The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3847-2 advisory.

  - It was found that the raw midi kernel driver does not protect against concurrent access which leads to a     double realloc (double free) in snd_rawmidi_input_params() and snd_rawmidi_output_status() which are part     of snd_rawmidi_ioctl() handler in rawmidi.c file. A malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-     timers.c in the POSIX timer code is caused by the way the overrun accounting works. Depending on interval     and expiry time values, the overrun can be larger than INT_MAX, but the accounting is int based. This     basically makes the accounting values, which are visible to user space via timer_getoverrun(2) and     siginfo::si_overrun, random. For example, a local user can cause a denial of service (signed integer     overflow) via crafted mmap, futex, timer_create, and timer_settime system calls. (CVE-2018-12896)

  - drivers/infiniband/core/ucma.c in the Linux kernel through 4.17.11 allows ucma_leave_multicast to access a     certain data structure after a cleanup step in ucma_process_join, which allows attackers to cause a denial     of service (use-after-free). (CVE-2018-14734)

  - An issue was discovered in yurex_read in drivers/usb/misc/yurex.c in the Linux kernel before 4.17.7. Local     attackers could use user access read/writes with incorrect bounds checking in the yurex USB driver to     crash the kernel or potentially escalate privileges. (CVE-2018-16276)

  - In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of     numeric bounds in the BPF verifier permits out-of-bounds memory accesses because     adjust_scalar_min_max_vals in kernel/bpf/verifier.c mishandles 32-bit right shifts. (CVE-2018-18445)

  - In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make     this filesystem non-operational until the next mount by triggering an unchecked error condition during an     xfs attribute change, because xfs_attr_shortform_addname in fs/xfs/libxfs/xfs_attr.c mishandles     ATTR_REPLACE operations with conversion of an attr from short to long form. (CVE-2018-18690)

  - An issue was discovered in the Linux kernel through 4.19. An information leak in cdrom_ioctl_select_disc     in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from     unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and     CVE-2018-16658. (CVE-2018-18710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 16.04 LTS : Linux kernel (HWE) vulnerabilities (USN-3847-2)

high Nessus Plugin ID 119828

Version 1.9

Version 1.8

Version 1.9 Jan 9, 2024, 6:56 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202401091856
Version 1.8 Oct 21, 2023, 9:06 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSSv2 score source (set to "CVE-2018-18445") Detection Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin metadata Plugin Feed: 202310210906