According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In the Linux kernel through 4.14.13, the     rds_message_alloc_sgs() function does not validate a     value that is used during DMA page allocation, leading     to a heap-based out-of-bounds write (related to the     rds_rdma_extra_size() function in 'net/rds/rdma.c') and     thus to a system panic. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2018-5332)

  - In the Linux kernel through 4.14.13, the     rds_cmsg_atomic() function in 'net/rds/rdma.c'     mishandles cases where page pinning fails or an invalid     address is supplied by a user. This can lead to a NULL     pointer dereference in rds_atomic_free_op() and thus to     a system panic.(CVE-2018-5333)

  - A flaw was found in the Linux kernel's handling of     loopback devices. An attacker, who has permissions to     setup loopback disks, may create a denial of service or     other unspecified actions.(CVE-2018-5344)

  - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c     in the Linux kernel, through 4.14.15, allows local     users to obtain sensitive address information by     reading dmesg data from an SBS HC printk     call.(CVE-2018-5750)

  - The futex_requeue function in kernel/futex.c in the     Linux kernel, before 4.14.15, might allow attackers to     cause a denial of service (integer overflow) or     possibly have unspecified other impacts by triggering a     negative wake or requeue value. Due to the nature of     the flaw, privilege escalation cannot be fully ruled     out, although we believe it is unlikely.(CVE-2018-6927)

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757)

  - A an integer overflow vulnerability was discovered in     the Linux kernel, from version 3.4 through 4.15, in the     drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An     attacker with access to the udldrmfb driver could     exploit this to obtain full read and write permissions     on kernel physical pages, resulting in a code execution     in kernel space.(CVE-2018-8781)

  - A flaw was found in the way the Linux KVM module     processed the trap flag(TF) bit in EFLAGS during     emulation of the syscall instruction, which leads to a     debug exception(#DB) being raised in the guest stack. A     user/process inside a guest could use this flaw to     potentially escalate their privileges inside the guest.
    Linux guests are not affected by this.(CVE-2017-7518)

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service.(CVE-2017-18360)

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19.(CVE-2018-18281)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary     task.(CVE-2018-17972)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found In the Linux kernel, through version     4.19.6, where a local user could exploit a     use-after-free in the ALSA driver by supplying a     malicious USB Sound device (with zero interfaces) that     is mishandled in usb_audio_probe in sound/usb/card.c.
    An attacker could corrupt memory and possibly escalate     privileges if the attacker is able to have physical     access to the system.(CVE-2018-19824)

  - A security flaw was found in the Linux kernel in a way     that the cleancache subsystem clears an inode after the     final file truncation (removal). The new file created     with the same inode may contain leftover pages from     cleancache and the old file data instead of the new     one.(CVE-2018-16862)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out.(CVE-2018-18559)

  - A new software page cache side channel attack scenario     was discovered in operating systems that implement the     very common 'page cache' caching mechanism. A malicious     user/process could use 'in memory' page-cache knowledge     to infer access timings to shared memory and gain     knowledge which can be used to reduce effectiveness of     cryptographic strength by monitoring algorithmic     behavior, infer access patterns of memory to determine     code paths taken, and exfiltrate data to a blinded     attacker through page-granularity access times as a     side-channel.(CVE-2019-5489)

  - A flaw was found in mmap in the Linux kernel allowing     the process to map a null page. This allows attackers     to abuse this mechanism to turn null pointer     dereferences into workable exploits.(CVE-2019-9213)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

  - An issue was discovered in the Linux kernel through     4.19. An information leak in cdrom_ioctl_select_disc in     drivers/cdrom/cdrom.c could be used by local attackers     to read kernel memory because a cast from unsigned long     to int interferes with bounds checking.(CVE-2018-18710)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka     GPU driver) for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, mishandles the     KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers     to gain privileges by leveraging accidental read-write     mappings, aka Qualcomm internal bug     CR988993.(CVE-2016-2067i1/4%0

  - Integer overflow in the mem_check_range function in     drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel     before 4.9.10 allows local users to cause a denial of     service (memory corruption), obtain sensitive     information from kernel memory, or possibly have     unspecified other impact via a write or read request     involving the 'RDMA protocol over infiniband' (aka Soft     RoCE) technology.(CVE-2016-8636i1/4%0

  - Heap-based buffer overflow in the     logi_dj_ll_raw_request function in     drivers/hid/hid-logitech-dj.c in the Linux kernel     before 3.16.2 allows physically proximate attackers to     cause a denial of service (system crash) or possibly     execute arbitrary code via a crafted device that     specifies a large report size for an LED     report.(CVE-2014-3183i1/4%0

  - The futex_requeue function in kernel/futex.c in the     Linux kernel, before 4.14.15, might allow attackers to     cause a denial of service (integer overflow) or     possibly have unspecified other impacts by triggering a     negative wake or requeue value. Due to the nature of     the flaw, privilege escalation cannot be fully ruled     out, although we believe it is     unlikely.(CVE-2018-6927i1/4%0

  - The hub_activate function in drivers/usb/core/hub.c in     the Linux kernel before 4.3.5 does not properly     maintain a hub-interface data structure, which allows     physically proximate attackers to cause a denial of     service (invalid memory access and system crash) or     possibly have unspecified other impact by unplugging a     USB hub device.(CVE-2015-8816i1/4%0

  - It was found that the blk_rq_map_user_iov() function in     the Linux kernel's block device implementation did not     properly restrict the type of iterator, which could     allow a local attacker to read or write to arbitrary     kernel memory locations or cause a denial of service     (use-after-free) by leveraging write access to a     /dev/sg device.(CVE-2016-9576i1/4%0

  - A security flaw was found in the Linux kernel's     networking subsystem that destroying the network     interface with huge number of ipv4 addresses assigned     keeps 'rtnl_lock' spinlock for a very long time (up to     hour). This blocks many network-related operations,     including creation of new incoming ssh connections.The     problem is especially important for containers, as the     container owner has enough permissions to trigger this     and block a network access on a whole host, outside the     container.(CVE-2016-3156i1/4%0

  - The edge_bulk_in_callback function in     drivers/usb/serial/io_ti.c in the Linux kernel allows     local users to obtain sensitive information (in the     dmesg ringbuffer and syslog) from uninitialized kernel     memory by using a crafted USB device (posing as an     io_ti USB serial device) to trigger an integer     underflow.(CVE-2017-8924i1/4%0

  - The IPv4 implementation in the Linux kernel before     3.18.8 does not properly consider the length of the     Read-Copy Update (RCU) grace period for redirecting     lookups in the absence of caching, which allows remote     attackers to cause a denial of service (memory     consumption or system crash) via a flood of     packets.(CVE-2015-1465i1/4%0

  - A symlink size validation was missing in Linux kernels     built with UDF file system (CONFIG_UDF_FS) support,     allowing the corruption of kernel memory. An attacker     able to mount a corrupted/malicious UDF file system     image could cause the kernel to crash.(CVE-2014-9728i1/4%0

  - net/ipv6/ip6_output.c in the Linux kernel through     3.11.4 does not properly determine the need for UDP     Fragmentation Offload (UFO) processing of small packets     after the UFO queueing of a large packet, which allows     remote attackers to cause a denial of service (memory     corruption and system crash) or possibly have     unspecified other impact via network traffic that     triggers a large response packet.(CVE-2013-4387i1/4%0

  - It was found that nfsd is missing permissions check     when setting ACL on files, this may allow a local users     to gain access to any file by setting a crafted     ACL.(CVE-2016-1237i1/4%0

  - In the Linux kernel before 4.13.5, a local user could     create keyrings for other users via keyctl commands,     setting unwanted defaults or causing a denial of     service.(CVE-2017-18270i1/4%0

  - An issue was discovered in the Linux kernel where an     integer overflow in kernel/time/posix-timers.c in the     POSIX timer code is caused by the way the overrun     accounting works. Depending on interval and expiry time     values, the overrun can be larger than INT_MAX, but the     accounting is int based. This basically makes the     accounting values, which are visible to user space via     timer_getoverrun(2) and siginfo::si_overrun,     random.(CVE-2018-12896i1/4%0

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and reused. This is     fixed in the following kernel versions: 4.9.135,     4.14.78, 4.18.16, 4.19.(CVE-2018-18281i1/4%0

  - The netfilter subsystem in the Linux kernel through     4.15.7 mishandles the case of a rule blob that contains     a jump but lacks a user-defined chain, which allows     local users to cause a denial of service (NULL pointer     dereference) by leveraging the CAP_NET_RAW or     CAP_NET_ADMIN capability, related to arpt_do_table in     net/ipv4/netfilter/arp_tables.c, ipt_do_table in     net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in     net/ipv6/netfilter/ip6_tables.c.(CVE-2018-1065i1/4%0

  - The use of a kzalloc with an integer multiplication     allowed an integer overflow condition to be reached in     vfio_pci_intrs.c. This combined with CVE-2016-9083 may     allow an attacker to craft an attack and use     unallocated memory, potentially crashing the     machine.(CVE-2016-9084i1/4%0

  - The acm_probe function in drivers/usb/class/cdc-acm.c     in the Linux kernel before 4.5.1 allows physically     proximate attackers to cause a denial of service (NULL     pointer dereference and system crash) via a USB device     without both a control and a data endpoint     descriptor.(CVE-2016-3138i1/4%0

  - It was discovered that root can gain direct access to     an internal keyring, such as '.dns_resolver' in RHEL-7     or '.builtin_trusted_keys' upstream, by joining it as     its session keyring. This allows root to bypass module     signature verification by adding a new public key of     its own devising to the keyring.(CVE-2016-9604i1/4%0

  - An information leak flaw was found in the Linux     kernel's IEEE 802.11 wireless networking     implementation. When software encryption was used, a     remote attacker could use this flaw to leak up to 8     bytes of plaintext.(CVE-2014-8709i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2043 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: vhost_net: infinite loop while receiving packets leads to DoS (CVE-2019-3900)

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * kernel: Buffer overflow in hidp_process_report (CVE-2018-9363)

    * kernel: l2tp: Race condition between pppol2tp_session_create() and l2tp_eth_create() (CVE-2018-9517)

    * kernel: kvm: guest userspace to guest kernel write (CVE-2018-10853)

    * kernel: use-after-free Read in vhost_transport_send_pkt (CVE-2018-14625)

    * kernel: use-after-free in ucma_leave_multicast in drivers/infiniband/core/ucma.c (CVE-2018-14734)

    * kernel: Mishandling of indirect calls weakens Spectre mitigation for paravirtual guests (CVE-2018-15594)

    * kernel: TLB flush happens too late on mremap (CVE-2018-18281)

    * kernel: Heap address information leak while using L2CAP_GET_CONF_OPT (CVE-2019-3459)

    * kernel: Heap address information leak while using L2CAP_PARSE_CONF_RSP (CVE-2019-3460)

    * kernel: denial of service vector through vfio DMA mappings (CVE-2019-3882)

    * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599)

    * kernel: a NULL pointer dereference in drivers/scsi/megaraid/megaraid_sas_base.c leading to DoS     (CVE-2019-11810)

    * kernel: fs/ext4/extents.c leads to information disclosure (CVE-2019-11833)

    * kernel: Information exposure in fd_locked_ioctl function in drivers/block/floppy.c (CVE-2018-7755)

    * kernel: Memory leak in drivers/net/wireless/mac80211_hwsim.c:hwsim_new_radio_nl() can lead to potential     denial of service (CVE-2018-8087)

    * kernel: HID: debug: Buffer overflow in hid_debug_events_read() in drivers/hid/hid-debug.c     (CVE-2018-9516)

    * kernel: Integer overflow in the alarm_timer_nsleep function (CVE-2018-13053)

    * kernel: NULL pointer dereference in lookup_slow function (CVE-2018-13093)

    * kernel: NULL pointer dereference in xfs_da_shrink_inode function (CVE-2018-13094)

    * kernel: NULL pointer dereference in fs/xfs/libxfs/xfs_inode_buf.c (CVE-2018-13095)

    * kernel: Information leak in cdrom_ioctl_drive_status (CVE-2018-16658)

    * kernel: out-of-bound read in memcpy_fromiovecend() (CVE-2018-16885)

    * Kernel: KVM: leak of uninitialized stack contents to guest (CVE-2019-7222)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2017-18249

A race condition was discovered in the disk space allocator of F2FS. A user with access to an F2FS volume could use this to cause a denial of service or other security impact.

CVE-2018-1128, CVE-2018-1129

The cephx authentication protocol used by Ceph was susceptible to replay attacks, and calculated signatures incorrectly. These vulnerabilities in the server required changes to authentication that are incompatible with existing clients. The kernel's client code has now been updated to be compatible with the fixed server.

CVE-2018-3639 (SSB)

Multiple researchers have discovered that Speculative Store Bypass (SSB), a feature implemented in many processors, could be used to read sensitive information from another context. In particular, code in a software sandbox may be able to read sensitive information from outside the sandbox. This issue is also known as Spectre variant 4.

This update adds a further mitigation for this issue in the eBPF (Extended Berkeley Packet Filter) implementation.

CVE-2018-5391 (FragmentSmack)

Juha-Matti Tilli discovered a flaw in the way the Linux kernel handled reassembly of fragmented IPv4 and IPv6 packets. A remote attacker can take advantage of this flaw to trigger time and calculation expensive fragment reassembly algorithms by sending specially crafted packets, leading to remote denial of service.

This was previously mitigated by reducing the default limits on memory usage for incomplete fragmented packets. This update replaces that mitigation with a more complete fix.

CVE-2018-5848

The wil6210 wifi driver did not properly validate lengths in scan and connection requests, leading to a possible buffer overflow. On systems using this driver, a local user with the CAP_NET_ADMIN capability could use this for denial of service (memory corruption or crash) or potentially for privilege escalation.

CVE-2018-12896, CVE-2018-13053

Team OWL337 reported possible integer overflows in the POSIX timer implementation. These might have some security impact.

CVE-2018-13096, CVE-2018-13097, CVE-2018-13100, CVE-2018-14614, CVE-2018-14616

Wen Xu from SSLab at Gatech reported that crafted F2FS volumes could trigger a crash (BUG, Oops, or division by zero) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2018-13406

Dr Silvio Cesare of InfoSect reported a potential integer overflow in the uvesafb driver. A user with permission to access such a device might be able to use this for denial of service or privilege escalation.

CVE-2018-14610, CVE-2018-14611, CVE-2018-14612, CVE-2018-14613

Wen Xu from SSLab at Gatech reported that crafted Btrfs volumes could trigger a crash (Oops) and/or out-of-bounds memory access. An attacker able to mount such a volume could use this to cause a denial of service or possibly for privilege escalation.

CVE-2018-15471 ((XSA-270)

Felix Wilhelm of Google Project Zero discovered a flaw in the hash handling of the xen-netback Linux kernel module. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in privilege escalation, denial of service, or information leaks.

https://xenbits.xen.org/xsa/advisory-270.html

CVE-2018-16862

Vasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team discovered that the cleancache memory management feature did not invalidate cached data for deleted files. On Xen guests using the tmem driver, local users could potentially read data from other users' deleted files if they were able to create new files on the same volume.

CVE-2018-17972

Jann Horn reported that the /proc/*/stack files in procfs leaked sensitive data from the kernel. These files are now only readable by users with the CAP_SYS_ADMIN capability (usually only root)

CVE-2018-18281

Jann Horn reported a race condition in the virtual memory manager that can result in a process briefly having access to memory after it is freed and reallocated. A local user could possibly exploit this for denial of service (memory corruption) or for privilege escalation.

CVE-2018-18690

Kanda Motohiro reported that XFS did not correctly handle some xattr (extended attribute) writes that require changing the disk format of the xattr. A user with access to an XFS volume could use this for denial of service.

CVE-2018-18710

It was discovered that the cdrom driver does not correctly validate the parameter to the CDROM_SELECT_DISC ioctl. A user with access to a cdrom device could use this to read sensitive information from the kernel or to cause a denial of service (crash).

CVE-2018-19407

Wei Wu reported a potential crash (Oops) in the KVM implementation for x86 processors. A user with access to /dev/kvm could use this for denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.144-3.1~deb8u1. This version also includes fixes for Debian bugs #890034, #896911, #907581, #915229, and #915231; and other fixes included in upstream stable updates.

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A division-by-zero in set_termios(), when debugging is     enabled, was found in the Linux kernel. When the     [io_ti] driver is loaded, a local unprivileged attacker     can request incorrect high transfer speed in the     change_port_settings() in the     drivers/usb/serial/io_ti.c so that the divisor value     becomes zero and causes a system crash resulting in a     denial of service. (CVE-2017-18360)

  - Since Linux kernel version 3.2, the mremap() syscall     performs TLB flushes after dropping pagetable locks. If     a syscall such as ftruncate() removes entries from the     pagetables of a task that is in the middle of mremap(),     a stale TLB entry can remain for a short time that     permits access to a physical page after it has been     released back to the page allocator and     reused.(CVE-2018-18281)

  - A flaw was discovered in the Linux kernel's USB     subsystem in the __usb_get_extra_descriptor() function     in the drivers/usb/core/usb.c which mishandles a size     check during the reading of an extra descriptor data.
    By using a specially crafted USB device which sends a     forged extra descriptor, an unprivileged user with     physical access to the system can potentially cause a     privilege escalation or trigger a system crash or lock     up and thus to cause a denial of service     (DoS).(CVE-2018-20169)

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741)

  - A use-after-free flaw can occur in the Linux kernel due     to a race condition between packet_do_bind() and     packet_notifier() functions called for an AF_PACKET     socket. An unprivileged, local user could use this flaw     to induce kernel memory corruption on the system,     leading to an unresponsive system or to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out. (CVE-2018-18559)

  - An issue was discovered in can_can_gw_rcv in     net/can/gw.c in the Linux kernel through 4.19.13. The     CAN frame modification rules allow bitwise logical     operations that can be also applied to the can_dlc     field. Because of a missing check, the CAN drivers may     write arbitrary content beyond the data registers in     the CAN controller's I/O memory when processing can-gw     manipulated outgoing frames. This is related to     cgw_csum_xor_rel. An unprivileged user can trigger a     system crash (general protection fault).(CVE-2019-3701)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause a use-after-free in     ext4_xattr_set_entry function and a denial of service     or unspecified other impact may occur by renaming a     file in a crafted ext4 filesystem     image.(CVE-2018-10879)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in     jbd2_journal_dirty_metadata(), a denial of service, and     a system crash by mounting and operating on a crafted     ext4 filesystem image.(CVE-2018-10883)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation.(CVE-2018-10902)

  - The Linux kernel is vulnerable to a NULL pointer     dereference in the ext4/xattr.c:ext4_xattr_inode_hash()     function. An attacker could trick a legitimate user or     a privileged attacker could exploit this to cause a     NULL pointer dereference with a crafted ext4 image.
    (CVE-2018-1094)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory.

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
124834	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1512)	Nessus	Huawei Local Security Checks	5/13/2019	5/20/2022	high
124975	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1522)	Nessus	Huawei Local Security Checks	5/14/2019	5/20/2022	high
127655	RHEL 7 : kernel-rt (RHSA-2019:2043)	Nessus	Red Hat Local Security Checks	8/12/2019	11/6/2024	high
122879	Debian DLA-1715-1 : linux-4.9 security update (Spectre)	Nessus	Debian Local Security Checks	3/18/2019	1/9/2026	high
123605	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2019-1131)	Nessus	Huawei Local Security Checks	4/2/2019	5/20/2022	high
164602	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)	Nessus	Misc.	9/1/2022	2/21/2026	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical