Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
(CVE-2019-11091)

Modern Intel microprocessors implement hardware-level micro-optimizations to improve the performance of writing data back to CPU caches. The write operation is split into STA (STore Address) and STD (STore Data) sub-operations. These sub-operations allow the processor to hand-off address generation logic into these sub-operations for optimized writes. Both of these sub-operations write to a shared distributed processor structure called the 'processor store buffer'. As a result, an unprivileged attacker could use this flaw to read private data resident within the CPU's processor store buffer. (CVE-2018-12126)

The virConnectGetDomainCapabilities() libvirt API accepts an 'emulatorbin' argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10167)

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would execute an arbitrary program when the domain was resumed. (CVE-2019-10166)

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration parameter allows any user on the host to connect using virtlockd-admin-sock or virtlogd-admin-sock and perform administrative tasks against the virtlockd and virtlogd daemons.(CVE-2019-10132)

The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs accept an 'emulator' argument to specify the program providing emulation for a domain.
Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument, causing libvirtd to execute a crafted executable with its own privileges. (CVE-2019-10168)

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process.
An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs. (CVE-2019-10161)

Microprocessors use a load port subcomponent to perform load operations from memory or IO. During a load operation, the load port receives data from the memory or IO subsystem and then provides the data to the CPU registers and operations in the CPUs pipelines. Stale load operations results are stored in the 'load port' table until overwritten by newer operations. Certain load-port operations triggered by an attacker can be used to reveal data about previous stale requests leaking data back to the attacker via a timing side-channel. (CVE-2018-12127)

A flaw was found in the implementation of the 'fill buffer', a mechanism used by modern CPUs when a cache-miss is made on L1 CPU cache. If an attacker can generate a load operation that would create a page fault, the execution will continue speculatively with incorrect data from the fill buffer while the data is fetched from higher level caches. This response time can be measured to infer data in the fill buffer. (CVE-2018-12130)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - Microarchitectural Store Buffer Data Sampling (MSBDS):
    Store buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here: https://www.intel.com/content/dam/www     /public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2018-12126)

  - Microarchitectural Load Port Data Sampling (MLPDS): Load     ports on some microprocessors utilizing speculative     execution may allow an authenticated user to potentially     enable information disclosure via a side channel with     local access. A list of impacted products can be found     here: https://www.intel.com/content/dam/www/public/us/en     /documents/corporate-information/SA00233-microcode-     update-guidance_05132019.pdf (CVE-2018-12127)

  - Microarchitectural Fill Buffer Data Sampling (MFBDS):
    Fill buffers on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. A list of impacted products     can be found here: https://www.intel.com/content/dam/www     /public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2018-12130)

  - An issue was discovered in the Linux kernel before     4.18.7. In block/blk-core.c, there is an
    __blk_drain_queue() use-after-free because a certain     error case is mishandled. (CVE-2018-20856)

  - A flaw was found in the Linux kernel. A heap based     buffer overflow in mwifiex_uap_parse_tail_ies function     in drivers/net/wireless/marvell/mwifiex/ie.c might lead     to memory corruption and possibly other consequences.
    (CVE-2019-10126)

  - A vulnerability was found in Linux kernel's, versions up     to 3.10, implementation of overlayfs. An attacker with     local access can create a denial of service situation     via NULL pointer dereference in ovl_posix_acl_create     function in fs/overlayfs/dir.c. This can allow attackers     with ability to create directories on overlayfs to crash     the kernel creating a denial of service (DOS).
    (CVE-2019-10140)

  - Microarchitectural Data Sampling Uncacheable Memory     (MDSUM): Uncacheable memory on some microprocessors     utilizing speculative execution may allow an     authenticated user to potentially enable information     disclosure via a side channel with local access. A list     of impacted products can be found here: https://www.inte     l.com/content/dam/www/public/us/en/documents/corporate-     information/SA00233-microcode-update-     guidance_05132019.pdf (CVE-2019-11091)

  - An out-of-bounds access issue was found in the Linux     kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO     write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write     indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged     host user or process with access to '/dev/kvm' device     could use this flaw to crash the host kernel, resulting     in a denial of service or potentially escalating     privileges on the system. (CVE-2019-14821)

  - A flaw that allowed an attacker to corrupt memory and     possibly escalate privileges was found in the mwifiex     kernel module while connecting to a malicious wireless     network. (CVE-2019-3846)

  - The Bluetooth BR/EDR specification up to and including     version 5.1 permits sufficiently low encryption key     length and does not prevent an attacker from influencing     the key length negotiation. This allows practical brute-     force attacks (aka KNOB) that can decrypt traffic and     inject arbitrary ciphertext without the victim noticing.
    (CVE-2019-9506)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - It was found that AIO interface didn't use the proper     rw_verify_area() helper function with extended     functionality, for example, mandatory locking on the     file. Also rw_verify_area() makes extended checks, for     example, that the size of the access doesn't cause     overflow of the provided offset limits. This integer     overflow in fs/aio.c in the Linux kernel before 3.4.1     allows local users to cause a denial of service or     possibly have unspecified other impact via a large AIO     iovec. (CVE-2012-6701)

  - Integer overflow in the aio_setup_single_vector function     in fs/aio.c in the Linux kernel 4.0 allows local users     to cause a denial of service or possibly have     unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701     regression. (CVE-2015-8830)

  - It was discovered that a remote attacker could leverage     the generation of IPv6 atomic fragments to trigger the     use of fragmentation in an arbitrary IPv6 flow (in     scenarios in which actual fragmentation of packets is     not needed) and could subsequently perform any type of a     fragmentation-based attack against legacy IPv6 nodes     that do not implement RFC6946. (CVE-2016-10142)

  - A race condition flaw was found in the ioctl_send_fib()     function in the Linux kernel's aacraid implementation. A     local attacker could use this flaw to cause a denial of     service (out-of-bounds access or system crash) by     changing a certain size value. (CVE-2016-6480)

  - It was found that when the gcc stack protector was     enabled, reading the /proc/keys file could cause a panic     in the Linux kernel due to stack corruption. This     happened because an incorrect buffer size was used to     hold a 64-bit timeout value rendered as weeks.
    (CVE-2016-7042)

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but doesn't     clear the setgid bit in a similar way. This could allow     a local user to gain group privileges via certain setgid     applications. (CVE-2016-7097)

  - A flaw was found in the Linux networking subsystem where     a local attacker with CAP_NET_ADMIN capabilities could     cause an out-of-bounds memory access by creating a     smaller-than-expected ICMP header and sending to its     destination via sendto(). (CVE-2016-8399)

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted RSA     key. This flaw panics the machine during the     verification of the RSA key. (CVE-2016-8650)

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.
    (CVE-2017-0861)

  - A race condition issue was found in the way the raw     packet socket implementation in the Linux kernel     networking subsystem handled synchronization. A local     user able to open a raw packet socket (requires the     CAP_NET_RAW capability) could use this to waste     resources in the kernel's ring buffer or possibly cause     an out-of-bounds read on the heap leading to a system     crash. (CVE-2017-1000111)

  - A use-after-free flaw was found in the Netlink     functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify     function, a local attacker could potentially use this     flaw to escalate their privileges on the system.
    (CVE-2017-11176)

  - It was found that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'     do unbalanced pages refcounting if IO vector has small     consecutive buffers belonging to the same page.
    bio_add_pc_page() merges them into one, but the page     reference is never dropped, causing a memory leak and     possible system lockup due to out-of-memory condition.
    (CVE-2017-12190)

  - A divide-by-zero vulnerability was found in the
    __tcp_select_window function in the Linux kernel. This     can result in a kernel panic causing a local denial of     service. (CVE-2017-14106)

  - A non-privileged user is able to mount a fuse filesystem     on RHEL 6 or 7 and crash a system if an application     punches a hole in a file that does not end aligned to a     page boundary. (CVE-2017-15121)

  - A use-after-free vulnerability was found when issuing an     ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption or     possibly privilege escalation. (CVE-2017-15265)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with CAP_SYS_ADMIN     capability) can directly perform the ioctl operations     for dm device creation and removal and this would     typically be outside the direct control of the     unprivileged attacker. (CVE-2017-18203)

  - A race condition leading to a NULL pointer dereference     was found in the Linux kernel's Link Layer Control     implementation. A local attacker with access to ping     sockets could use this flaw to crash the system.
    (CVE-2017-2671)

  - It was found that the original fix for CVE-2016-6786 was     incomplete. There exist a race between two concurrent     sys_perf_event_open() calls when both try and move the     same pre-existing software group into a hardware     context. (CVE-2017-6001)

  - A flaw was found in the Linux kernel's handling of     packets with the URG flag. Applications using the     splice() and tcp_splice_read() functionality could allow     a remote attacker to force the kernel to enter a     condition in which it could loop indefinitely.
    (CVE-2017-6214)

  - Kernel memory corruption due to a buffer overflow was     found in brcmf_cfg80211_mgmt_tx() function in Linux     kernels from v3.9-rc1 to v4.13-rc1. The vulnerability     can be triggered by sending a crafted NL80211_CMD_FRAME     packet via netlink. This flaw is unlikely to be     triggered remotely as certain userspace code is needed     for this. An unprivileged local user could use this flaw     to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     it is unlikely. (CVE-2017-7541)

  - An integer overflow vulnerability in     ip6_find_1stfragopt() function was found. A local     attacker that has privileges (of CAP_NET_RAW) to open     raw socket can cause an infinite loop inside the     ip6_find_1stfragopt() function. (CVE-2017-7542)

  - Incorrect error handling in the set_mempolicy() and     mbind() compat syscalls in 'mm/mempolicy.c' in the Linux     kernel allows local users to obtain sensitive     information from uninitialized stack data by triggering     failure of a certain bitmap operation. (CVE-2017-7616)

  - The mm subsystem in the Linux kernel through 4.10.10     does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read     or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access     restrictions) via an application that opens the /dev/mem     file, related to arch/x86/mm/init.c and     drivers/char/mem.c. (CVE-2017-7889)

  - The IPv6 fragmentation implementation in the Linux     kernel does not consider that the nexthdr field may be     associated with an invalid option, which allows local     users to cause a denial of service (out-of-bounds read     and BUG) or possibly have unspecified other impact via     crafted socket and send system calls. Due to the nature     of the flaw, privilege escalation cannot be fully ruled     out, although we believe it is unlikely. (CVE-2017-9074)

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2018-1000004)

  - A null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in the Linux kernel allows a local     user to cause a denial of service by a number of certain     crafted system calls. (CVE-2018-1130)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data) sub-     operations. These sub-operations allow the processor to     hand-off address generation logic into these sub-     operations for optimized writes. Both of these sub-     operations write to a shared distributed processor     structure called the 'processor store buffer'. As a     result, an unprivileged attacker could use this flaw to     read private data resident within the CPU's processor     store buffer. (CVE-2018-12126)

  - Microprocessors use a load port subcomponent to     perform load operations from memory or IO. During a load     operation, the load port receives data from the memory     or IO subsystem and then provides the data to the CPU     registers and operations in the CPUs pipelines. Stale     load operations results are stored in the 'load port'     table until overwritten by newer operations. Certain     load-port operations triggered by an attacker can be     used to reveal data about previous stale requests     leaking data back to the attacker via a timing side-     channel. (CVE-2018-12127)

  - A flaw was found in the implementation of the fill     buffer, a mechanism used by modern CPUs when a cache-     miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time can     be measured to infer data in the fill buffer.
    (CVE-2018-12130)

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - A Floating Point Unit (FPU) state information leakage     flaw was found in the way the Linux kernel saved and     restored the FPU state during task switch. Linux kernels     that follow the Lazy FPU Restore scheme are vulnerable     to the FPU state information leakage issue. An     unprivileged local attacker could use this flaw to read     FPU state bits by conducting targeted cache side-channel     attacks, similar to the Meltdown vulnerability disclosed     earlier this year. (CVE-2018-3665)

  - An error in the _sctp_make_chunk() function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS. (CVE-2018-5803)

  - ALSA sequencer core initializes the event pool on demand     by invoking snd_seq_pool_init() when the first write     happens and the pool is empty. A user can reset the pool     size manually via ioctl concurrently, and this may lead     to UAF or out-of-bound access. (CVE-2018-7566)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user to     potentially enable information disclosure via a side     channel with local access. (CVE-2019-11091)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host has not properly mitigated a series of known speculative execution vulnerabilities. It, therefore, may be affected by :
  - Branch Target Injection (BTI) (CVE-2017-5715)
  - Bounds Check Bypass (BCB) (CVE-2017-5753)
  - Rogue Data Cache Load (RDCL) (CVE-2017-5754)
  - Rogue System Register Read (RSRE) (CVE-2018-3640)
  - Speculative Store Bypass (SSB) (CVE-2018-3639)
  - L1 Terminal Fault (L1TF) (CVE-2018-3615, CVE-2018-3620, CVE-2018-3646)
  - Microarchitectural Data Sampling Uncacheable Memory (MDSUM) (CVE-2019-11091)
  - Microarchitectural Store Buffer Data Sampling (MSBDS) (CVE-2018-12126)
  - Microarchitectural Load Port Data Sampling (MLPDS) (CVE-2018-12127)
  - Microarchitectural Fill Buffer Data Sampling (MFBDS) (CVE-2018-12130)
  - TSX Asynchronous Abort (TAA) (CVE-2019-11135)

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0009 advisory.

    This advisory aggregates security fixes for the kernel SRPM in CIQ LTS 8.6. It addresses 214 CVEs:
    CVE-2019-0154, CVE-2022-3640, CVE-2020-29661, CVE-2019-11091, CVE-2021-3609, and 209 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
128288	Amazon Linux 2 : libvirt (ALAS-2019-1274) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	Amazon Linux Local Security Checks	8/28/2019	5/27/2024	high
131421	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0222)	Nessus	NewStart CGSL Local Security Checks	12/2/2019	4/9/2024	critical
127425	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0152)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	12/6/2022	high
125303	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1407) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	5/21/2019	5/21/2024	high
125243	openSUSE Security Update : the Linux Kernel (openSUSE-2019-1404) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)	Nessus	SuSE Local Security Checks	5/17/2019	5/22/2024	high
132101	Windows Speculative Execution Configuration Check	Nessus	Windows	12/18/2019	8/10/2026	medium
358696	Rocky Linux 8.6 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (ciqsa-2026_0009)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/12/2026	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

medium

high