According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's perf     subsystem retrieved userlevel stack traces on PowerPC     systems. A local, unprivileged user could use this flaw     to cause a denial of service on the system by creating     a special stack layout that would force the     perf_callchain_user_64() function into an infinite     loop.(CVE-2015-6526i1/4%0

  - A vulnerability was found in the Linux kernel. Payloads     of NM entries are not supposed to contain NUL. When     such entry is processed, only the part prior to the     first NUL goes into the concatenation (i.e. the     directory entry name being encoded by a bunch of NM     entries). The process stops when the amount collected     so far + the claimed amount in the current NM entry     exceed 254. However, the value returned as the total     length is the sum of *claimed* sizes, not the actual     amount collected. And that's what will be passed to     readdir() callback as the name length - 8Kb
    __copy_to_user() from a buffer allocated by
    __get_free_page().(CVE-2016-4913i1/4%0

  - The perf_trace_event_perm function in     kernel/trace/trace_event_perf.c in the Linux kernel     before 3.12.2 does not properly restrict access to the     perf subsystem, which allows local users to enable     function tracing via a crafted     application.(CVE-2013-2930i1/4%0

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes     on the same system, potentially allowing sniffing of     secret information. (Fixing this affects the output of     the fincore program.) Limited remote exploitation may     be possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP     Server.(CVE-2019-5489i1/4%0

  - It was found that the espfix functionality could be     bypassed by installing a 16-bit RW data segment into     GDT instead of LDT (which espfix checks), and using     that segment on the stack. A local, unprivileged user     could potentially use this flaw to leak kernel stack     addresses.(CVE-2014-8133i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An out-of-bounds access is possible     in write_extent_buffer() when mounting and operating a     crafted btrfs image due to a lack of verification at     mount time within the btrfs_read_block_groups() in     fs/btrfs/extent-tree.c function. This could lead to a     system crash and a denial of service.(CVE-2018-14610i1/4%0

  - kernel/bpf/verifier.c in the Linux kernel through     4.14.8 mishandles states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type,     which allows local users to obtain potentially     sensitive address information, aka a 'pointer     leak.'(CVE-2017-17864i1/4%0

  - drivers/hid/hid-lenovo-tpkbd.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows     physically proximate attackers to cause a denial of     service (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2894i1/4%0

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757i1/4%0

  - It was found that the original fix for CVE-2016-6786     was incomplete. There exist a race between two     concurrent sys_perf_event_open() calls when both try     and move the same pre-existing software group into a     hardware context.(CVE-2017-6001i1/4%0

  - In the Linux kernel before 4.20.12,     net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP     NAT module has insufficient ASN.1 length checks (aka an     array index error), making out-of-bounds read and write     operations possible, leading to an OOPS or local     privilege escalation. This affects snmp_version and     snmp_helper.(CVE-2019-9162i1/4%0

  - An information leak flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled access of the user control's     state. A local, privileged user could use this flaw to     leak kernel memory to user space.(CVE-2014-4652i1/4%0

  - A flaw was found that the vfs_rename() function did not     detect hard links on overlayfs. A local, unprivileged     user could use the rename syscall on overlayfs on top     of xfs to crash the system.(CVE-2016-6198i1/4%0

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.(CVE-2016-7097i1/4%0

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2014-9644i1/4%0

  - An arbitrary memory r/w access issue was found in the     Linux kernel compiled with the eBPF bpf(2) system call     (CONFIG_BPF_SYSCALL) support. The issue could occur due     to calculation errors in the eBPF verifier module,     triggered by user supplied malicious BPF program. An     unprivileged user could use this flaw to escalate their     privileges on a system. Setting parameter     'kernel.unprivileged_bpf_disabled=1' prevents such     privilege escalation by restricting access to bpf(2)     call.(CVE-2017-16995i1/4%0

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel     oops).(CVE-2017-15274i1/4%0

  - A flaw was found in the Linux kernel's keyring handling     code: the key_reject_and_link() function could be     forced to free an arbitrary memory block. An attacker     could use this flaw to trigger a use-after-free     condition on the system, potentially allowing for     privilege escalation.(CVE-2016-4470i1/4%0

  - A flaw was found in the way certain interfaces of the     Linux kernel's Infiniband subsystem used write() as     bi-directional ioctl() replacement, which could lead to     insufficient memory security checks when being invoked     using the splice() system call. A local unprivileged     user on a system with either Infiniband hardware     present or RDMA Userspace Connection Manager Access     module explicitly loaded, could use this flaw to     escalate their privileges on the     system.(CVE-2016-4565i1/4%0

  - It was found that the Linux kernel's IPv6 network stack     did not properly validate the value of the MTU variable     when it was set. A remote attacker could potentially     use this flaw to disrupt a target system's networking     (packet loss) by setting an invalid MTU value, for     example, via a NetworkManager daemon that is processing     router advertisement packets running on the target     system.(CVE-2015-8215i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
72325	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 8823 / 8827)	Nessus	SuSE Local Security Checks	2014/2/5	2021/1/19	high
127146	NewStart CGSL MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0004)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	high
124985	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1532)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high

検出

プラグインの検索

high

high

high