Disclosure Vulnerability'. This CVE ID is unique from     CVE-2019-1071, CVE-2019-1073. (CVE-2019-1125)

  - Jonathan Looney discovered that the TCP retransmission     queue implementation in tcp_fragment in the Linux kernel     could be fragmented when handling certain TCP Selective     Acknowledgment (SACK) sequences. A remote attacker could     use this to cause a denial of service. This has been     fixed in stable kernel releases 4.4.182, 4.9.182,     4.14.127, 4.19.52, 5.1.11, and is fixed in commit     f070ef2ac66716357066b683fb0baf55f8191a2e.
    (CVE-2019-11478)

  - Jonathan Looney discovered that the Linux kernel default     MSS is hard-coded to 48 bytes. This allows a remote peer     to fragment TCP resend queues significantly more than if     a larger MSS were enforced. A remote attacker could use     this to cause a denial of service. This has been fixed     in stable kernel releases 4.4.182, 4.9.182, 4.14.127,     4.19.52, 5.1.11, and is fixed in commits     967c05aee439e6e5d7d805e195b3a20ef5c433d6 and     5f3e2bf008c2221478101ee72f5cb4654b9fc363.
    (CVE-2019-11479)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - An integer overflow flaw was found in the way the Linux     kernel's networking subsystem processed TCP Selective     Acknowledgment (SACK) segments. While processing SACK     segments, the Linux kernel's socket buffer (SKB) data     structure becomes fragmented. Each fragment is about TCP     maximum segment size (MSS) bytes. To efficiently process     SACK blocks, the Linux kernel merges multiple fragmented     SKBs into one, potentially overflowing the variable     holding the number of segments. A remote attacker could     use this flaw to crash the Linux kernel by sending a     crafted sequence of SACK segments on a TCP connection     with small value of TCP MSS, resulting in a denial of     service (DoS). (CVE-2019-11477)

  - An excessive resource consumption flaw was found in the     way the Linux kernel's networking subsystem processed     TCP Selective Acknowledgment (SACK) segments. While     processing SACK segments, the Linux kernel's socket     buffer (SKB) data structure becomes fragmented, which     leads to increased resource utilization to traverse and     process these fragments as further SACK segments are     received on the same TCP connection. A remote attacker     could use this flaw to cause a denial of service (DoS)     by sending a crafted sequence of SACK segments on a TCP     connection. (CVE-2019-11478)

  - An excessive resource consumption flaw was found in the     way the Linux kernel's networking subsystem processed     TCP segments. If the Maximum Segment Size (MSS) of a TCP     connection was set to low values, such as 48 bytes, it     can leave as little as 8 bytes for the user data, which     significantly increases the Linux kernel's resource     (CPU, Memory, and Bandwidth) utilization. A remote     attacker could use this flaw to cause a denial of     service (DoS) by repeatedly sending network traffic on a     TCP connection with low TCP MSS. (CVE-2019-11479)

  - A double-free can happen in idr_remove_all() in     lib/idr.c in the Linux kernel. An unprivileged local     attacker can use this flaw for a privilege escalation or     for a system crash and a denial of service (DoS).
    (CVE-2019-3896)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Based on the RPM metadata this appears to be a security kernel.

The RPM changelog shows fixes related to Security Fix(es) :

  - An integer overflow flaw was found in the way the Linux     kernel's networking subsystem processed TCP Selective     Acknowledgment (SACK) segments. While processing SACK     segments, the Linux kernel's socket buffer (SKB) data     structure becomes fragmented. Each fragment is about TCP     maximum segment size (MSS) bytes. To efficiently process     SACK blocks, the Linux kernel merges multiple fragmented     SKBs into one, potentially overflowing the variable     holding the number of segments. A remote attacker could     use this flaw to crash the Linux kernel by sending a     crafted sequence of SACK segments on a TCP connection     with small value of TCP MSS, resulting in a denial of     service (DoS). (CVE-2019-11477)

  - kernel: Double free in lib/idr.c (CVE-2019-3896)

  - Kernel: tcp: excessive resource consumption while     processing SACK blocks allows remote denial of service     (CVE-2019-11478)

  - Kernel: tcp: excessive resource consumption for TCP     connections with low MSS allows remote denial of service     (CVE-2019-11479)

Bug Fix(es) :

  - kernel memory leak in xenfs

  - dentry with DCACHE_SHRINKING set but no task shrinking     dcache

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A double-free can happen in idr_remove_all() in     lib/idr.c in the Linux kernel. An unprivileged local     attacker can use this flaw for a privilege escalation     or for a system crash and a denial of service (DoS).

  - An integer overflow flaw was found in the way the Linux     kernel's networking subsystem processed TCP Selective     Acknowledgment (SACK) segments. While processing SACK     segments, the Linux kernel's socket buffer (SKB) data     structure becomes fragmented. Each fragment is about     TCP maximum segment size (MSS) bytes. To efficiently     process SACK blocks, the Linux kernel merges multiple     fragmented SKBs into one, potentially overflowing the     variable holding the number of segments. A remote     attacker could use this flaw to crash the Linux kernel     by sending a crafted sequence of SACK segments on a TCP     connection with small value of TCP MSS, resulting in a     denial of service (DoS).

  - tcp: excessive resource consumption while processing     SACK blocks allows remote denial of service.

  - tcp: excessive resource consumption for TCP connections     with low MSS allows remote denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1488 advisory.

  - Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow     in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). A remote attacker could use this     to cause a denial of service. This has been fixed in stable kernel releases 4.4.182, 4.9.182, 4.14.127,     4.19.52, 5.1.11, and is fixed in commit 3b4929f65b0d8249f19a50245cd88ed1a2f78cff. (CVE-2019-11477)

  - Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a     remote peer to fragment TCP resend queues significantly more than if a larger MSS were enforced. A remote     attacker could use this to cause a denial of service. This has been fixed in stable kernel releases     4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commits     967c05aee439e6e5d7d805e195b3a20ef5c433d6 and 5f3e2bf008c2221478101ee72f5cb4654b9fc363. (CVE-2019-11479)

  - A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged     local attacker can use this flaw for a privilege escalation or for a system crash and a denial of service     (DoS). (CVE-2019-3896)

  - Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux     kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. A remote     attacker could use this to cause a denial of service. This has been fixed in stable kernel releases     4.4.182, 4.9.182, 4.14.127, 4.19.52, 5.1.11, and is fixed in commit     f070ef2ac66716357066b683fb0baf55f8191a2e. (CVE-2019-11478)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).
(CVE-2019-11477)

* kernel: Double free in lib/idr.c (CVE-2019-3896)

* Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478)

* Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* MDS mitigations not enabled on Intel Skylake CPUs (BZ#1710081)

* RHEL6 kernel does not disable SMT with mds=full,nosmt (BZ#1710121)

* [RHEL6] md_clear flag missing from /proc/cpuinfo (BZ#1710517)

Security Fix(es) :

  - An integer overflow flaw was found in the way the Linux     kernel's networking subsystem processed TCP Selective     Acknowledgment (SACK) segments. While processing SACK     segments, the Linux kernel's socket buffer (SKB) data     structure becomes fragmented. Each fragment is about TCP     maximum segment size (MSS) bytes. To efficiently process     SACK blocks, the Linux kernel merges multiple fragmented     SKBs into one, potentially overflowing the variable     holding the number of segments. A remote attacker could     use this flaw to crash the Linux kernel by sending a     crafted sequence of SACK segments on a TCP connection     with small value of TCP MSS, resulting in a denial of     service (DoS). (CVE-2019-11477)

  - kernel: Double free in lib/idr.c (CVE-2019-3896)

  - Kernel: tcp: excessive resource consumption while     processing SACK blocks allows remote denial of service     (CVE-2019-11478)

  - Kernel: tcp: excessive resource consumption for TCP     connections with low MSS allows remote denial of service     (CVE-2019-11479)

Bug Fix(es) :

  - MDS mitigations not enabled on Intel Skylake CPUs

  - kernel does not disable SMT with mds=full,nosmt

  - md_clear flag missing from /proc/cpuinfo

An update for kernel is now available for Red Hat Enterprise Linux 6.5 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).
(CVE-2019-11477)

* kernel: Double free in lib/idr.c (CVE-2019-3896)

* Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478)

* Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* MDS mitigations not enabled on Intel Skylake CPUs (BZ#1713025)

* [RHEL6] md_clear flag missing from /proc/cpuinfo (BZ#1713028)

* RHEL6 kernel does not disable SMT with mds=full,nosmt (BZ#1713043)

An update for kernel is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* An integer overflow flaw was found in the way the Linux kernel's networking subsystem processed TCP Selective Acknowledgment (SACK) segments. While processing SACK segments, the Linux kernel's socket buffer (SKB) data structure becomes fragmented. Each fragment is about TCP maximum segment size (MSS) bytes. To efficiently process SACK blocks, the Linux kernel merges multiple fragmented SKBs into one, potentially overflowing the variable holding the number of segments. A remote attacker could use this flaw to crash the Linux kernel by sending a crafted sequence of SACK segments on a TCP connection with small value of TCP MSS, resulting in a denial of service (DoS).
(CVE-2019-11477)

* kernel: Double free in lib/idr.c (CVE-2019-3896)

* Kernel: tcp: excessive resource consumption while processing SACK blocks allows remote denial of service (CVE-2019-11478)

* Kernel: tcp: excessive resource consumption for TCP connections with low MSS allows remote denial of service (CVE-2019-11479)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es) :

* MDS mitigations not enabled on Intel Skylake CPUs (BZ#1713026)

* [RHEL6] md_clear flag missing from /proc/cpuinfo (BZ#1713029)

* RHEL6 kernel does not disable SMT with mds=full,nosmt (BZ#1713044)

ID	Name	Product	Family	Severity
150512	SUSE SLES11 Security Update : kernel (SUSE-SU-2019:14127-1)	Nessus	SuSE Local Security Checks	high
128689	NewStart CGSL MAIN 4.06 : kernel Multiple Vulnerabilities (NS-SA-2019-0177)	Nessus	NewStart CGSL Local Security Checks	high
127456	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0168)	Nessus	NewStart CGSL Local Security Checks	high
126763	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (SACK Panic) (SACK Slowness)	Nessus	Scientific Linux Local Security Checks	high
126175	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2019-052)	Nessus	Virtuozzo Local Security Checks	high
126023	Oracle Linux 6 : kernel (ELSA-2019-1488)	Nessus	Oracle Linux Local Security Checks	high
126007	CentOS 6 : kernel (CESA-2019:1488) (SACK Panic) (SACK Slowness)	Nessus	CentOS Local Security Checks	high
125980	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20190617) (SACK Panic) (SACK Slowness)	Nessus	Scientific Linux Local Security Checks	high
125977	RHEL 6 : kernel (RHSA-2019:1490) (SACK Panic) (SACK Slowness)	Nessus	Red Hat Local Security Checks	high
125976	RHEL 6 : kernel (RHSA-2019:1489) (SACK Panic) (SACK Slowness)	Nessus	Red Hat Local Security Checks	high
125975	RHEL 6 : kernel (RHSA-2019:1488) (SACK Panic) (SACK Slowness)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-3896

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high