Security Fix(es) :

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load &amp; Store instructions (a commonly     used performance optimization). It relies on the     presence of a precisely-defined instruction sequence in     the privileged code as well as the fact that memory read     from address to which a recent memory write has occurred     may see an older value and subsequently cause an update     into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639, PowerPC)

  - kernel: net/packet: overflow in check for priv area size     (CVE-2017-7308)

  - kernel: AIO interface didn't use rw_verify_area() for     checking mandatory locking on files and size of access     (CVE-2012-6701)

  - kernel: AIO write triggers integer overflow in some     protocols (CVE-2015-8830)

  - kernel: NULL pointer dereference via keyctl     (CVE-2016-8650)

  - kernel: ping socket / AF_LLC connect() sin_family race     (CVE-2017-2671)

  - kernel: Race condition between multiple     sys_perf_event_open() calls (CVE-2017-6001)

  - kernel: Incorrect error handling in the set_mempolicy     and mbind compat syscalls in mm/mempolicy.c     (CVE-2017-7616)

  - kernel: mm subsystem does not properly enforce the     CONFIG_STRICT_DEVMEM protection mechanism     (CVE-2017-7889)

  - kernel: Double free in the inet_csk_clone_lock function     in net/ipv4/inet_connection_sock.c (CVE-2017-8890)

  - kernel: net: sctp_v6_create_accept_sk function     mishandles inheritance (CVE-2017-9075)

  - kernel: net: IPv6 DCCP implementation mishandles     inheritance (CVE-2017-9076)

  - kernel: net: tcp_v6_syn_recv_sock function mishandles     inheritance (CVE-2017-9077)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203)

  - kernel: a NULL pointer dereference in     net/dccp/output.c:dccp_write_xmit() leads to a system     crash (CVE-2018-1130)

  - kernel: Missing length check of payload in     net/sctp/sm_make_chunk.c:_sctp_make_chunk() function     allows denial of service (CVE-2018-5803)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3698-1 advisory.

    It was discovered that the nested KVM implementation in the Linux kernel in some situations did not     properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker     in a guest could use this to cause a denial of service (system crash). (CVE-2017-12154)

    Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux     kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a     denial of service (system crash). (CVE-2017-12193)

    It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating     and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-15265)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX     registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker     could use this to expose sensitive information. (CVE-2018-3665)

    Wang Qize discovered that an information disclosure vulnerability existed in the SMBus driver for ACPI     Embedded Controllers in the Linux kernel. A local attacker could use this to expose sensitive information     (kernel pointer addresses). (CVE-2018-5750)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927)

    It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel.
    A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - dm: fix race between dm_get_from_kobject and
    __dm_destroy (Hou Tao) (CVE-2017-18203)

  - drm: udl: Properly check framebuffer mmap offsets (Greg     Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781)

  - kernel/exit.c: avoid undefined behaviour when calling     wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers:
    UBSAN: Undefined behaviour in kernel/exit.c:1651:9     (mridula shastry) [Orabug: 27875488] (CVE-2018-10087)

  - kernel/signal.c: avoid undefined behaviour in     kill_something_info When running kill(72057458746458112,     0) in userspace I hit the following issue. (mridula     shastry) (CVE-2018-10124)

  - bluetooth: Validate socket address length in     sco_sock_bind. (mlevatic) [Orabug: 28130293]     (CVE-2015-8575)

  - dccp: check sk for closed state in dccp_sendmsg (Alexey     Kodanev) [Orabug: 28220402] (CVE-2017-8824)     (CVE-2018-1130)

  - sctp: verify size of a new chunk in _sctp_make_chunk     (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803)

  - mm/mempolicy.c: fix error handling in set_mempolicy and     mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616)

  - xfrm: policy: check policy direction value (Vladis     Dronov) [Orabug: 28264121] (CVE-2017-11600)     (CVE-2017-11600)

  - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug:
    28156176] (CVE-2018-3665)

  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng     Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741)

  - xfs: set format back to extents if     xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug:
    27989498] (CVE-2018-10323)

  - Bluetooth: Prevent stack info leak from the EFS element.
    (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410)     (CVE-2017-1000410)

  - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2549)

  - ALSA: timer: Harden slave timer list handling (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548)

  - ALSA: timer: Fix double unlink of active_list (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2545)

  - ALSA: seq: Fix missing NULL check at remove_events ioctl     (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543)

  - ALSA: seq: Fix race at timer setup and close (Takashi     Iwai) [Orabug: 28058229] (CVE-2016-2544)

  - ALSA: usb-audio: avoid freeing umidi object twice     (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384)

  - perf/hwbp: Simplify the perf-hwbp code, fix     documentation (Linus Torvalds) [Orabug: 27947608]     (CVE-2018-1000199)

  - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix     documentation' (Brian Maly) [Orabug: 27947608]

ID	Name	Product	Family	Published	Updated	Severity
110887	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180619) (Spectre)	Nessus	Scientific Linux Local Security Checks	7/3/2018	9/6/2024	high
110900	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3698-1)	Nessus	Ubuntu Local Security Checks	7/3/2018	8/27/2024	high
111022	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)	Nessus	OracleVM Local Security Checks	7/12/2018	9/5/2024	high

Detections

Analytics

Plugins Search

high

high

high