The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-1 advisory.

    It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating     and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-15265)

    Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict     adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys     in a negative state. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-15951)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-     bounds error when handling alternative settings. A physically proximate attacker could use to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate CDC     metadata. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16534)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local users to gain privileges via crafted     system calls that trigger mishandling of packet_fanout data structures, because of a race condition     (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than     CVE-2017-6346. (CVE-2017-15649)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2578:02 advisory.

    An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of instructions (a commonly used performance optimization). There are three primary     variants of the issue which differ in the way the speculative execution can be exploited.
    Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel     packages provide software mitigation for this hardware issue at a cost of potential performance penalty.
    Please refer to References section for further information about this issue and the performance impact.
    In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are     provided.
      * Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It     relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the     fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted     cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)
      * Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It     relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the     fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-     channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)
      * Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative     execution of instruction permission faults, exception generation triggered by a faulting access is     suppressed until the retirement of the whole instruction block. In a combination with the fact that memory     accesses may populate the cache even when the block is being dropped and never committed (executed), an     unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting     targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64     microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
    (CVE-2017-5754, Important)     Asianux would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and     CVE-2017-5754.
    This update also fixes the following security issues and bugs:
    CVE-2015-8539     The KEYS subsystem in the Linux kernel before 4.4 allows local users     to gain privileges or cause a denial of service (BUG) via crafted     keyctl commands that negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and     security/keys/user_defined.c.
    CVE-2017-12192     The keyctl_read_key function in security/keys/keyctl.c in the Key     Management subcomponent in the Linux kernel before 4.13.5 does not     properly consider that a key may be possessed but negatively     instantiated, which allows local users to cause a denial of service     (OOPS and system crash) via a crafted KEYCTL_READ operation.
    CVE-2017-12193     The assoc_array_insert_into_terminal_node function in lib/assoc_array.c     in the Linux kernel before 4.13.11 mishandles node splitting, which     allows local users to cause a denial of service (NULL pointer     dereference and panic) via a crafted application, as demonstrated by     the keyring key type, and key addition and link creation operations.
    CVE-2017-15649     net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local     users to gain privileges via crafted system calls that trigger     mishandling of packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free, a different vulnerability than CVE-2017-6346.
    CVE-2017-5715     Systems with microprocessors utilizing speculative execution and     indirect branch prediction may allow unauthorized disclosure of     information to an attacker with local user access via a side-channel     analysis.
    CVE-2017-5753     Systems with microprocessors utilizing speculative execution and     branch prediction may allow unauthorized disclosure of information to     an attacker with local user access via a side-channel analysis.
    CVE-2017-5754     Systems with microprocessors utilizing speculative execution and     indirect branch prediction may allow unauthorized disclosure of     information to an attacker with local user access via a side-channel     analysis of the data cache.
    CVE-2017-7472     The KEYS subsystem in the Linux kernel before 4.10.13 allows local     users to cause a denial of service (memory consumption) via a series of     KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the Linux kernel's key management     system where it was possible for an attacker to escalate     privileges or crash the machine. If a user key gets     negatively instantiated, an error code is cached in the     payload area. A negatively instantiated key may be then     be positively instantiated by updating it with valid     data. However, the ->update key type method must be     aware that the error code may be there. (CVE-2015-8539)

  - A flaw was found in the way the Linux KVM module     processed the trap flag(TF) bit in EFLAGS during     emulation of the syscall instruction, which leads to a     debug exception(#DB) being raised in the guest stack. A     user/process inside a guest could use this flaw to     potentially escalate their privileges inside the guest.
    Linux guests are not affected by this. (CVE-2017-7518)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on a negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel. (CVE-2017-12192)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the system.
    (CVE-2017-12188)

  - A flaw was found in the Linux kernel's implementation of     associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null pointer     dereference in assoc_array_apply_edit() due to incorrect     node-splitting in assoc_array implementation. This     affects the keyring key type and thus key addition and     link creation operations may cause the kernel to panic.
    (CVE-2017-12193)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that     leads to a use-after-free bug. (CVE-2017-15649)

  - A vulnerability was found in the Linux kernel where the     keyctl_set_reqkey_keyring() function leaks the thread     keyring. This allows an unprivileged local user to     exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5,     when nested virtualisation is used, does not properly     traverse guest pagetable entries to resolve a guest     virtual address, which allows L1 guest OS users to     execute arbitrary code on the host OS or cause a denial     of service (incorrect index during page walking, and     host OS crash), aka an MMU potential stack buffer     overrun.(CVE-2017-12188)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - security/keys/keyctl.c in the Linux kernel before     4.11.5 does not consider the case of a NULL payload in     conjunction with a nonzero length value, which allows     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192.(CVE-2017-15274)

  - Linux kernel: heap out-of-bounds in AF_PACKET sockets.
    This new issue is analogous to previously disclosed     CVE-2016-8655. In both cases, a socket option that     changes socket state may race with safety checks in     packet_set_ring. Previously with PACKET_VERSION. This     time with PACKET_RESERVE. The solution is similar: lock     the socket for the update. This issue may be     exploitable, we did not investigate further. As this     issue affects PF_PACKET sockets, it requires     CAP_NET_RAW in the process namespace. But note that     with user namespaces enabled, any process can create a     namespace in which it has     CAP_NET_RAW.(CVE-2017-1000111)

  - Use-after-free vulnerability in the Linux kernel before     4.14-rc5 allows local users to have unspecified impact     via vectors related to /dev/snd/seq.(CVE-2017-15265)

  - net/packet/af_packet.c in the Linux kernel before     4.13.6 allows local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free, a different     vulnerability than CVE-2017-6346.(CVE-2017-15649)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel     heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0.(CVE-2017-14991)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0174 for details.

ID	Name	Product	Family	Published	Updated	Severity
104716	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3485-1)	Nessus	Ubuntu Local Security Checks	11/21/2017	8/27/2024	high
220504	Linux Distros Unpatched Vulnerability : CVE-2017-15649	Nessus	Misc.	3/4/2025	7/17/2026	high
289677	MiracleLinux 7 : kernel-3.10.0-693.17.1.el7 (AXSA:2018-2578:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	2/9/2026	high
127165	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0014)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	5/8/2024	high
104296	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1271)	Nessus	Huawei Local Security Checks	11/1/2017	11/17/2025	high
105248	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0174) (BlueBorne) (Dirty COW) (Stack Clash)	Nessus	OracleVM Local Security Checks	12/14/2017	11/11/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high