The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1854 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC)

    * kernel: net/packet: overflow in check for priv area size (CVE-2017-7308)

    * kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of     access (CVE-2012-6701)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Null pointer dereference via keyctl (CVE-2016-8650)

    * kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671)

    * kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001)

    * kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c     (CVE-2017-7616)

    * kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism     (CVE-2017-7889)

    * kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c     (CVE-2017-8890)

    * kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075)

    * kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076)

    * kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190)

    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121)

    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of     service (CVE-2017-18203)

    * kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash     (CVE-2018-1130)

    * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows     denial of service (CVE-2018-5803)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting CVE-2018-3639; Vitaly Mayatskih for reporting CVE-2017-12190; and Evgenii Shatokhin     (Virtuozzo Team) for reporting CVE-2018-1130. The CVE-2017-15121 issue was discovered by Miklos Szeredi     (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes     and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A flaw was found in the Linux kernel's handling of fork     failure when dealing with event messages in the     userfaultfd code. Failure to fork correctly can create a     fork event that will be removed from an already freed     list of events. (CVE-2017-15126)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is unlikely.
    (CVE-2017-7294)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a use-     after-free issue. A user/process could use this flaw to     crash the guest VM resulting in a denial of service     issue or, potentially, gain privileged access to a     system. (CVE-2019-6974)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when a     L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003029 advisory.

    A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an     application punches a hole in a file that does not end aligned to a page boundary.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - hw: cpu: speculative execution permission faults     handling (CVE-2017-5754, Important, KVM for Power)

  - kernel: Buffer overflow in firewire driver via crafted     incoming packets (CVE-2016-8633, Important)

  - kernel: Use-after-free vulnerability in DCCP socket     (CVE-2017-8824, Important)

  - Kernel: kvm: nVMX: L2 guest could access hardware(L0)     CR8 register (CVE-2017-12154, Important)

  - kernel: v4l2: disabled memory access protection     mechanism allowing privilege escalation (CVE-2017-13166,     Important)

  - kernel: media: use-after-free in [tuner-xc2028] media     driver (CVE-2016-7913, Moderate)

  - kernel: drm/vmwgfx: fix integer overflow in     vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

  - kernel: Incorrect type conversion for size during dma     allocation (CVE-2017-9725, Moderate)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190, Moderate)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121, Moderate)

  - kernel: Use-after-free in     userfaultfd_event_wait_completion function in     userfaultfd.c (CVE-2017-15126, Moderate)

  - kernel: net: double-free and memory corruption in     get_net_ns_by_id() (CVE-2017-15129, Moderate)

  - kernel: Use-after-free in snd_seq_ioctl_create_port()     (CVE-2017-15265, Moderate)

  - kernel: Missing capabilities check in     net/netfilter/nfnetlink_cthelper.c allows for     unprivileged access to systemwide nfnl_cthelper_list     structure (CVE-2017-17448, Moderate)

  - kernel: Missing namespace check in     net/netlink/af_netlink.c allows for network monitors to     observe systemwide activity (CVE-2017-17449, Moderate)

  - kernel: Unallocated memory access by malicious USB     device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

  - kernel: netfilter: use-after-free in     tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203, Moderate)

  - kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ     (CVE-2017-1000252, Moderate)

  - Kernel: KVM: DoS via write flood to I/O port 0x80     (CVE-2017-1000407, Moderate)

  - kernel: Stack information leak in the EFS element     (CVE-2017-1000410, Moderate)

  - kernel: Kernel address information leak in     drivers/acpi/sbshc.c:acpi_smbus_hc_add() function     potentially allowing KASLR bypass (CVE-2018-5750,     Moderate)

  - kernel: Race condition in sound system can lead to     denial of service (CVE-2018-1000004, Moderate)

  - kernel: multiple Low security impact security issues     (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116,     CVE-2017-15127, CVE-2018-6927, Low)

Additional Changes :

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1062 advisory.

    - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430]     {CVE-2017-13166}
    - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
    - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381]     {CVE-2017-15265}
    - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543088]     {CVE-2017-18017}
    - [sound] alsa: seq: Make ioctls race-free (CVE-2018-1000004) (Jaroslav Kysela) [1537203]     {CVE-2018-1000004}
    - [x86] mm: Fix use-after-free of ldt_struct (Oleg Nesterov) [1543352] {CVE-2017-17053}
    - [net] netlink: Add netns check on taps (William Townsend) [1538738] {CVE-2017-17449}
    - [net] netfilter: xt_osf: Add missing permission checks (Florian Westphal) [1539230] {CVE-2017-17448}
    - [net] netfilter: nfnetlink_cthelper: Add missing permission checks (Florian Westphal) [1539230]     {CVE-2017-17448}
    - [powerpc] kvm: book3s: Provide information about hardware/firmware CVE workarounds (Serhii Popovych)     [1532077] {CVE-2017-5754}
    - [net] Fix double free and memory corruption in get_net_ns_by_id() (Aristeu Rozanski) [1531551]     {CVE-2017-15129}
    - [media] xc2028: avoid use after free (Torez Smith) [1402893] {CVE-2016-7913}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC)

* kernel: net/packet: overflow in check for priv area size (CVE-2017-7308)

* kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access (CVE-2012-6701)

* kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

* kernel: NULL pointer dereference via keyctl (CVE-2016-8650)

* kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671)

* kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001)

* kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c (CVE-2017-7616)

* kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism (CVE-2017-7889)

* kernel: Double free in the inet_csk_clone_lock function in net/ipv4/ inet_connection_sock.c (CVE-2017-8890)

* kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075)

* kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076)

* kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077)

* kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190)

* kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121)

* kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203)

* kernel: a NULL pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash (CVE-2018-1130)

* kernel: Missing length check of payload in net/sctp/ sm_make_chunk.c:_sctp_make_chunk() function allows denial of service (CVE-2018-5803)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639; Vitaly Mayatskih for reporting CVE-2017-12190; and Evgenii Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section.

ID	Name	Product	Family	Published	Updated	Severity
110600	RHEL 6 : kernel (RHSA-2018:1854)	Nessus	Red Hat Local Security Checks	6/19/2018	4/15/2025	high
110701	Oracle Linux 6 : kernel (ELSA-2018-1854)	Nessus	Oracle Linux Local Security Checks	6/27/2018	2/9/2026	high
127285	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0077)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	high
287313	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003029)	Nessus	Unity Linux Local Security Checks	1/15/2026	1/16/2026	medium
109449	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)	Nessus	Scientific Linux Local Security Checks	5/1/2018	1/13/2026	critical
109113	Oracle Linux 7 : kernel (ELSA-2018-1062)	Nessus	Oracle Linux Local Security Checks	4/18/2018	2/9/2026	critical
110645	CentOS 6 : kernel (CESA-2018:1854) (Spectre)	Nessus	CentOS Local Security Checks	6/22/2018	9/17/2024	high

Detections

Analytics

Plugins Search

high

high

high

medium

critical

critical

high