According to the versions of the cpupools / cpupools-features / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimisation) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the     fact that memory writes occur to an address which     depends on the untrusted value. Such writes cause an     update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to influence speculative execution     and/or read privileged memory by conducting targeted     cache side-channel attacks.

  - A flaw named SegmentSmack was found in the way the     Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending     specially modified packets within ongoing TCP sessions     which could lead to a CPU saturation and hence a denial     of service on the system. Maintaining the denial of     service condition requires continuous two-way TCP     sessions to a reachable open port, thus the attacks     cannot be performed using spoofed IP addresses.

  - A flaw was found in Linux kernel's KVM virtualization     subsystem. The VMX code does not restore the GDT.LIMIT     to the previous host value, but instead sets it to     64KB. With a corrupted GDT limit a host's userspace     code has an ability to place malicious entries in the     GDT, particularly to the per-cpu variables. An attacker     can use this to escalate their privileges.

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.

  - ALSA sequencer core initializes the event pool on     demand by invoking snd_seq_pool_init() when the first     write happens and the pool is empty. A user can reset     the pool size manually via ioctl concurrently, and this     may lead to UAF or out-of-bound access.

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2403 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    Security Fix(es):

    * Modern operating systems implement virtualization of physical memory to efficiently use available system     resources and provide inter-domain protection through access control and isolation. The L1TF issue was     found in the way the x86 microprocessor designs have implemented speculative execution of instructions (a     commonly used performance optimisation) in combination with handling of page-faults caused by terminated     virtual to physical address resolving process. As a result, an unprivileged attacker could use this flaw     to read privileged memory of the kernel or other processes and/or cross guest/host boundaries to read host     memory by conducting targeted cache side-channel attacks. (CVE-2018-3620, CVE-2018-3646)

    * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and calculation expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within     ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system.
    Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open     port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)

    Red Hat would like to thank Intel OSSIRT (Intel.com) for reporting CVE-2018-3620 and CVE-2018-3646 and     Juha-Matti Tilli (Aalto University, Department of Communications and Networking and Nokia Bell Labs) for     reporting CVE-2018-5390.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ucode-intel was updated to the 20180807 release.

For the listed CPU chipsets this fixes CVE-2018-3640 (Spectre v3a) and is part of the mitigations for CVE-2018-3639 (Spectre v4) and CVE-2018-3646 (L1 Terminal fault). (bsc#1104134 bsc#1087082 bsc#1087083 bsc#1089343)

Processor Identifier Version Products

Model Stepping F-MO-S/PI Old->New

---- new platforms ---------------------------------------- WSM-EP/WS U1 6-2c-2/03 0000001f Xeon E/L/X56xx, W36xx NHM-EX D0 6-2e-6/04 0000000d Xeon E/L/X65xx/75xx BXT C0 6-5c-2/01 00000014 Atom T5500/5700 APL E0 6-5c-a/03 0000000c Atom x5-E39xx DVN B0 6-5f-1/01 00000024 Atom C3xxx

---- updated platforms ------------------------------------ NHM-EP/WS D0 6-1a-5/03 00000019->0000001d Xeon E/L/X/W55xx NHM B1 6-1e-5/13 00000007->0000000a Core i7-8xx, i5-7xx;
Xeon L3426, X24xx WSM B1 6-25-2/12 0000000e->00000011 Core i7-6xx, i5-6xx/4xxM, i3-5xx/3xxM, Pentium G69xx, Celeon P45xx; Xeon L3406 WSM K0 6-25-5/92 00000004->00000007 Core i7-6xx, i5-6xx/5xx/4xx, i3-5xx/3xx, Pentium G69xx/P6xxx/U5xxx, Celeron P4xxx/U3xxx SNB D2 6-2a-7/12 0000002d->0000002e Core Gen2; Xeon E3 WSM-EX A2 6-2f-2/05 00000037->0000003b Xeon E7 IVB E2 6-3a-9/12 0000001f->00000020 Core Gen3 Mobile HSW-H/S/E3 Cx/Dx 6-3c-3/32 00000024->00000025 Core Gen4 Desktop; Xeon E3 v3 BDW-U/Y E/F 6-3d-4/c0 0000002a->0000002b Core Gen5 Mobile HSW-ULT Cx/Dx 6-45-1/72 00000023->00000024 Core Gen4 Mobile and derived Pentium/Celeron HSW-H Cx 6-46-1/32 00000019->0000001a Core Extreme i7-5xxxX BDW-H/E3 E/G 6-47-1/22 0000001d->0000001e Core i5-5xxxR/C, i7-5xxxHQ/EQ;
Xeon E3 v4 SKL-U/Y D0 6-4e-3/c0 000000c2->000000c6 Core Gen6 Mobile BDX-DE V1 6-56-2/10 00000015->00000017 Xeon D-1520/40 BDX-DE V2/3 6-56-3/10 07000012->07000013 Xeon D-1518/19/21/27/28/31/33/37/41/48, Pentium D1507/08/09/17/19 BDX-DE Y0 6-56-4/10 0f000011->0f000012 Xeon D-1557/59/67/71/77/81/87 APL D0 6-5c-9/03 0000002c->00000032 Pentium N/J4xxx, Celeron N/J3xxx, Atom x5/7-E39xx SKL-H/S/E3 R0 6-5e-3/36 000000c2->000000c6 Core Gen6; Xeon E3 v5

This update was imported from the SUSE:SLE-15:Update update project.

On certain Intel 64-bit x86 systems there is a period of time during terminal fault handling where the CPU may use speculative execution to try to load data. The CPU may speculatively access the level 1 data cache (L1D). Data which would otherwise be protected may then be determined by using side channel methods.

This issue affects bhyve on FreeBSD/amd64 systems. Impact : An attacker executing user code, or kernel code inside of a virtual machine, may be able to read secret data from the kernel or from another virtual machine.

This update for xen fixes the following issues: This security issue was fixed :

  - CVE-2018-3646: Systems with microprocessors utilizing     speculative execution and address translations may have     allowed unauthorized disclosure of information residing     in the L1 data cache to an attacker with local user     access with guest OS privilege via a terminal page fault     and a side-channel analysis (bsc#1091107, bsc#1027519).
    These non-security issue were fixed :

  - bsc#1102116: SSBD is not virtualized for guests

  - bsc#1101684: Not able to disable the visibility of the     new CPU flags

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple researchers have discovered a vulnerability in the way the Intel processor designs have implemented speculative execution of instructions in combination with handling of page-faults. This flaw could allow an attacker controlling an unprivileged process to read memory from arbitrary (non-user controlled) addresses, including from the kernel and all other processes running on the system or cross guest/host boundaries to read host memory.

To fully resolve these vulnerabilities it is also necessary to install updated CPU microcode (only available in Debian non-free). Common server class CPUs are covered in the update released as DLA 1446-1.

For Debian 8 'Jessie', these problems have been fixed in version 4.9.110-3+deb9u4~deb8u1.

We recommend that you upgrade your linux-4.9 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimisation) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3620, CVE-2018-3646)

  - A flaw named SegmentSmack was found in the way the     Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and     calculation expensive calls to tcp_collapse_ofo_queue()     and tcp_prune_ofo_queue() functions by sending     specially modified packets within ongoing TCP sessions     which could lead to a CPU saturation and hence a denial     of service on the system. Maintaining the denial of     service condition requires continuous two-way TCP     sessions to a reachable open port, thus the attacks     cannot be performed using spoofed IP addresses.
    (CVE-2018-5390)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence     a denial of service on the system.(CVE-2018-5391)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Windows host is missing security update 4343909.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-8341, CVE-2018-8348)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited the vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2018-8344)

  - A remote code execution vulnerability exists when     Microsoft Edge improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that enables an attacker to execute arbitrary code in     the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-8377,     CVE-2018-8387)

  - An elevation of privilege vulnerability exists in the     Network Driver Interface Specification (NDIS) when     ndis.sys fails to check the length of a buffer prior to     copying memory to it.  (CVE-2018-8343)

  - A remote code execution vulnerability exists in     &quot;Microsoft COM for Windows&quot; when it fails to     properly handle serialized objects. An attacker who     successfully exploited the vulnerability could use a     specially crafted file or script to perform actions. In     an email attack scenario, an attacker could exploit the     vulnerability by sending the specially crafted file to     the user and convincing the user to open the file.
    (CVE-2018-8349)

  - An elevation of privilege vulnerability exists when the     DirectX Graphics Kernel (DXGKRNL) driver improperly     handles objects in memory. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context.  (CVE-2018-8400, CVE-2018-8401,     CVE-2018-8405, CVE-2018-8406)

  - A remote code execution vulnerability exists in the way     that the ChakraCore scripting engine handles objects in     memory. The vulnerability could corrupt memory in such a     way that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-8390)

  - A remote code execution vulnerability exists when the     Windows Shell does not properly validate file paths. An     attacker who successfully exploited this vulnerability     could run arbitrary code in the context of the current     user. If the current user is logged on as an     administrator, an attacker could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with elevated privileges. Users whose accounts     are configured to have fewer privileges on the system     could be less impacted than users who operate with     administrative privileges.  (CVE-2018-8414)

  - A spoofing vulnerability exists when Microsoft Edge does     not properly parse HTTP content. An attacker who     successfully exploited this vulnerability could trick a     user by redirecting the user to a specially crafted     website. The specially crafted website could either     spoof content or serve as a pivot to chain an attack     with other vulnerabilities in web services.
    (CVE-2018-8383)

  - A security feature bypass vulnerability exists in Device     Guard that could allow an attacker to inject malicious     code into a Windows PowerShell session. An attacker who     successfully exploited this vulnerability could inject     code into a trusted PowerShell process to bypass the     Device Guard Code Integrity policy on the local machine.
    (CVE-2018-8200, CVE-2018-8204)

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385)

  - An elevation of privilege vulnerability exists in     Microsoft Windows when the Windows kernel fails to     properly handle parsing of certain symbolic links. An     attacker who successfully exploited this vulnerability     could potentially access privileged registry keys and     thereby elevate permissions. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-8347)

  - A remote code execution vulnerability exists when     Microsoft Windows PDF Library improperly handles objects     in memory. The vulnerability could corrupt memory in a     way that enables an attacker to execute arbitrary code     in the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user. If the current     user is logged on with administrative user rights, an     attacker could take control of an affected system. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights.  (CVE-2018-8350)

  - A remote code execution vulnerability exists in     Microsoft Windows that could allow remote code execution     if a .LNK file is processed. An attacker who     successfully exploited this vulnerability could gain the     same user rights as the local user.  (CVE-2018-8345)

  - A information disclosure vulnerability exists when     WebAudio Library improperly handles audio requests. An     attacker who has successfully exploited this     vulnerability might be able to read privileged data     across trust boundaries. In browsing scenarios, an     attacker could convince a user to visit a malicious site     and leverage the vulnerability to obtain privileged     information from the browser process, such as sensitive     data from other opened tabs. An attacker could also     inject malicious code into advertising networks used by     trusted sites or embed malicious code on a compromised,     but trusted, site. The update addresses the     vulnerability by correcting how the WebAudio Library     handles audio requests. (CVE-2018-8370)

  - An elevation of privilege vulnerability exists in the     Windows Installer when the Windows Installer fails to     properly sanitize input leading to an insecure library     loading behavior. A locally authenticated attacker could     run arbitrary code with elevated system privileges. An     attacker could then install programs; view, change, or     delete data; or create new accounts with full user     rights. The security update addresses the vulnerability     by correcting the input sanitization error to preclude     unintended elevation. (CVE-2018-8339)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2018-8266, CVE-2018-8380,     CVE-2018-8381)

  - A remote code execution vulnerability exists when     Internet Explorer improperly validates hyperlinks before     loading executable libraries. An attacker who     successfully exploited this vulnerability could take     control of an affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights.
    (CVE-2018-8316)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2018-8399, CVE-2018-8404)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2018-8394, CVE-2018-8398)

  - A remote code execution vulnerability exists in the way     that Microsoft browsers access objects in memory. The     vulnerability could corrupt memory in a way that could     allow an attacker to execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-8403)

  - An information disclosure vulnerability exists when     affected Microsoft browsers improperly allow cross-frame     interaction. An attacker who successfully exploited this     vulnerability could allow an attacker to obtain browser     frame or window state from a different domain. For an     attack to be successful, an attacker must persuade a     user to open a malicious website from a secure website.
    This update addresses the vulnerability by denying     permission to read the state of the object model, to     which frames or windows on different domains should not     have access. (CVE-2018-8351)

  - An elevation of privilege vulnerability exists in     Microsoft browsers allowing sandbox escape. An attacker     who successfully exploited the vulnerability could use     the sandbox escape to elevate privileges on an affected     system. This vulnerability by itself does not allow     arbitrary code execution; however, it could allow     arbitrary code to be run if the attacker uses it in     combination with another vulnerability (such as a remote     code execution vulnerability or another elevation of     privilege vulnerability) that is capable of leveraging     the elevated privileges when code execution is     attempted. (CVE-2018-8357)

  - An Elevation of Privilege vulnerability exists when     Diagnostics Hub Standard Collector allows file creation     in arbitrary locations.  (CVE-2018-0952)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373,     CVE-2018-8389)

  - An information disclosure vulnerability exists in     Microsoft .NET Framework that could allow an attacker to     access information in multi-tenant environments. The     vulnerability is caused when .NET Framework is used in     high-load/high-density network connections where content     from one stream can blend into another stream.
    (CVE-2018-8360)

  - A spoofing vulnerability exists when Microsoft Edge     improperly handles specific HTML content. An attacker     who successfully exploited this vulnerability could     trick a user into believing that the user was on a     legitimate website. The specially crafted website could     either spoof content or serve as a pivot to chain an     attack with other vulnerabilities in web services.
    (CVE-2018-8388)

ID	Name	Product	Family	Published	Updated	Severity
112018	Virtuozzo 6 : cpupools / cpupools-features / etc (VZA-2018-055)	Nessus	Virtuozzo Local Security Checks	8/20/2018	8/15/2024	high
112027	RHEL 7 : redhat-virtualization-host (RHSA-2018:2403)	Nessus	Red Hat Local Security Checks	8/21/2018	3/26/2025	medium
112031	openSUSE Security Update : ucode-intel (openSUSE-2018-887) (Foreshadow) (Spectre)	Nessus	SuSE Local Security Checks	8/21/2018	1/9/2026	medium
112069	FreeBSD : FreeBSD -- L1 Terminal Fault (L1TF) Kernel Information Disclosure (2310b814-a652-11e8-805b-a4badb2f4699) (Foreshadow)	Nessus	FreeBSD Local Security Checks	8/23/2018	3/26/2025	medium
112106	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2483-1) (Foreshadow)	Nessus	SuSE Local Security Checks	8/24/2018	3/26/2025	medium
112168	Debian DLA-1481-1 : linux-4.9 security update (Foreshadow)	Nessus	Debian Local Security Checks	8/29/2018	3/25/2025	medium
112237	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2018-1278)	Nessus	Huawei Local Security Checks	9/4/2018	3/25/2025	medium
112238	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1279)	Nessus	Huawei Local Security Checks	9/4/2018	3/25/2025	medium
111692	KB4343909: Windows 10 Version 1803 and Windows Server Version 1803 August 2018 Security Update (Foreshadow)	Nessus	Windows : Microsoft Bulletins	8/14/2018	3/29/2022	high

Detections

Analytics

Plugins Search

high

medium

medium

medium

medium

medium

medium

medium

high