The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-3620: Local attackers on baremetal systems     could use speculative code patterns on hyperthreaded     processors to read data present in the L1 Datacache used     by other hyperthreads on the same CPU core, potentially     leaking sensitive data. (bnc#1087081).

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system.
    (bnc#1089343).

  - CVE-2018-5390 aka 'SegmentSmack': The Linux Kernel can     be forced to make very expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for     every incoming packet which can lead to a denial of     service (bnc#1102340).

  - CVE-2018-5391 aka 'FragmentSmack': A flaw in the IP     packet reassembly could be used by remote attackers to     consume lots of CPU time (bnc#1103097).

  - CVE-2018-14734: drivers/infiniband/core/ucma.c allowed     ucma_leave_multicast to access a certain data structure     after a cleanup step in ucma_process_join, which allowed     attackers to cause a denial of service (use-after-free)     (bnc#1103119).

  - CVE-2017-18344: The timer_create syscall implementation     in kernel/time/posix-timers.c didn't properly validate     the sigevent->sigev_notify field, which leads to     out-of-bounds access in the show_timer function (called     when /proc/$PID/timers is read). This allowed userspace     applications to read arbitrary kernel memory (on a     kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).

  - CVE-2018-9385: When printing the 'driver_override'     option from with-in the amba driver, a very long line     could expose one additional uninitialized byte     (bnc#1100491).

  - CVE-2018-13053: The alarm_timer_nsleep function in     kernel/time/alarmtimer.c had an integer overflow via a     large relative timeout because ktime_add_safe is not     used (bnc#1099924).

  - CVE-2018-13405: The inode_init_owner function in     fs/inode.c allowed local users to create files with an     unintended group ownership, in a scenario where a     directory is SGID to a certain group and is writable by     a user who is not a member of that group. Here, the     non-member can trigger creation of a plain file whose     group ownership is that group. The intended behavior was     that the non-member can trigger creation of a directory     (but not a plain file) whose group ownership is that     group. The non-member can escalate privileges by making     the plain file executable and SGID (bnc#1100416).

  - CVE-2018-13406: An integer overflow in the     uvesafb_setcmap function in     drivers/video/fbdev/uvesafb.c could result in local     attackers being able to crash the kernel or potentially     elevate privileges because kmalloc_array is not used     (bnc#1098016 1100418).

  - CVE-2018-5814: Multiple race condition errors when     handling probe, disconnect, and rebind operations could     be exploited to trigger a use-after-free condition or a     NULL pointer dereference by sending multiple USB over IP     packets (bnc#1096480).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.8 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K07020416 advisory.

    The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8     doesn't properly validate the sigevent->sigev_notify field, which leads to out-of-bounds access in the     show_timer function (called when /proc/$PID/timers is read). This allows userspace applications to read     arbitrary kernel memory (on a kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE).(CVE-2017-18344)ImpactA local attacker may use this vulnerability to expose     sensitive information or cause a denial of service (DoS), makingthe system unresponsive.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4196 advisory.

    - posix-timer: Properly check sigevent->sigev_notify (Thomas Gleixner)  [Orabug: 28481412]     {CVE-2017-18344}
    - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (Matt Fleming)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Fix SMT supported evaluation (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - KVM: VMX: Tell the nested hypervisor to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86/speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3620}
    - KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (KarimAllah Ahmed)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Paolo Bonzini)  [Orabug: 28220674]     {CVE-2018-3620}
    - Documentation/l1tf: Remove Yonah processors from not vulnerable list (Thomas Gleixner)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/KVM/VMX: Dont set l1tf_flush_l1d from vmx_handle_external_intr() (Nicolai Stange)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/irq: Let interrupt handlers set kvm_cpu_l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86: Dont include linux/irq.h from asm/hardirq.h (Nicolai Stange)  [Orabug: 28220625]  {CVE-2018-3620}
    - x86/KVM/VMX: Introduce per-host-cpu analogue of l1tf_flush_l1d (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - x86/KVM/VMX: Move the l1tf_flush_l1d test to vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - x86/KVM/VMX: Replace 'vmx_l1d_flush_always' with 'vmx_l1d_flush_cond' (Nicolai Stange)  [Orabug:
    28220625]  {CVE-2018-3646}
    - x86/KVM/VMX: Dont set l1tf_flush_l1d to true from vmx_l1d_flush() (Nicolai Stange)  [Orabug: 28220625]     {CVE-2018-3646}
    - KVM: VMX: support MSR_IA32_ARCH_CAPABILITIES as a feature MSR (Paolo Bonzini)  [Orabug: 28220625]     {CVE-2018-3646}
    - KVM: X86: Introduce kvm_get_msr_feature() (Wanpeng Li)  [Orabug: 28220674]  {CVE-2018-3646}
    - KVM: x86: Add a framework for supporting MSR-based features (Tom Lendacky)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: detect SMT disabled by BIOS (Josh Poimboeuf)  [Orabug: 28220674]  {CVE-2018-3620}
    - Documentation/l1tf: Fix typos (Tony Luck)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/KVM/VMX: Initialize the vmx_l1d_flush_pages content (Nicolai Stange)  [Orabug: 28220674]     {CVE-2018-3646}
    - x86/speculation/l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Jiri Kosina)  [Orabug:
    28220674]  {CVE-2018-3620}
    - Documentation: Add section about CPU vulnerabilities (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/bugs, kvm: Introduce boot-time control of L1TF mitigations (Jiri Kosina)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Expose SMT control init function (Jiri Kosina)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/kvm: Allow runtime control of L1D flush (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Serialize L1D flush parameter setter (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Add static key for flush always (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/kvm: Move l1tf setup function (Thomas Gleixner)  [Orabug: 28220625]  {CVE-2018-3646}
    - x86/l1tf: Handle EPT disabled state proper (Thomas Gleixner)  [Orabug: 28220625]  {CVE-2018-3620}
    - x86/kvm: Drop L1TF MSR list approach (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/litf: Introduce vmx status variable (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Online siblings when SMT control is turned on (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add find_msr() helper function (Konrad Rzeszutek Wilk)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Konrad Rzeszutek Wilk)     [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D flush logic (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D MSR based flush (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add L1D flush algorithm (Paolo Bonzini)  [Orabug: 28220674]  {CVE-2018-3646}
    - x86/KVM/VMX: Add module argument for L1TF mitigation (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3646} {CVE-2018-3646}
    - locking/static_keys: Add static_key_{en,dis}able() helpers (Peter Zijlstra)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Konrad Rzeszutek Wilk)  [Orabug:
    28220674]  {CVE-2018-3646}
    - KVM: x86: Introducing kvm_x86_ops VM init/destroy hooks (Suravee Suthikulpanit)  [Orabug: 28220674]     {CVE-2018-3646}
    - cpu/hotplug: Boot HT siblings at least once (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - Revert 'x86/apic: Ignore secondary threads if nosmt=force' (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Borislav Petkov)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/cpufeatures: Add detection of L1D cache flush support. (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/apic: Ignore secondary threads if nosmt=force (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/AMD: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Borislav Petkov)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/cpu/intel: Evaluate smp_num_siblings early (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/topology: Provide detect_extended_topology_early() (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/cpu/common: Provide detect_ht_early() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/cpu/AMD: Remove the pointless detect_ht() call (Thomas Gleixner)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/cpu: Remove the pointless CPU printout (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Provide knobs to control SMT (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/topology: Add topology_max_smt_threads() (Andi Kleen)  [Orabug: 28220674]  {CVE-2018-3620}
    - cpu/hotplug: Split do_cpu_down() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/topology: Provide topology_smt_supported() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/smp: Provide topology_is_primary_thread() (Thomas Gleixner)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Klein)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Klein)  [Orabug:
    28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Klein)  [Orabug: 28220674]  {CVE-2018-3620}
    - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Klein)  [Orabug: 28220674]     {CVE-2018-3620}
    - x86/mm: Limit mmap() of /dev/mem to valid physical addresses (Craig Bergstrom)  [Orabug: 28220674]     {CVE-2018-3620}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Integer overflow in Linux's create_elf_tables function     (CVE-2018-14634)

  - out-of-bounds access in the show_timer function in     kernel/time/posix-timers.c (CVE-2017-18344)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3590 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact     (CVE-2018-10675)

    * kernel: Integer overflow in Linux's create_elf_tables function (CVE-2018-14634)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391 and Qualys Research Labs for reporting     CVE-2018-14634.

    Bug Fix(es):

    * Previously, a kernel panic occurred when the kernel tried to make an out of bound access to the array     that describes the L1 Terminal Fault (L1TF) mitigation state on systems without Extended Page Tables (EPT)     support. This update extends the array of mitigation states to cover all the states, which effectively     prevents out of bound array access. Also, this update enables rejecting invalid, irrelevant values, that     might be erroneously provided by the userspace. As a result, the kernel no longer panics in the described     scenario. (BZ#1629565)

    * Previously, a packet was missing the User Datagram Protocol (UDP) payload checksum during a full     checksum computation, if the hardware checksum was not applied. As a consequence, a packet with an     incorrect checksum was dropped by a peer. With this update, the kernel includes the UDP payload checksum     during the full checksum computation. As a result, the checksum is computed correctly and the packet can     be received by the peer. (BZ#1635792)

    * Previously, a transform lookup through the xfrm framework could be performed on an already transformed     destination cache entry (dst_entry). When using User Datagram Protocol (UDP) over IPv6 with a connected     socket in conjunction with Internet Protocol Security (IPsec) in Encapsulating Security Payload (ESP)     transport mode. As a consequence, invalid IPv6 fragments transmitted from the host or the kernel     occasionally terminated unexpectedly due to a socket buffer (SKB) underrun. With this update, the xfrm     lookup on an already transformed dst_entry is not possible. As a result, using UDP iperf utility over IPv6     ESP no longer causes invalid IPv6 fragment transmissions or a kernel panic. (BZ#1639586)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3083 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    * kernel: out-of-bounds access in the show_timer function in kernel/time/posix-timers.c (CVE-2017-18344)

    * kernel: Integer overflow in udl_fb_mmap() can allow attackers to execute code in kernel space     (CVE-2018-8781)

    * kernel: MIDI driver race condition leads to a double-free (CVE-2018-10902)

    * kernel: Missing check in inode_init_owner() does not clear SGID bit on non-directories for non-members     (CVE-2018-13405)

    * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830)

    * kernel: Use-after-free in snd_pcm_info function in ALSA subsystem potentially leads to privilege     escalation (CVE-2017-0861)

    * kernel: Handling of might_cancel queueing is not properly pretected against race (CVE-2017-10661)

    * kernel: Salsa20 encryption algorithm does not correctly handle zero-length inputs allowing local     attackers to cause denial of service (CVE-2017-17805)

    * kernel: Inifinite loop vulnerability in madvise_willneed() function allows local denial of service     (CVE-2017-18208)

    * kernel: fuse-backed file mmap-ed onto process cmdline arguments causes denial of service (CVE-2018-1120)

    * kernel: a null pointer dereference in dccp_write_xmit() leads to a system crash (CVE-2018-1130)

    * kernel: drivers/block/loop.c mishandles lo_release serialization allowing denial of service     (CVE-2018-5344)

    * kernel: Missing length check of payload in _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

    * kernel: buffer overflow in drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may lead to memory     corruption (CVE-2018-5848)

    * kernel: out-of-bound write in ext4_init_block_bitmap function with a crafted ext4 image (CVE-2018-10878)

    * kernel: Improper validation in bnx2x network card driver can allow for denial of service attacks via     crafted packet (CVE-2018-1000026)

    * kernel: Information leak when handling NM entries containing NUL (CVE-2016-4913)

    * kernel: Mishandling mutex within libsas allowing local Denial of Service (CVE-2017-18232)

    * kernel: NULL pointer dereference in ext4_process_freed_data() when mounting crafted ext4 image     (CVE-2018-1092)

    * kernel: NULL pointer dereference in ext4_xattr_inode_hash() causes crash with crafted ext4 image     (CVE-2018-1094)

    * kernel: vhost: Information disclosure in vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

    * kernel: Denial of service in resv_map_release function in mm/hugetlb.c (CVE-2018-7740)

    * kernel: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

    * kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image     allowing denial of service (CVE-2018-10322)

    * kernel: use-after-free detected in ext4_xattr_set_entry with a crafted file (CVE-2018-10879)

    * kernel: out-of-bound access in ext4_get_group_info() when mounting and operating a crafted ext4 image     (CVE-2018-10881)

    * kernel: stack-out-of-bounds write in jbd2_journal_dirty_metadata function (CVE-2018-10883)

    * kernel: incorrect memory bounds check in drivers/cdrom/cdrom.c (CVE-2018-10940)

    Red Hat would like to thank Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5391; Trend Micro Zero Day Initiative for reporting     CVE-2018-10902; Qualys Research Labs for reporting CVE-2018-1120; Evgenii Shatokhin (Virtuozzo Team) for     reporting CVE-2018-1130; and Wen Xu for reporting CVE-2018-1092 and CVE-2018-1094.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.143 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-5390 aka 'SegmentSmack': Linux kernel could be     forced to make very expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for     every incoming packet which can lead to a denial of     service (bnc#1102340).

  - CVE-2018-14734: drivers/infiniband/core/ucma.c in the     Linux kernel allowed ucma_leave_multicast to access a     certain data structure after a cleanup step in     ucma_process_join, which allowed attackers to cause a     denial of service (use-after-free) (bnc#1103119).

  - CVE-2017-18344: The timer_create syscall implementation     in kernel/time/posix-timers.c didn't properly validate     the sigevent->sigev_notify field, which lead to     out-of-bounds access in the show_timer function (called     when /proc/$PID/timers is read). This allowed userspace     applications to read arbitrary kernel memory (on a     kernel built with CONFIG_POSIX_TIMERS and     CONFIG_CHECKPOINT_RESTORE) (bnc#1102851 bnc#1103580).

  - CVE-2018-3620: Local attackers on baremetal systems     could use speculative code patterns on hyperthreaded     processors to read data present in the L1 Datacache used     by other hyperthreads on the same CPU core, potentially     leaking sensitive data. (bnc#1087081).

  - CVE-2018-3646: Local attackers in virtualized guest     systems could use speculative code patterns on     hyperthreaded processors to read data present in the L1     Datacache used by other hyperthreads on the same CPU     core, potentially leaking sensitive data, even from     other virtual machines or the host system.
    (bnc#1089343).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities:

  - A buffer overflow vulnerability due to a lack of input     filtering of incoming fragmented datagrams was found in     the IP-over-1394 driver [firewire-net] in a fragment     handling code in the Linux kernel. The vulnerability     exists since firewire supported IPv4, i.e. since version     2.6.31 (year 2009) till version v4.9-rc4. A maliciously     formed fragment with a respectively large datagram     offset would cause a memcpy() past the datagram buffer,     which would cause a system panic or possible arbitrary     code execution. The flaw requires [firewire-net] module     to be loaded and is remotely exploitable from connected     firewire devices, but not over a local network.
    (CVE-2016-8633)

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation. (CVE-2017-13166)

  - The timer_create syscall implementation in     kernel/time/posix-timers.c in the Linux kernel doesn't     properly validate the sigevent->sigev_notify field,     which leads to out-of-bounds access in the show_timer     function. (CVE-2017-18344)

  - A use-after-free vulnerability was found in DCCP socket     code affecting the Linux kernel since 2.6.16. This     vulnerability could allow an attacker to their escalate     privileges. (CVE-2017-8824)

  - A flaw was found in the way the Linux kernel's KVM     hypervisor handled exceptions delivered after a stack     switch operation via Mov SS or Pop SS instructions.
    During the stack switch operation, the processor did not     deliver interrupts and exceptions, rather they are     delivered once the first instruction after the stack     switch is executed. An unprivileged KVM guest user could     use this flaw to crash the guest or, potentially,     escalate their privileges in the guest. (CVE-2018-1087)

  - It was found that the raw midi kernel driver does not     protect against concurrent access which leads to a     double realloc (double free) in     snd_rawmidi_input_params() and     snd_rawmidi_output_status() which are part of     snd_rawmidi_ioctl() handler in rawmidi.c file. A     malicious local attacker could possibly use this for     privilege escalation. (CVE-2018-10902)

  - A vulnerability was found in the     fs/inode.c:inode_init_owner() function logic of the     LInux kernel that allows local users to create files     with an unintended group ownership and with group     execution and SGID permission bits set, in a scenario     where a directory is SGID and belongs to a certain group     and is writable by a user who is not a member of this     group. This can lead to excessive permissions granted in     case when they should not. (CVE-2018-13405)

  - Modern operating systems implement virtualization of     physical memory to efficiently use available system     resources and provide inter-domain protection through     access control and isolation. The L1TF issue was found     in the way the x86 microprocessor designs have     implemented speculative execution of instructions (a     commonly used performance optimization) in combination     with handling of page-faults caused by terminated     virtual to physical address resolving process. As a     result, an unprivileged attacker could use this flaw to     read privileged memory of the kernel or other processes     and/or cross guest/host boundaries to read host memory     by conducting targeted cache side-channel attacks.
    (CVE-2018-3620)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load & Store instructions (a commonly used     performance optimization). It relies on the presence of     a precisely-defined instruction sequence in the     privileged code as well as the fact that memory read     from address to which a recent memory write has occurred     may see an older value and subsequently cause an update     into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.
    (CVE-2018-3639)

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions past bounds check. The flaw     relies on the presence of a precisely-defined     instruction sequence in the privileged code and the fact     that memory writes occur to an address which depends on     the untrusted value. Such writes cause an update into     the microprocessor's data cache even for speculatively     executed instructions that never actually commit     (retire). As a result, an unprivileged attacker could     use this flaw to influence speculative execution and/or     read privileged memory by conducting targeted cache     side-channel attacks. (CVE-2018-3693)

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - A an integer overflow vulnerability was discovered in     the Linux kernel, from version 3.4 through 4.15, in the     drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() function. An     attacker with access to the udldrmfb driver could     exploit this to obtain full read and write permissions     on kernel physical pages, resulting in a code execution     in kernel space. (CVE-2018-8781)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0247 for details.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
111815	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2344-1) (Foreshadow)	Nessus	SuSE Local Security Checks	2018/8/17	2024/8/19	high
151461	F5 Networks BIG-IP : Linux kernel vulnerability (K07020416)	Nessus	F5 Networks Local Security Checks	2021/7/8	2026/10/21	medium
111726	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4196)	Nessus	Oracle Linux Local Security Checks	2018/8/15	2026/2/9	medium
118743	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2018-1360)	Nessus	Huawei Local Security Checks	2018/11/6	2026/1/26	high
118947	RHEL 7 : kernel (RHSA-2018:3590)	Nessus	Red Hat Local Security Checks	2018/11/14	2026/1/26	high
118525	RHEL 7 : kernel (RHSA-2018:3083)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/3/16	high
111590	openSUSE Security Update : the Linux Kernel (openSUSE-2018-826)	Nessus	SuSE Local Security Checks	2018/8/8	2024/8/23	medium
111746	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:2328-1) (Foreshadow)	Nessus	SuSE Local Security Checks	2018/8/15	2024/8/21	high
127222	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0044)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2026/1/9	high
111773	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0247) (Foreshadow)	Nessus	OracleVM Local Security Checks	2018/8/16	2025/3/26	medium

検出

プラグインの検索

high

medium

medium

high

high

high

medium

high

high

medium