The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3776-1 advisory.

  - In fs/ocfs2/cluster/nodemanager.c in the Linux kernel before 4.15, local users can cause a denial of     service (NULL pointer dereference and BUG) because a required mutex is not used. (CVE-2017-18216)

  - It was found that the raw midi kernel driver does not protect against concurrent access which leads to a     double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part     of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux     kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote     attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the     iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e.
    depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and     thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target.
    Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is     highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. (CVE-2018-14633)

  - The spectre_v2_select_mitigation function in arch/x86/kernel/cpu/bugs.c in the Linux kernel before 4.18.1     does not always fill RSB upon a context switch, which makes it easier for attackers to conduct userspace-     userspace spectreRSB attacks. (CVE-2018-15572)

  - arch/x86/kernel/paravirt.c in the Linux kernel before 4.18.1 mishandles certain indirect calls, which     makes it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests. (CVE-2018-15594)

  - An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local     attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to     crash the kernel or potentially escalate privileges. (CVE-2018-16276)

  - An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in     mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly     gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.
    (CVE-2018-17182)

  - Memory leak in the irda_bind function in net/irda/af_irda.c and later in     drivers/staging/irda/net/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of     service (memory consumption) by repeatedly binding an AF_IRDA socket. (CVE-2018-6554)

  - The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the     Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and     system crash) or possibly have unspecified other impact via an AF_IRDA socket. (CVE-2018-6555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3776-1)

high Nessus Plugin ID 117870

Version 1.12

Version 1.11

Version 1.11

Version 1.12 Jan 10, 2024, 8:45 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401100845
Version 1.11 Oct 23, 2023, 4:39 PM CVSS metrics ("CVSSv3 score" changed from 7.0 to 7.8. "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2018-6555") Detection Plugin metadata Plugin Feed: 202310231639
Version 1.11 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856