USN 3343-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu 12.04 ESM.

USN 3335-2 fixed a vulnerability in the Linux kernel. However, that fix introduced regressions for some Java applications. This update addresses the issue. We apologize for the inconvenience.

It was discovered that a use-after-free vulnerability in the core voltage regulator driver of the Linux kernel. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2014-9940)

Roee Hay discovered that the parallel port printer driver in the Linux kernel did not properly bounds check passed arguments. A local attacker with write access to the kernel command line arguments could use this to execute arbitrary code. (CVE-2017-1000363)

Li Qiang discovered that an integer overflow vulnerability existed in the Direct Rendering Manager (DRM) driver for VMware devices in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-7294)

It was discovered that a double-free vulnerability existed in the IPv4 stack of the Linux kernel. An attacker could use this to cause a denial of service (system crash). (CVE-2017-8890)

Andrey Konovalov discovered an IPv6 out-of-bounds read error in the Linux kernel's IPv6 stack. A local attacker could cause a denial of service or potentially other unspecified problems. (CVE-2017-9074)

Andrey Konovalov discovered a flaw in the handling of inheritance in the Linux kernel's IPv6 stack. A local user could exploit this issue to cause a denial of service or possibly other unspecified problems.
(CVE-2017-9075)

It was discovered that dccp v6 in the Linux kernel mishandled inheritance. A local attacker could exploit this issue to cause a denial of service or potentially other unspecified problems.
(CVE-2017-9076)

It was discovered that the transmission control protocol (tcp) v6 in the Linux kernel mishandled inheritance. A local attacker could exploit this issue to cause a denial of service or potentially other unspecified problems. (CVE-2017-9077)

It was discovered that the IPv6 stack in the Linux kernel was performing its over write consistency check after the data was actually overwritten. A local attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2017-9242).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The regulator_ena_gpio_free function in     drivers/regulator/core.c in the Linux kernel allows     local users to gain privileges or cause a denial of     service (use-after-free) via a crafted     application.i1/4^CVE-2014-9940i1/4%0

  - Race condition in the sctp_wait_for_sndbuf function in     net/sctp/socket.c in the Linux kernel before 4.9.11     allows local users to cause a denial of service     (assertion failure and panic) via a multithreaded     application that peels off an association in a certain     buffer-full state.i1/4^CVE-2017-5986i1/4%0

  - net/sctp/socket.c in the Linux kernel through 4.10.1     does not properly restrict association peel-off     operations during certain wait states, which allows     local users to cause a denial of service (invalid     unlock and double free) via a multithreaded     application. NOTE: this vulnerability exists because of     an incorrect fix for CVE-2017-5986.i1/4^CVE-2017-6353i1/4%0

  - The ipxitf_ioctl function in net/ipx/af_ipx.c in the     Linux kernel through 4.11.1 mishandles reference     counts, which allows local users to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via a failed SIOCGIFADDR ioctl call for an     IPX interface.i1/4^CVE-2017-7487i1/4%0

  - fs/ext4/inode.c in the Linux kernel before 4.6.2, when     ext4 data=ordered mode is used, mishandles a     needs-flushing-before-commit list, which allows local     users to obtain sensitive information from other users'     files in opportunistic circumstances by waiting for a     hardware reset, creating a new file, making write     system calls, and reading this file.i1/4^CVE-2017-7495i1/4%0

  - The NFSv2/NFSv3 server in the nfsd subsystem in the     Linux kernel through 4.10.11 allows remote attackers to     cause a denial of service (system crash) via a long RPC     reply, related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c,     and fs/nfsd/nfsxdr.c.i1/4^CVE-2017-7645i1/4%0

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     through 4.10.15 allows attackers to cause a denial of     service (double free) or possibly have unspecified     other impact by leveraging use of the accept system     call.i1/4^CVE-2017-8890i1/4%0

  - The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel before     4.10.4 allows local users to obtain sensitive     information (in the dmesg ringbuffer and syslog) from     uninitialized kernel memory by using a crafted USB     device (posing as an io_ti USB serial device) to     trigger an integer underflow.i1/4^CVE-2017-8924i1/4%0

  - The IPv6 fragmentation implementation in the Linux     kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option,     which allows local users to cause a denial of service     (out-of-bounds read and BUG) or possibly have     unspecified other impact via crafted socket and send     system calls.i1/4^CVE-2017-9074i1/4%0

  - The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel through 4.11.1     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890.i1/4^CVE-2017-9075i1/4%0

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel through 4.11.1     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890.i1/4^CVE-2017-9077i1/4%0

  - The __ip6_append_data function in net/ipv6/ip6_output.c     in the Linux kernel through 4.11.3 is too late in     checking whether an overwrite of an skb data structure     may occur, which allows local users to cause a denial     of service (system crash) via crafted system     calls.i1/4^CVE-2017-9242i1/4%0

  - The ext4_fill_super function in fs/ext4/super.c in the     Linux kernel through 4.9.8 does not properly validate     meta block groups, which allows physically proximate     attackers to cause a denial of service (out-of-bounds     read and system crash) via a crafted ext4     image.i1/4^CVE-2016-10208i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load &amp; Store instructions (a commonly     used performance optimization). It relies on the     presence of a precisely-defined instruction sequence in     the privileged code as well as the fact that memory read     from address to which a recent memory write has occurred     may see an older value and subsequently cause an update     into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639, PowerPC)

  - kernel: net/packet: overflow in check for priv area size     (CVE-2017-7308)

  - kernel: AIO interface didn't use rw_verify_area() for     checking mandatory locking on files and size of access     (CVE-2012-6701)

  - kernel: AIO write triggers integer overflow in some     protocols (CVE-2015-8830)

  - kernel: NULL pointer dereference via keyctl     (CVE-2016-8650)

  - kernel: ping socket / AF_LLC connect() sin_family race     (CVE-2017-2671)

  - kernel: Race condition between multiple     sys_perf_event_open() calls (CVE-2017-6001)

  - kernel: Incorrect error handling in the set_mempolicy     and mbind compat syscalls in mm/mempolicy.c     (CVE-2017-7616)

  - kernel: mm subsystem does not properly enforce the     CONFIG_STRICT_DEVMEM protection mechanism     (CVE-2017-7889)

  - kernel: Double free in the inet_csk_clone_lock function     in net/ipv4/inet_connection_sock.c (CVE-2017-8890)

  - kernel: net: sctp_v6_create_accept_sk function     mishandles inheritance (CVE-2017-9075)

  - kernel: net: IPv6 DCCP implementation mishandles     inheritance (CVE-2017-9076)

  - kernel: net: tcp_v6_syn_recv_sock function mishandles     inheritance (CVE-2017-9077)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203)

  - kernel: a NULL pointer dereference in     net/dccp/output.c:dccp_write_xmit() leads to a system     crash (CVE-2018-1130)

  - kernel: Missing length check of payload in     net/sctp/sm_make_chunk.c:_sctp_make_chunk() function     allows denial of service (CVE-2018-5803)

Rebase to 4.11.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the vzkernel package and the readykernel-patch installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - The tcp_v6_syn_recv_sock function in     net/ipv6/tcp_ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The IPv6 DCCP implementation in the Linux kernel     mishandles inheritance, which allows local users to     cause a denial of service or possibly have unspecified     other impact via crafted system calls, a related issue     to CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The sctp_v6_create_accept_sk function in     net/sctp/ipv6.c in the Linux kernel mishandles     inheritance, which allows local users to cause a denial     of service or possibly have unspecified other impact     via crafted system calls, a related issue to     CVE-2017-8890. An unprivileged local user could use     this flaw to induce kernel memory corruption on the     system, leading to a crash. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

  - The IPv6 fragmentation implementation in the Linux     kernel through 4.11.1 does not consider that the     nexthdr field may be associated with an invalid option,     which allows local users to cause a denial of service     (out-of-bounds read and BUG) or possibly have     unspecified other impact via crafted socket and send     system calls.

  - The inet_csk_clone_lock function in     net/ipv4/inet_connection_sock.c in the Linux kernel     allows attackers to cause a denial of service (double     free) or possibly have unspecified other impact by     leveraging use of the accept system call. An     unprivileged local user could use this flaw to induce     kernel memory corruption on the system, leading to a     crash. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.

  - A vulnerability was found in the Linux kernel. An     unprivileged local user could trigger oops in     shash_async_export() by attempting to force the     in-kernel hashing algorithms into decrypting an empty     data set.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-7487     Li Qiang reported a reference counter leak in the     ipxitf_ioctl function which may result into a     use-after-free vulnerability, triggerable when a IPX     interface is configured.

  - CVE-2017-7645     Tuomas Haanpaa and Matti Kamunen from Synopsys Ltd     discovered that the NFSv2 and NFSv3 server     implementations are vulnerable to an out-of-bounds     memory access issue while processing arbitrarily long     arguments sent by NFSv2/NFSv3 PRC clients, leading to a     denial of service.

  - CVE-2017-7895     Ari Kauppi from Synopsys Ltd discovered that the NFSv2     and NFSv3 server implementations do not properly handle     payload bounds checking of WRITE requests. A remote     attacker with write access to a NFS mount can take     advantage of this flaw to read chunks of arbitrary     memory from both kernel-space and user-space.

  - CVE-2017-8064     Arnd Bergmann found that the DVB-USB core misused the     device logging system, resulting in a use-after-free     vulnerability, with unknown security impact.

  - CVE-2017-8890     It was discovered that the net_csk_clone_lock() function     allows a remote attacker to cause a double free leading     to a denial of service or potentially have other impact.

  - CVE-2017-8924     Johan Hovold found that the io_ti USB serial driver     could leak sensitive information if a malicious USB     device was connected.

  - CVE-2017-8925     Johan Hovold found a reference counter leak in the     omninet USB serial driver, resulting in a use-after-free     vulnerability. This can be triggered by a local user     permitted to open tty devices.

  - CVE-2017-9074     Andrey Konovalov reported that the IPv6 fragmentation     implementation could read beyond the end of a packet     buffer. A local user or guest VM might be able to use     this to leak sensitive information or to cause a denial     of service (crash).

  - CVE-2017-9075     Andrey Konovalov reported that the SCTP/IPv6     implementation wrongly initialised address lists on     connected sockets, resulting in a use-after-free     vulnerability, a similar issue to CVE-2017-8890. This     can be triggered by any local user.

  - CVE-2017-9076 / CVE-2017-9077     Cong Wang found that the TCP/IPv6 and DCCP/IPv6     implementations wrongly initialised address lists on     connected sockets, a similar issue to CVE-2017-9075.

  - CVE-2017-9242     Andrey Konovalov reported a packet buffer overrun in the     IPv6 implementation. A local user could use this for     denial of service (memory corruption; crash) and     possibly for privilege escalation.

  - CVE-2017-1000364     The Qualys Research Labs discovered that the size of the     stack guard page is not sufficiently large. The     stack-pointer can jump over the guard-page and moving     from the stack into another memory region without     accessing the guard-page. In this case no page-fault     exception is raised and the stack extends into the other     memory region. An attacker can exploit this flaw for     privilege escalation.

  The default stack gap protection is set to 256 pages and can be   configured via the stack_guard_gap kernel parameter on the kernel   command line.

  Further details can be found at   https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1842 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * An use-after-free flaw was found in the Linux kernel which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

    * A flaw was found that can be triggered in keyring_search_iterator in keyring.c if type->match is NULL. A     local user could use this flaw to crash the system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

    * It was found that the NFSv4 server in the Linux kernel did not properly validate layout type when     processing NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A remote attacker could use this flaw to soft-     lockup the system and thus cause denial of service. (CVE-2017-8797, Important)

    This update also fixes multiple Moderate and Low impact security issues:

    * CVE-2015-8839, CVE-2015-8970, CVE-2016-9576, CVE-2016-7042, CVE-2016-7097, CVE-2016-8645, CVE-2016-9576,     CVE-2016-9588, CVE-2016-9806, CVE-2016-10088, CVE-2016-10147, CVE-2017-2596, CVE-2017-2671, CVE-2017-5970,     CVE-2017-6001, CVE-2017-6951, CVE-2017-7187, CVE-2017-7616, CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890, CVE-2017-9076, CVE-2017-8890, CVE-2017-9077, CVE-2017-9242,     CVE-2014-7970, CVE-2014-7975, CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

    Documentation for these issues is available from the Release Notes document linked from the References     section.

    Red Hat would like to thank Igor Redko (Virtuozzo) and Andrey Ryabinin (Virtuozzo) for reporting     CVE-2017-2647; Igor Redko (Virtuozzo) and Vasily Averin (Virtuozzo) for reporting CVE-2015-8970; Marco     Grassi for reporting CVE-2016-8645; and Dmitry Vyukov (Google Inc.) for reporting CVE-2017-2596. The     CVE-2016-7042 issue was discovered by Ondrej Kozina (Red Hat); the CVE-2016-7097 issue was discovered by     Andreas Gruenbacher (Red Hat) and Jan Kara (SUSE); the CVE-2016-6213 and CVE-2016-9685 issues were     discovered by Qian Cai (Red Hat); and the CVE-2016-9604 issue was discovered by David Howells (Red Hat).

    Additional Changes:

    For detailed information on other changes in this release, see the Red Hat Enterprise Linux 7.4 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - An use-after-free flaw was found in the Linux kernel     which enables a race condition in the L2TPv3 IP     Encapsulation feature. A local user could use this flaw     to escalate their privileges or crash the system.
    (CVE-2016-10200, Important)

  - A flaw was found that can be triggered in     keyring_search_iterator in keyring.c if type->match is     NULL. A local user could use this flaw to crash the     system or, potentially, escalate their privileges.
    (CVE-2017-2647, Important)

  - It was found that the NFSv4 server in the Linux kernel     did not properly validate layout type when processing     NFSv4 pNFS LAYOUTGET and GETDEVICEINFO operands. A     remote attacker could use this flaw to soft- lockup the     system and thus cause denial of service. (CVE-2017-8797,     Important)

This update also fixes multiple Moderate and Low impact security issues :

  - CVE-2015-8839, CVE-2015-8970, CVE-2016-9576,     CVE-2016-7042, CVE-2016-7097, CVE-2016-8645,     CVE-2016-9576, CVE-2016-9588, CVE-2016-9806,     CVE-2016-10088, CVE-2016-10147, CVE-2017-2596,     CVE-2017-2671, CVE-2017-5970, CVE-2017-6001,     CVE-2017-6951, CVE-2017-7187, CVE-2017-7616,     CVE-2017-7889, CVE-2017-8890, CVE-2017-9074,     CVE-2017-8890, CVE-2017-9075, CVE-2017-8890,     CVE-2017-9076, CVE-2017-8890, CVE-2017-9077,     CVE-2017-9242, CVE-2014-7970, CVE-2014-7975,     CVE-2016-6213, CVE-2016-9604, CVE-2016-9685

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3236:06 advisory.

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0015 for details.

ID	Name	Product	Family	Published	Updated	Severity
101153	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-3343-2)	Nessus	Ubuntu Local Security Checks	6/30/2017	12/12/2025	high
101852	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1122)	Nessus	Huawei Local Security Checks	7/21/2017	12/9/2025	high
110887	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180619) (Spectre)	Nessus	Scientific Linux Local Security Checks	7/3/2018	9/6/2024	high
100563	Fedora 25 : kernel (2017-6f06be3fe9)	Nessus	Fedora Local Security Checks	6/1/2017	12/17/2025	high
100599	Virtuozzo 7 : readykernel-patch (VZA-2017-043)	Nessus	Virtuozzo Local Security Checks	6/5/2017	12/17/2025	high
100877	Debian DSA-3886-1 : linux - security update (Stack Clash)	Nessus	Debian Local Security Checks	6/20/2017	12/16/2025	critical
102143	RHEL 7 : kernel (RHSA-2017:1842)	Nessus	Red Hat Local Security Checks	8/3/2017	4/15/2025	high
102645	Scientific Linux Security Update : kernel on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	8/22/2017	11/26/2025	high
289119	MiracleLinux 4 : kernel-2.6.32-754.el6 (AXSA:2018-3236:06)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/10/2026	high
106469	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0015) (BlueBorne) (Meltdown) (Spectre) (Stack Clash)	Nessus	OracleVM Local Security Checks	1/30/2018	10/30/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

high

high

critical