OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0033)

High Nessus Plugin ID 109114

Synopsis

The remote OracleVM host is missing one or more security updates.

Description

The remote OracleVM system is missing necessary patches to address critical security updates :

- mlx4: change the ICM table allocations to lowest needed size (Daniel Jurgens) [Orabug: 27718305]

- autofs: use dentry flags to block walks during expire (Ian Kent)

- autofs races (Al Viro) [Orabug: 27766149] [Orabug:
27766149]

- crypto: FIPS - allow tests to be disabled in FIPS mode (Stephan Mueller) [Orabug: 26182706]

- crypto: rng - Zero seed in crypto_rng_reset (Herbert Xu) [Orabug: 26182706]

- crypto: xts - consolidate sanity check for keys (Stephan Mueller)

- fork: fix incorrect fput of ->exe_file causing use-after-free (Eric Biggers) [Orabug: 27290198] (CVE-2017-17052)

- negotiate_mq should happen in all cases of a new VBD being discovered by xen-blkfront, whether called through
_probe or a hot-attached new VBD from dom-0 via xenstore. Otherwise, hot-attached new VBDs are left configured without multi-queue. (Patrick Colp) [Orabug:
27383895]

- rds: Fix NULL pointer dereference in __rds_rdma_map (H&aring kon Bugge)

- nvme: fix uninitialized prp2 value on small transfers (Jan H. Sch&ouml nherr) [Orabug: 27581008]

- xen-netfront: Improve error handling during initialization (Ross Lagerwall) [Orabug: 27655820]

- RDS: IB: Fix null pointer issue (Guanglei Li) [Orabug:
27636704]

- mstflint: update Makefile and Kconfig (Qing Huang) [Orabug: 27656465]

- target: add inquiry_product module param to override LIO default (Kyle Fortin) [Orabug: 27679482]

- target: add inquiry_vendor module param to override LIO-ORG (Kyle Fortin) [Orabug: 27679482]

- net/rds: Avoid copy overhead if send buff is full (Gerd Rausch)

- IB/core: Avoid calling ib_query_device (Or Gerlitz) [Orabug: 27687710]

- IB/core: Save the device attributes on the device structure (Ira Weiny) [Orabug: 27687710]

- KVM: x86: fix singlestepping over syscall (Paolo Bonzini) [Orabug: 27669907] (CVE-2017-7518) (CVE-2017-7518)

- xen/acpi: upload _PSD info for non-dom0 CPUs too (Joao Martins)

- Revert 'RDS: don't commit to queue till transport connection is up' (Santosh Shilimkar)

Solution

Update the affected kernel-uek / kernel-uek-firmware packages.

See Also

http://www.nessus.org/u?ca78dd73

Plugin Details

Severity: High

ID: 109114

File Name: oraclevm_OVMSA-2018-0033.nasl

Version: 1.4

Type: local

Published: 2018/04/18

Updated: 2019/09/27

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS v3.0

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:oracle:vm:kernel-uek, p-cpe:/a:oracle:vm:kernel-uek-firmware, cpe:/o:oracle:vm_server:3.4

Required KB Items: Host/local_checks_enabled, Host/OracleVM/release, Host/OracleVM/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2018/04/17

Vulnerability Publication Date: 2017/11/29

Reference Information

CVE: CVE-2017-17052, CVE-2017-7518