The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive various security and bugfixes. This update enables SMB encryption in the CIFS support in the Linux Kernel (fate#324404) The following security bugs were fixed :

  - CVE-2017-1000410: The Linux kernel was affected by an     information leak in the processing of incoming L2CAP     commands - ConfigRequest, and ConfigResponse messages.
    (bnc#1070535).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations     (bnc#1066192).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-16528: sound/core/seq_device.c in the Linux     kernel allowed local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066629).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function     in drivers/input/misc/ims-pcu.c in the Linux kernel     allowed local users to cause a denial of service     (ims_pcu_parse_cdc_data out-of-bounds read and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1067132).

  - CVE-2017-16646:
    drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux     kernel allowed local users to cause a denial of service     (BUG and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067105).

  - CVE-2017-16994: The walk_hugetlb_range function in     mm/pagewalk.c in the Linux kernel mishandled holes in     hugetlb ranges, which allowed local users to obtain     sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call     (bnc#1069996).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, did not restrict     observations of Netlink messages to a single net     namespace, which allowed local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system (bnc#1071694).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-7482: Fixed an overflow when decoding a krb5     principal. (bnc#1046107).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6     allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - drivers/usb/core/config.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel     before 4.13.8 allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel before     4.13.10 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - A flaw was found that sound/core/timer.c in the Linux     kernel before 4.11.5 is vulnerable to a data race in     the ALSA /dev/snd/timer driver resulting in local users     being able to read information belonging to other     users. Uninitialized memory contents may be disclosed     when a read and an ioctl happen at the same     time.(CVE-2017-1000380)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The ims_pcu_get_cdc_union_desc function in     drivers/input/misc/ims-pcu.c in the Linux kernel     through 4.13.11 allows local users to cause a denial of     service (ims_pcu_parse_cdc_data out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16645)

  - The parse_hid_report_descriptor function in     drivers/input/tablet/gtco.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16643)

  - The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (improper error handling and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16644)

  - The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16534)

  - The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16650)

  - The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (divide-by-zero error and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16649)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel before 4.13.6 allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages. (bnc#1069702)

  - CVE-2017-1000405: mm, thp: do not dirty huge pages on     read fault (bnc#1069496).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067085)

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c, when CONFIG_X86_X32 is enabled, allowed     local users to gain privileges via a recvmmsg system     call with a crafted timeout pointer parameter     (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067086)

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1066700)

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference.
    (bnc#1066705)

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor.
    (bnc#1066671)

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations.
    (bnc#1066192)

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device. (bnc#1066650)

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup. (bnc#1066618)

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device.
    (bnc#1066573)

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device.
    (bnc#1066606)

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device. (bnc#1066625)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     attacker controllable speculative execution over code     patterns in the Linux Kernel to leak content from     otherwise not readable memory in the same address space,     allowing retrieval of passwords, cryptographic keys and     other secrets. This problem is mitigated by adding     speculative fencing on affected code paths throughout     the Linux kernel.

  - CVE-2017-5715: Local attackers on systems with modern     CPUs featuring branch prediction could use mispredicted     branches to speculatively execute code patterns that in     turn could be made to leak other non-readable content in     the same address space, an attack similar to     CVE-2017-5753. This problem is mitigated by disabling     predictive branches, depending on CPU architecture     either by firmware updates and/or fixes in the     user-kernel privilege boundaries. Please contact your     CPU / hardware vendor for potential microcode or BIOS     updates needed for this fix. As this feature can have a     performance impact, it can be disabled using the     'nospec' kernel commandline option.

  - CVE-2017-5754: Local attackers on systems with modern     CPUs featuring deep instruction pipelining could use     code patterns in userspace to speculative executive code     that would read otherwise read protected memory, an     attack similar to CVE-2017-5753. This problem is     mitigated by unmapping the Linux Kernel from the user     address space during user code execution, following a     approach called 'KAISER'. The terms used here are     'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page     Table Isolation'. This feature is disabled on unaffected     architectures. This feature can be enabled / disabled by     the 'pti=[on|off|auto]' or 'nopti' commandline options.
    The following security bugs were fixed :

  - CVE-2017-1000251: The native Bluetooth stack in the     Linux Kernel (BlueZ) was vulnerable to a stack overflow     vulnerability in the processing of L2CAP configuration     responses resulting in Remote code execution in kernel     space (bnc#1057389).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer was fixed. (bnc#1072876).

  - CVE-2017-14106: The tcp_disconnect function in     net/ipv4/tcp.c in the Linux kernel allowed local users     to cause a denial of service (__tcp_select_window     divide-by-zero error and system crash) by triggering a     disconnect within a certain tcp_recvmsg code path     (bnc#1056982).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel didn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in     fs/xfs/xfs_linux.h in the Linux kernel did not verify     that a filesystem has a realtime device, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory (bnc#1058524).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695     1074033).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17805: The Salsa20 encryption algorithm in the     Linux kernel did not correctly handle zero-length     inputs, allowing a local attacker able to use the     AF_ALG-based skcipher interface     (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of     service (uninitialized-memory free and kernel crash) or     have unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 were     vulnerable (bnc#1073792).

  - CVE-2017-17806: The HMAC implementation (crypto/hmac.c)     in the Linux kernel did not validate that the underlying     cryptographic hash algorithm is unkeyed, allowing a     local attacker able to use the AF_ALG-based hash     interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3     hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel     stack-based buffer overflow by executing a crafted     sequence of system calls that encounter a missing SHA-3     initialization (bnc#1073874).

  - CVE-2017-7472: The KEYS subsystem in the Linux kernel     allowed local users to cause a denial of service (memory     consumption) via a series of     KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring     calls (bnc#1034862).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3619-1 advisory.

    Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel improperly     performed sign extension in some situations. A local attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2017-16995)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    It was discovered that an information disclosure vulnerability existed in the ACPI implementation of the     Linux kernel. A local attacker could use this to expose sensitive information (kernel memory addresses).
    (CVE-2017-11472)

    It was discovered that a use-after-free vulnerability existed in the network namespaces implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15129)

    It was discovered that the Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel     contained a use-after-free when handling device removal. A physically proximate attacker could use this to     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16528)

    Andrey Konovalov discovered that the usbtest device driver in the Linux kernel did not properly validate     endpoint metadata. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16532)

    Andrey Konovalov discovered that the Conexant cx231xx USB video capture driver in the Linux kernel did not     properly validate interface descriptors. A physically proximate attacker could use this to cause a denial     of service (system crash). (CVE-2017-16536)

    Andrey Konovalov discovered that the SoundGraph iMON USB driver in the Linux kernel did not properly     validate device metadata. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2017-16537)

    Andrey Konovalov discovered that the IMS Passenger Control Unit USB driver in the Linux kernel did not     properly validate device descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16645)

    Andrey Konovalov discovered that the DiBcom DiB0700 USB DVB driver in the Linux kernel did not properly     handle detach events. A physically proximate attacker could use this to cause a denial of service (system     crash). (CVE-2017-16646)

    Andrey Konovalov discovered that the CDC USB Ethernet driver did not properly validate device descriptors.
    A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16649)

    Andrey Konovalov discovered that the QMI WWAN USB driver did not properly validate device descriptors. A     physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2017-16650)

    It was discovered that the USB Virtual Host Controller Interface (VHCI) driver in the Linux kernel     contained an information disclosure vulnerability. A physically proximate attacker could use this to     expose sensitive information (kernel memory). (CVE-2017-16911)

    It was discovered that the USB over IP implementation in the Linux kernel did not validate endpoint     numbers. A remote attacker could use this to cause a denial of service (system crash). (CVE-2017-16912)

    It was discovered that the USB over IP implementation in the Linux kernel did not properly validate     CMD_SUBMIT packets. A remote attacker could use this to cause a denial of service (excessive memory     consumption). (CVE-2017-16913)

    It was discovered that the USB over IP implementation in the Linux kernel contained a NULL pointer     dereference error. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16914)

    It was discovered that the HugeTLB component of the Linux kernel did not properly handle holes in hugetlb     ranges. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2017-16994)

    It was discovered that the netfilter component of the Linux did not properly restrict access to the     connection tracking helpers list. A local attacker could use this to bypass intended access restrictions.
    (CVE-2017-17448)

    It was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of     netlink messages to the appropriate net namespace. A local attacker could use this to expose sensitive     information (kernel netlink traffic). (CVE-2017-17449)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the core USB subsystem in the Linux kernel did not validate the number of     configurations and interfaces in a device. A physically proximate attacker could use this to cause a     denial of service (system crash). (CVE-2017-17558)

    Dmitry Vyukov discovered that the KVM implementation in the Linux kernel contained an out-of-bounds read     when handling memory-mapped I/O. A local attacker could use this to expose sensitive information.
    (CVE-2017-17741)

    It was discovered that the Salsa20 encryption algorithm implementations in the Linux kernel did not     properly handle zero-length inputs. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-17805)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    It was discovered that the keyring implementation in the Linux kernel did not properly check permissions     when a key request was performed on a task's default keyring. A local attacker could use this to add keys     to unauthorized keyrings. (CVE-2017-17807)

    Alexei Starovoitov discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel     contained a branch-pruning logic issue around unreachable code. A local attacker could use this to cause a     denial of service. (CVE-2017-17862)

    It was discovered that the parallel cryptography component of the Linux kernel incorrectly freed kernel     memory. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18075)

    It was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A     local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203)

    It was discovered that a race condition existed in the OCFS2 file system implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2017-18204)

    It was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel     in certain circumstances. A local attacker could use this to cause a denial of service (system hang).
    (CVE-2017-18208)

    Andy Lutomirski discovered that the KVM implementation in the Linux kernel was vulnerable to a debug     exception error when single-stepping through a syscall. A local attacker in a non-Linux guest vm could     possibly use this to gain administrative privileges in the guest vm. (CVE-2017-7518)

    It was discovered that the Broadcom NetXtremeII ethernet driver in the Linux kernel did not properly     validate Generic Segment Offload (GSO) packet sizes. An attacker could use this to cause a denial of     service (interface unavailability). (CVE-2018-1000026)

    It was discovered that the Reliable Datagram Socket (RDS) implementation in the Linux kernel contained an     out-of-bounds write during RDMA page allocation. An attacker could use this to cause a denial of service     (system crash) or possibly execute arbitrary code. (CVE-2018-5332)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927)

    It was discovered that a NULL pointer dereference existed in the RDS (Reliable Datagram Sockets) protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-7492)

    It was discovered that the Broadcom UniMAC MDIO bus controller driver in the Linux kernel did not properly     validate device resources. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2018-8043)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
105364	openSUSE Security Update : the Linux Kernel (openSUSE-2017-1391) (Dirty COW)	Nessus	SuSE Local Security Checks	12/19/2017	1/19/2021	high
105461	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3410-1)	Nessus	SuSE Local Security Checks	12/26/2017	1/6/2021	high
104910	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1291)	Nessus	Huawei Local Security Checks	12/1/2017	1/6/2021	medium
105020	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3210-1) (Dirty COW)	Nessus	SuSE Local Security Checks	12/5/2017	1/6/2021	high
105685	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:0040-1) (BlueBorne) (KRACK) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	1/9/2018	1/19/2021	high
108842	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3619-1)	Nessus	Ubuntu Local Security Checks	4/5/2018	8/27/2024	high

Detections

Analytics

Plugins Search

high

high

medium

high

high

high