The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A flaw was found in the Linux kernel's handling of fork     failure when dealing with event messages in the     userfaultfd code. Failure to fork correctly can create a     fork event that will be removed from an already freed     list of events. (CVE-2017-15126)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is unlikely.
    (CVE-2017-7294)

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimization) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3646)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a use-     after-free issue. A user/process could use this flaw to     crash the guest VM resulting in a denial of service     issue or, potentially, gain privileged access to a     system. (CVE-2019-6974)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when a     L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A flaw was found in the Linux kernel's handling of fork     failure when dealing with event messages in the     userfaultfd code. Failure to fork correctly can create a     fork event that will be removed from an already freed     list of events. (CVE-2017-15126)

  - An out-of-bounds write vulnerability was found in the     Linux kernel's vmw_surface_define_ioctl() function, in     the 'drivers/gpu/drm/vmwgfx/vmwgfx_surface.c' file. Due     to the nature of the flaw, privilege escalation cannot     be fully ruled out, although we believe it is unlikely.
    (CVE-2017-7294)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor implements its device     control API. While creating a device via     kvm_ioctl_create_device(), the device holds a reference     to a VM object, later this reference is transferred to     the caller's file descriptor table. If such file     descriptor was to be closed, reference count to the VM     object could become zero, potentially leading to a use-     after-free issue. A user/process could use this flaw to     crash the guest VM resulting in a denial of service     issue or, potentially, gain privileged access to a     system. (CVE-2019-6974)

  - A use-after-free vulnerability was found in the way the     Linux kernel's KVM hypervisor emulates a preemption     timer for L2 guests when nested (=1) virtualization is     enabled. This high resolution timer(hrtimer) runs when a     L2 guest is active. After VM exit, the sync_vmcs12()     timer object is stopped. The use-after-free occurs if     the timer object is freed before calling sync_vmcs12()     routine. A guest user/process could use this flaw to     crash the host kernel resulting in a denial of service     or, potentially, gain privileged access to a system.
    (CVE-2019-7221)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2809 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * Kernel: page cache side channel attacks (CVE-2019-5489)

    * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974)

    * kernel: broken permission and object lifetime handling for PTRACE_TRACEME (CVE-2019-13272)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * [kernel-alt]: BUG: unable to handle kernel NULL pointer IP: crypto_remove_spawns+0x118/0x2e0     (BZ#1536967)

    * [HPE Apache] update ssif max_xmit_msg_size limit for multi-part messages (BZ#1610534)

    * RHEL-Alt-7.6 - powerpc/pseries: Fix unitialized timer reset on migration / powerpc/pseries/mobility:
    Extend start/stop topology update scope (LPM) (BZ#1673613)

    * RHEL-Alt-7.6 - s390: sha3_generic module fails and triggers panic when in FIPS mode (BZ#1673979)

    * RHEL-Alt-7.6 - System crashed after oom - During ICP deployment (BZ#1710304)

    * kernel-alt: Race condition in hashtables [rhel-alt-7.6.z] (BZ#1712127)

    * RHEL-Alt-7.6 - OP930:PM_Test:cpupower -r command set values for first 3 cores in quad and misses last     core. (CORAL) (BZ#1717836)

    * RHEL-Alt-7.6 - disable runtime NUMA remapping for PRRN/LPM/VPHN (BZ#1717906)

    * fragmented packets timing out (BZ#1729066)

    * Backport TCP follow-up for small buffers (BZ#1733617)

    Enhancement(s):

    * RHEL-Alt-7.6 - perfevent PMDA cannot create file descriptors for reading nest events using the perf API     (pcp/kernel) (CORAL) (BZ#1723036)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in     the Linux kernel before 4.6.1 supports MSR 0x2f8, which     allows guest OS users to read or write to the     kvm_arch_vcpu data structure, and consequently obtain     sensitive information or cause a denial of service     (system crash), via a crafted ioctl     call.(CVE-2016-3713)

  - Linux kernel built with the Kernel-based Virtual     Machine (CONFIG_KVM) support is vulnerable to a null     pointer dereference flaw. It could occur on x86     platform, when emulating an undefined instruction. An     attacker could use this flaw to crash the host kernel     resulting in DoS.(CVE-2016-8630)

  - Linux kernel built with the Kernel-based Virtual     Machine (CONFIG_KVM) support was vulnerable to an     incorrect segment selector(SS) value error. The error     could occur while loading values into the SS register     in long mode. A user or process inside a guest could     use this flaw to crash the guest, resulting in DoS or     potentially escalate their privileges inside the     guest.(CVE-2017-2583)

  - arch/x86/kvm/emulate.c in the Linux kernel through     4.9.3 allows local users to obtain sensitive     information from kernel memory or cause a denial of     service (use-after-free) via a crafted application that     leverages instruction emulation for fxrstor, fxsave,     sgdt, and sidt.(CVE-2017-2584)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (i1/4z1024) index value.(CVE-2017-1000252)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5715 triggers the     speculative execution by utilizing branch target     injection. It relies on the presence of a     precisely-defined instruction sequence in the     privileged code as well as the fact that memory     accesses may cause allocation into the microprocessor's     data cache even for speculatively executed instructions     that never actually commit (retire). As a result, an     unprivileged attacker could use this flaw to cross the     syscall and guest/host boundaries and read privileged     memory by conducting targeted cache side-channel     attacks.(CVE-2017-5715)

  - A flaw was found in the way the Linux KVM module     processed the trap flag(TF) bit in EFLAGS during     emulation of the syscall instruction, which leads to a     debug exception(#DB) being raised in the guest stack. A     user/process inside a guest could use this flaw to     potentially escalate their privileges inside the guest.
    Linux guests are not affected by this.(CVE-2017-7518)

  - Linux kernel compiled with the KVM virtualization     (CONFIG_KVM) support is vulnerable to an out-of-bounds     read access issue. It could occur when emulating vmcall     instructions invoked by a guest. A guest user/process     could use this flaw to disclose kernel memory     bytes.(CVE-2017-17741)

  - Systems with microprocessors utilizing speculative     execution and speculative execution of memory reads     before the addresses of all prior memory writes are     known may allow unauthorized disclosure of information     to an attacker with local user access via a     side-channel analysis, aka Speculative Store Bypass     (SSB), Variant 4.(CVE-2018-3639)

  - kernel: kvm: guest userspace to guest kernel     write(CVE-2018-10853)

  - In the Linux kernel before 4.20.8,     kvm_ioctl_create_device in virt/kvm/kvm_main.c     mishandles reference counting because of a race     condition, leading to a use-after-free.(CVE-2019-6974)

  - The KVM implementation in the Linux kernel through     4.20.5 has an Information Leak.(CVE-2019-7222)

  - The KVM implementation in the Linux kernel through     4.20.5 has a Use-after-Free.(CVE-2019-7221)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
127283	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0076)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	high
127285	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0077)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/7/2024	high
129145	RHEL 7 : kernel-alt (RHSA-2019:2809)	Nessus	Red Hat Local Security Checks	9/23/2019	11/6/2024	high
124953	EulerOS Virtualization 3.0.1.0 : kvm (EulerOS-SA-2019-1450)	Nessus	Huawei Local Security Checks	5/14/2019	5/20/2022	high

Detections

Analytics

Plugins Search

high

high

high

high