Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)

critical Nessus Plugin ID 109449
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Security Fix(es) :

- hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power)

- kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)

- kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

- Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)

- kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important)

- kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)

- kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

- kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

- kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

- kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)

- kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate)

- kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

- kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

- kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

- kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate)

- kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate)

- kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

- kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate)

- kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

- Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)

- kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

- kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate)

- kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

- kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low)

Additional Changes :

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?21bff66d

Plugin Details

Severity: Critical

ID: 109449

File Name: sl_20180410_kernel_on_SL7_x.nasl

Version: 1.6

Type: local

Agent: unix

Published: 5/1/2018

Updated: 2/24/2020

Dependencies: ssh_get_info.nasl

Risk Information

VPR

Risk Factor: High

Score: 8.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:H/RL:OF/RC:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:H/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:kernel, p-cpe:/a:fermilab:scientific_linux:kernel-abi-whitelists, p-cpe:/a:fermilab:scientific_linux:kernel-debug, p-cpe:/a:fermilab:scientific_linux:kernel-debug-debuginfo, p-cpe:/a:fermilab:scientific_linux:kernel-debug-devel, p-cpe:/a:fermilab:scientific_linux:kernel-debuginfo, p-cpe:/a:fermilab:scientific_linux:kernel-debuginfo-common-x86_64, p-cpe:/a:fermilab:scientific_linux:kernel-devel, p-cpe:/a:fermilab:scientific_linux:kernel-doc, p-cpe:/a:fermilab:scientific_linux:kernel-headers, p-cpe:/a:fermilab:scientific_linux:kernel-tools, p-cpe:/a:fermilab:scientific_linux:kernel-tools-debuginfo, p-cpe:/a:fermilab:scientific_linux:kernel-tools-libs, p-cpe:/a:fermilab:scientific_linux:kernel-tools-libs-devel, p-cpe:/a:fermilab:scientific_linux:perf, p-cpe:/a:fermilab:scientific_linux:perf-debuginfo, p-cpe:/a:fermilab:scientific_linux:python-perf, p-cpe:/a:fermilab:scientific_linux:python-perf-debuginfo, x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/10/2018

Vulnerability Publication Date: 4/27/2016

Reference Information

CVE: CVE-2016-3672, CVE-2016-7913, CVE-2016-8633, CVE-2017-1000252, CVE-2017-1000407, CVE-2017-1000410, CVE-2017-12154, CVE-2017-12190, CVE-2017-13166, CVE-2017-14140, CVE-2017-15116, CVE-2017-15121, CVE-2017-15126, CVE-2017-15127, CVE-2017-15129, CVE-2017-15265, CVE-2017-17448, CVE-2017-17449, CVE-2017-17558, CVE-2017-18017, CVE-2017-18203, CVE-2017-5754, CVE-2017-7294, CVE-2017-8824, CVE-2017-9725, CVE-2018-1000004, CVE-2018-5750, CVE-2018-6927

IAVA: 2018-A-0019