The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4025 advisory.

    - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290300]  {CVE-2017-8824}
    - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344841]  {CVE-2017-0861}     {CVE-2017-0861}
    - assoc_array: Fix a buggy node-splitting case (David Howells)  [Orabug: 27364592]  {CVE-2017-12193}     {CVE-2017-12193}
    - Sanitize move_pages() permission checks (Linus Torvalds)  [Orabug: 27364690]  {CVE-2017-14140}
    - pti: compile fix for when PTI is disabled (Pavel Tatashin)  [Orabug: 27383147]  {CVE-2017-5754}
    - sctp: do not peel off an assoc from one netns to another one (Xin Long)  [Orabug: 27386999]     {CVE-2017-15115}
    - net: ipv4: fix for a race condition in raw_sendmsg (Mohamed Ghannam)  [Orabug: 27390682]     {CVE-2017-17712}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.114 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-5715: Systems with microprocessors utilizing     speculative execution and indirect branch prediction may     allow unauthorized disclosure of information to an     attacker with local user access via a side-channel     analysis (bnc#1068032). The previous fix using CPU     Microcode has been complemented by building the Linux     Kernel with return trampolines aka 'retpolines'.

  - CVE-2017-15129: A use-after-free vulnerability was found     in network namespaces code affecting the Linux kernel in     the function get_net_ns_by_id() in     net/core/net_namespace.c did not check for the     net::count value after it has found a peer network in     netns_ids idr, which could lead to double free and     memory corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although it is thought to be unlikely     (bnc#1074839).

  - CVE-2017-17712: The raw_sendmsg() function in     net/ipv4/raw.c in the Linux kernel has a race condition     in inet->hdrincl that leads to uninitialized stack     pointer usage; this allowed a local user to execute code     and gain privileges (bnc#1073229).

  - CVE-2017-17862: kernel/bpf/verifier.c in the Linux     kernel ignored unreachable code, even though it would     still be processed by JIT compilers. This behavior, also     considered an improper branch-pruning logic issue, could     possibly be used by local users for denial of service     (bnc#1073928).

  - CVE-2017-17864: kernel/bpf/verifier.c in the Linux     kernel mishandled states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type, which     allowed local users to obtain potentially sensitive     address information, aka a 'pointer leak (bnc#1073928).

  - CVE-2017-18017: The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel allowed     remote attackers to cause a denial of service     (use-after-free and memory corruption) or possibly have     unspecified other impact by leveraging the presence of     xt_TCPMSS in an iptables action (bnc#1074488).

  - CVE-2018-5332: In the Linux kernel the     rds_message_alloc_sgs() function did not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size function in net/rds/rdma.c)     (bnc#1075621).

  - CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic     function in net/rds/rdma.c mishandled cases where page     pinning fails or an invalid address is supplied, leading     to an rds_atomic_free_op NULL pointer dereference     (bnc#1075617).

  - CVE-2018-1000004: In the Linux kernel a race condition     vulnerability existed in the sound system, this can lead     to a deadlock and denial of service condition     (bnc#1076017).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - drivers/char/mem.c: deny access in open operation when     securelevel is set (Ethan Zhao) [Orabug: 27234850]     [Orabug: 27234850]

  - hugetlb: fix nr_pmds accounting with shared page tables     (Kirill A. Shutemov) [Orabug: 26988581]

  - x86/IBRS: Drop unnecessary WRITE_ONCE (Boris Ostrovsky)     [Orabug: 27416198]

  - x86/IBRS: Don't try to change IBRS mode if IBRS is not     available (Boris Ostrovsky) [Orabug: 27416198]

  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode     (Boris Ostrovsky) 

  - x86: Include linux/device.h in bugs_64.c (Boris     Ostrovsky) [Orabug: 27418896]

  - x86/spectre: Drop the warning about ibrs being obsolete.
    (Konrad Rzeszutek Wilk)

  - x86/spec: Don't print the Missing arguments for option     spectre_v2. (Konrad Rzeszutek Wilk)

  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad     Rzeszutek Wilk)

  - x86/IBPB: Provide debugfs interface for changing IBPB     mode (Boris Ostrovsky) [Orabug: 27449065]

  - xen: Make PV Dom0 Linux kernel NUMA aware (Elena     Ufimtseva)

  - net/rds: Fix incorrect error handling (H&aring kon     Bugge) [Orabug: 26848729]

  - net/rds: use multiple sge than buddy allocation in     congestion code (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: fix the sg allocation based on actual     message size' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'RDS: avoid large pages for sg allocation for TCP     transport' (Wei Lin Guay) [Orabug: 26848729]

  - Revert 'net/rds: Reduce memory footprint in rds_sendmsg'     (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during ib_post_recv in     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: reduce memory footprint during rds_sendmsg with     IB transport (Wei Lin Guay) [Orabug: 26848729]

  - net/rds: set the rds_ib_init_frag based on supported sge     (Wei Lin Guay) [Orabug: 26848729]

  - bnxt_en: Fix possible corrupted NVRAM parameters from     firmware response. (Michael Chan) [Orabug: 27199588]

  - x86, kasan: Fix build failure on KASAN=y && KMEMCHECK=y     kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: Fix build failure on !KASAN &&     KMEMCHECK=y kernels (Andrey Ryabinin) [Orabug: 27255122]

  - x86, efi, kasan: #undef memset/memcpy/memmove per arch     (Andrey Ryabinin) [Orabug: 27255122]

  - Revert 'Makefile: Build with -Werror=date-time if the     compiler supports it' (Gayatri Vasudevan) [Orabug:
    27255122]

  - dccp: CVE-2017-8824: use-after-free in DCCP code     (Mohamed Ghannam) [Orabug: 27290300] (CVE-2017-8824)

  - x86/efi: Initialize and display UEFI secure boot state a     bit later during init (Daniel Kiper) [Orabug: 27309477]

  - x86/espfix: Init espfix on the boot CPU side (Zhu     Guihua) [Orabug: 27344552]

  - x86/espfix: Add 'cpu' parameter to init_espfix_ap (Zhu     Guihua) 

  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)     [Orabug: 27344841] (CVE-2017-0861) (CVE-2017-0861)

  - fs/ocfs2: remove page cache for converted direct write     (Wengang Wang)

  - Revert 'ocfs2: code clean up for direct io' (Wengang     Wang)

  - assoc_array: Fix a buggy node-splitting case (David     Howells) [Orabug: 27364592] (CVE-2017-12193)     (CVE-2017-12193)

  - Sanitize 'move_pages' permission checks (Linus Torvalds)     [Orabug: 27364690] (CVE-2017-14140)

  - pti: compile fix for when PTI is disabled (Pavel     Tatashin) [Orabug: 27383147] (CVE-2017-5754)

  - sctp: do not peel off an assoc from one netns to another     one (Xin Long) [Orabug: 27386999] (CVE-2017-15115)

  - net: ipv4: fix for a race condition in raw_sendmsg     (Mohamed Ghannam) [Orabug: 27390682] (CVE-2017-17712)

  - mlx4: add mstflint secure boot access kernel support     (Qing Huang) 

  - x86: Move STUFF_RSB in to the idt macro (Konrad     Rzeszutek Wilk)

  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad     Rzeszutek Wilk)

  - x86: Move ENABLE_IBRS in the interrupt macro. (Konrad     Rzeszutek Wilk)

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

ID	Name	Product	Family	Published	Updated	Severity
106670	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4025)	Nessus	Oracle Linux Local Security Checks	2/8/2018	10/23/2024	high
106672	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:0383-1) (Spectre)	Nessus	SuSE Local Security Checks	2/8/2018	1/23/2020	critical
106706	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0017) (Meltdown)	Nessus	OracleVM Local Security Checks	2/9/2018	9/27/2019	high
106740	openSUSE Security Update : the Linux Kernel (openSUSE-2018-153) (Spectre)	Nessus	SuSE Local Security Checks	2/12/2018	1/19/2021	critical
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	4/19/2018	10/30/2024	high

Detections

Analytics

Plugins Search

high

critical

high

critical

high