The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4300 advisory.

    - udf: Check component length before reading it (Jan Kara)  [Orabug: 21193696]  {CVE-2014-9728}
    - udf: Verify i_size when loading inode (Shan Hai)  [Orabug: 21193696]  {CVE-2014-9728}
    - scsi: libsas: defer ata device eh commands to libata (Jason Yan)  [Orabug: 28459689]  {CVE-2018-10021}
    - nfsd: silence sparse warning about accessing credentials (Jeff Layton)  [Orabug: 28824742]     {CVE-2017-13168}
    - scsi: sg: mitigate read/write abuse (Jann Horn)  [Orabug: 28824742]  {CVE-2017-13168}
    - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() (Alexander Potapenko)  [Orabug: 28892683]     {CVE-2018-1000204}
    - ALSA: rawmidi: Change resized buffers atomically (Takashi Iwai)  [Orabug: 28898650]  {CVE-2018-10902}
    - KVM: MTRR: remove MSR 0x2f8 (Andy Honig)  [Orabug: 28901657]  {CVE-2016-3713} {CVE-2016-3713}
    - cdrom: fix improper type cast, which can leat to information leak. (Young_X)  [Orabug: 28929777]     {CVE-2018-16658} {CVE-2018-10940} {CVE-2018-18710}
    - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)   {CVE-2018-7755}     {CVE-2018-7755}
    - crypto: salsa20 - fix blkcipher_walk API usage (Eric Biggers)  [Orabug: 28976585]  {CVE-2017-17805}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - xfs: don't call xfs_da_shrink_inode with NULL bp (Eric     Sandeen) [Orabug: 28898616] (CVE-2018-13094)

  - ALSA: rawmidi: Change resized buffers atomically     (Takashi Iwai) [Orabug: 28898636] (CVE-2018-10902)

  - md/raid5: fix a race condition in stripe batch (Shaohua     Li) [Orabug: 28917012]

  - xfs: don't fail when converting shortform attr to long     form during ATTR_REPLACE (Darrick J. Wong) [Orabug:
    28924091] (CVE-2018-18690)

  - certs: Add Oracle's new X509 cert into the kernel     keyring (Eric Snowberg) [Orabug: 28926203]

  - block: fix bdi vs gendisk lifetime mismatch (Shan Hai)     [Orabug: 28945039]

  - Add the following entries to     'uek-rpm/ol[67]/nano_modules.list':
    kernel/drivers/net/net_failover.ko     kernel/net/core/failover.ko Fixes: b3bc7c163fc9 ('net:
    Introduce generic failover module') (Vijay Balakrishna)     [Orabug: 28953351]

  - floppy: Do not copy a kernel pointer to user memory in     FDGETPRM ioctl (Andy Whitcroft) [Orabug: 28956547]     (CVE-2018-7755) (CVE-2018-7755)

  - iov_iter: don't revert iov buffer if csum error (Ding     Tianhong) [Orabug: 28960296]

  - crypto: salsa20 - fix blkcipher_walk API usage (Eric     Biggers) [Orabug: 28976583] (CVE-2017-17805)

  - crypto: hmac - require that the underlying hash     algorithm is unkeyed (Eric Biggers) [Orabug: 28976653]     (CVE-2017-17806)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0641 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: net/rxrpc: overflow in decoding of krb5 principal (CVE-2017-7482)

    * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows     denial of service (CVE-2018-5803)

    * kernel: use-after-free in ntfs_read_locked_inode in the ntfs.ko (CVE-2018-12929)

    * kernel: stack-based out-of-bounds write in ntfs_end_buffer_async_read in the ntfs.ko (CVE-2018-12930)

    * kernel: stack-based out-of-bounds write in ntfs_attr_find in the ntfs.ko (CVE-2018-12931)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Remove the NTFS module from the MRG 2.5.x realtime kernel (BZ#1674523)

    * update the MRG 2.5.z 3.10 kernel-rt sources (BZ#1674935)

    Users of kernel-rt are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data) sub-     operations. These sub-operations allow the processor to     hand-off address generation logic into these sub-     operations for optimized writes. Both of these sub-     operations write to a shared distributed processor     structure called the 'processor store buffer'. As a     result, an unprivileged attacker could use this flaw to     read private data resident within the CPU's processor     store buffer. (CVE-2018-12126)

  - A flaw was found in the implementation of the fill     buffer, a mechanism used by modern CPUs when a cache-     miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time can     be measured to infer data in the fill buffer.
    (CVE-2018-12130)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11091)

  - Microprocessors use a load port subcomponent to     perform load operations from memory or IO. During a load     operation, the load port receives data from the memory     or IO subsystem and then provides the data to the CPU     registers and operations in the CPUs pipelines. Stale     load operations results are stored in the 'load port'     table until overwritten by newer operations. Certain     load-port operations triggered by an attacker can be     used to reveal data about previous stale requests     leaking data back to the attacker via a timing side-     channel. (CVE-2018-12127)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3967 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * kernel: Memory corruption due to incorrect socket cloning (CVE-2018-9568)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Use-after-free due to race condition in AF_PACKET implementation (CVE-2018-18559)

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974)

    * Kernel: KVM: nVMX: use-after-free of the hrtimer for emulation of the preemption timer (CVE-2019-7221)

    * kernel: Inifinite loop vulnerability in mm/madvise.c:madvise_willneed() function allows local denial of     service (CVE-2017-18208)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * A cluster node has multiple hung mv processes that are accessing a gfs2 filesystem. (BZ#1716321)

    * Growing unreclaimable slab memory (BZ#1741918)

    * [LLNL 7.5 Bug] slab leak causing a crash when using kmem control group (BZ#1748236)

    * kernel build: parallelize redhat/mod-sign.sh (BZ#1755328)

    * kernel build: speed up module compression step (BZ#1755337)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
119535	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4300)	Nessus	Oracle Linux Local Security Checks	12/10/2018	2/9/2026	high
119566	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0286)	Nessus	OracleVM Local Security Checks	12/11/2018	7/16/2024	high
123432	RHEL 6 : kernel-rt (RHSA-2019:0641)	Nessus	Red Hat Local Security Checks	3/28/2019	11/6/2024	high
127312	NewStart CGSL MAIN 4.06 : kernel Multiple Vulnerabilities (NS-SA-2019-0092)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	12/6/2022	high
131375	RHEL 7 : kernel (RHSA-2019:3967)	Nessus	Red Hat Local Security Checks	11/27/2019	11/7/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high