SUSE Linux Enterprise 11 SP4カーネルが3.0.101-108.81に更新され、さまざまなセキュリティとバグの修正が行われました。

次のセキュリティバグが修正されました。

CVE-2018-18281：Linuxカーネルで問題が発見されました。mremap()システムコールはページテーブルのロックを削除した後にTLBフラッシュを実行します。
ftruncate()などのsyscallが、mremap()の途中にあるタスクのページテーブルからエントリを削除した場合、古いTLBエントリがしばらくの間残るため、解放されてページアロケーターに戻され再使用された後に物理ページにアクセスできます（bnc#1113769）。

CVE-2018-18710：Linuxカーネルで問題が発見されました。符号なしlongからintへのキャストが境界チェックと干渉するため、ローカルの攻撃者がdrivers/cdrom/cdrom.c内のcdrom_ioctl_select_discの情報漏洩を悪用し、カーネルメモリを読み取る可能性がありました。これはCVE-2018-10940とCVE-2018-16658に類似しています（bnc#1113751）。

CVE-2018-18386：Linuxカーネルのdrivers/tty/n_tty.cにより、（疑似ターミナルにアクセスできる）ローカル攻撃者が、TIOCINQでのEXTPROCとICANONの混同により、疑似ターミナルデバイスのさらなる使用をハングアップ/ブロックする可能性があります（bnc#1094825）。

CVE-2017-7273：Linuxカーネル4.xにおけるdrivers/hid/hid-cypress.cのcp_report_fixup関数により、物理的に近接する攻撃者が細工されたHIDレポートを介して、サービス拒否（整数アンダーフロー）を引き起こしたり、詳細不明な他の影響を与えたりすることができました（bnc#1031240）。

CVE-2017-16533：Linuxカーネルのdrivers/hid/usbhid/hid-core.cのusbhid_parse関数により、ローカルのユーザーが細工されたUSBデバイスを使用して、サービス拒否（領域外読み取りおよびシステムクラッシュ）を引き起こしたり、詳細不明なその他の影響を与えることが可能でした（bnc#1066674）。

CVE-2017-1000407：Linuxカーネルで問題が発見されました。診断ポート0x80をフラッディングすることで例外が引き起こされ、カーネルパニックが発生する可能性がありました（bnc#1071021）。

CVE-2018-9516：Linuxカーネルで問題が発見されました。HIDコード内のcopy_to_user（）は、実行前に長さを正しくチェックしていません（bsc#1108498）。

CVE-2018-14633：LinuxカーネルのISCSIターゲットコードのchap_server_compute_md5()関数で、ISCSIイニシエーターからの認証リクエストの処理方法にセキュリティの欠陥があることがわかりました。認証されていないリモート攻撃者がスタックバッファのオーバーフローを引き起こし、最大17バイトのスタックを破壊する可能性があります。この攻撃では、被害者のホストでiSCSIターゲットを有効にする必要があります。
ターゲットコードの構築方法（コンパイラー、コンパイルフラグ、ハードウェアアーキテクチャなど）によっては、攻撃を受けてシステムがクラッシュし、サービス拒否が引き起こされたり、iSCSIターゲットによってエクスポートされたデータが不正にアクセスされたりする可能性があります。欠陥の性質上、権限昇格を完全に排除することはできませんが、起こる可能性は非常に低いと考えられます（bnc#1107829）。

更新パッケージには、セキュリティ以外の修正も含まれています。詳細については、アドバイザリを参照してください。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

リモートホストにインストールされている AOS のバージョンは、5.16.0.1 より前です。したがって、NXSA-AOS-5.16.0.1 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - ESXi および Horizon DaaS アプライアンスで使用されている OpenSLP に、ヒープ上書きの問題があります。VMwareは、この問題の深刻度を、9.8の最大CVSSv3基本スコアを持つ「重要度最高」の深刻度範囲と評価しています。
    (CVE-2019-5544)

  -悪意のあるワイヤレスネットワークに接続している間に、mwifiex カーネルモジュールに、攻撃者がメモリを破損させ、権限を昇格させる可能性のある欠陥が見つかりました。(CVE-2019-3846)

  - 空または不正な形式の p256-ECDH 公開鍵は、値がメモリにコピーされて使用される前に不適切にサニタイズされるため、セグメンテーション違反を誘発する可能性があります。この脆弱性の影響を受けるのは、Firefox ESR < 60.8、Firefox < 68、Thunderbird < 60.8です。(CVE-2019-11729)

  - ブロック暗号によって暗号化するとき、そのブロックサイズよりも小さいデータでNSC_EncryptUpdateに対する呼び出しが行われた場合、小さな領域外書き込みが引き起こされる可能性があります。これにより、ヒープ破損と悪用可能なクラッシュを引き起こす可能性があります。この脆弱性の影響を受けるのは、Thunderbird < 68.3、Firefox ESR < 68.3、Firefox < 71 です。(CVE-2019-11745)

  - 4.18.7 より前の Linux カーネルで問題が発見されました。block/blk-core.cに、
    特定のエラーケースが誤って処理されるため、__blk_drain_queue() のメモリ解放後使用 (Use After Free) があります。(CVE-2018-20856)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

リモートのOracle Linux 6/7ホストに、ELSA-2019-4315アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。- Linuxカーネルを使用するCAFからのAndroidリリースの全Qualcomm製品で、DMA割り当て中に、サイズの誤ったデータタイプにより、割り当てサイズが切り捨てられ、失敗した場合に割り当てが成功します。（CVE-2017-9725）- 4.15.15までのLinuxカーネルのfs/ext4/inode.cのext4_iget関数は、ゼロi_links_countを伴うrootディレクトリのケースを誤って処理します。そのため、攻撃者は、細工されたext4画像を介して、サービス拒否（ext4_process_freed_data NULLポインタデリファレンスおよびOOPS）を引き起こす可能性があります。（CVE-2018-1092）- 4.12.4よりLinuxカーネルのdrivers/input/serio/i8042.cにより、攻撃者は、（NULLポインタデリファレンスおよびシステムクラッシュ）を引き起こしたり、詳細不明な他の影響を与える可能性があります。それは、port->exists値が検証後に変更できるようになっているためです。（CVE-2017-18079）- 4.7より前のLinuxカーネルでは、drivers/pinctrl/pinctrl-amd.cのamd_gpio_remove関数は、pinctrl_unregister関数を呼び出し、二重解放が発生します。（CVE-2017-18174）- 4.11.4より前のLinuxカーネルのmm/mlock.cの__munlock_pagevec関数により、ローカルユーザーは、細工されたmlockallおよびmunlockallシステムコールを使用することによって、サービス拒否（NR_MLOCKアカウンティング破損）を引き起こす可能性があります。
（CVE-2017-18221） -4.11より前のLinuxカーネル内のkernel/events/core.cのperf_cpu_time_max_percent_handler関数により、ローカルユーザーは、大きな値を介して、サービス拒否（整数オーバーフロー）を引き起こしたり、詳細不明な他の影響を与える可能性があります。これは不適切なサンプルレートでの計算によって実証されています。（CVE-2017-18255） -** 異論あり **4.15.7までのLinuxカーネルのarch/x86/kernel/cpu/mcheck/mce.cのstore_int_with_restart()関数により、ローカルユーザーは、rootのアクセス権で/sys/devices/system/machinecheck/machinecheckディレクトリのcheck_intervalファイルへ書き込みことによって、サービス拒否（パニック）を引き起こす可能性があります。注：サードパーティは、このレポートがセキュリティ関連ではないと指摘しています。（CVE-2018-7995）-bluetoothのhidp_process_reportで、整数オーバーフローがあります。これにより、追加の実行権限が不要で、領域外書き込みが発生する可能性があります。悪用はユーザーの操作を必要としません。製品：Androidのバージョン：AndroidカーネルAndroid ID: A-65853588参照：Upstreamカーネル。（CVE-2018-9363）hid_debug_events_read of drivers/hid/hid-debug.cで、境界チェックが欠落しているため領域外書き込みが発生する可能性があります。これにより、システム実行権限が必要なローカルでの権限昇格が引き起こされる可能性があります。悪用はユーザーの操作を必要としません。製品：Androidのバージョン：
AndroidカーネルAndroid ID: A-71361580。（CVE-2018-9516） Nessusはこの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

A flaw was found in the Linux kernel in the hid_debug_events_read() function in the drivers/hid/hid-debug.c file. A lack of the certain checks may allow a privileged user ('root') to achieve an out-of-bounds write and thus receiving user space buffer corruption.
(CVE-2018-9516)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3871-3 advisory.

    Wen Xu discovered that a use-after-free vulnerability existed in the ext4 filesystem implementation in the     Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10876,     CVE-2018-10879)

    Wen Xu discovered that a buffer overflow existed in the ext4 filesystem implementation in the Linux     kernel. An attacker could use this to construct a malicious ext4 image that, when mounted, could cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10877)

    Wen Xu discovered that an out-of-bounds write vulnerability existed in the ext4 filesystem implementation     in the Linux kernel. An attacker could use this to construct a malicious ext4 image that, when mounted,     could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-10878,     CVE-2018-10882)

    Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly ensure that     xattr information remained in inode bodies. An attacker could use this to construct a malicious ext4 image     that, when mounted, could cause a denial of service (system crash). (CVE-2018-10880)

    Wen Xu discovered that the ext4 file system implementation in the Linux kernel could possibly perform an     out of bounds write when updating the journal for an inline file. An attacker could use this to construct     a malicious ext4 image that, when mounted, could cause a denial of service (system crash).
    (CVE-2018-10883)

    It was discovered that a race condition existed in the vsock address family implementation of the Linux     kernel that could lead to a use-after-free condition. A local attacker in a guest virtual machine could     use this to expose sensitive information (host machine kernel memory). (CVE-2018-14625)

    Cfir Cohen discovered that a use-after-free vulnerability existed in the KVM implementation of the Linux     kernel, when handling interrupts in environments where nested virtualization is in use (nested KVM     virtualization is not enabled by default in Ubuntu kernels). A local attacker in a guest VM could possibly     use this to gain administrative privileges in a host machine. (CVE-2018-16882)

    Jann Horn discovered that the procfs file system implementation in the Linux kernel did not properly     restrict the ability to inspect the kernel stack of an arbitrary task. A local attacker could use this to     expose sensitive information. (CVE-2018-17972)

    Jann Horn discovered that the mremap() system call in the Linux kernel did not properly flush the TLB when     completing, potentially leaving access to a physical page after it has been released to the page     allocator. A local attacker could use this to cause a denial of service (system crash), expose sensitive     information, or possibly execute arbitrary code. (CVE-2018-18281)

    Wei Wu discovered that the KVM implementation in the Linux kernel did not properly ensure that ioapics     were initialized. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2018-19407)

    It was discovered that the debug interface for the Linux kernel's HID subsystem did not properly perform     bounds checking in some situations. An attacker with access to debugfs could use this to cause a denial of     service or possibly gain additional privileges. (CVE-2018-9516)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A malformed SG_IO ioctl issued for a SCSI device in the     Linux kernel leads to a local kernel data leak     manifesting in up to approximately 1000 memory pages     copied to the userspace. The problem has limited scope     as non-privileged users usually have no permissions to     access SCSI device files.(CVE-2018-1000204)

  - A flaw in the load_elf_binary() function in the Linux     kernel allows a local attacker to leak the base address     of .text and stack sections for setuid binaries and     bypass ASLR because install_exec_creds() is called too     late in this function.(CVE-2019-11190)

  - A flaw was found in the Linux kernel in the     hid_debug_events_read() function in the     drivers/hid/hid-debug.c file. A lack of the certain     checks may allow a privileged user ('root') to achieve     an out-of-bounds write and thus receiving user space     buffer corruption.(CVE-2018-9516)

  - A flaw was found in the Linux kernel's NFS41+     subsystem. NFS41+ shares mounted in different network     namespaces at the same time can make bc_svc_process()     use wrong back-channel IDs and cause a use-after-free     vulnerability. Thus a malicious container user can     cause a host kernel memory corruption and a system     panic. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out.(CVE-2018-16884)

  - An issue was discovered in the Linux kernel through     4.19. An information leak in cdrom_ioctl_select_disc in     drivers/cdrom/cdrom.c could be used by local attackers     to read kernel memory because a cast from unsigned long     to int interferes with bounds checking. This is similar     to CVE-2018-10940 and CVE-2018-16658.(CVE-2018-18710)

  - A flaw was found in the Linux kernel in the function     hso_probe() which reads if_num value from the USB     device (as an u8) and uses it without a length check to     index an array, resulting in an OOB memory read in     hso_probe() or hso_get_config_data(). An attacker with     a forged USB device and physical access to a system     (needed to connect such a device) can cause a system     crash and a denial of service.(CVE-2018-19985)

  - A possible memory corruption due to a type confusion     was found in the Linux kernel in the sk_clone_lock()     function in the net/core/sock.c. The possibility of     local escalation of privileges cannot be fully ruled     out for a local unprivileged attacker.(CVE-2018-9568)

  - A flaw was found in the Linux kernels implementation of     Logical link control and adaptation protocol (L2CAP),     part of the Bluetooth stack. An attacker with physical     access within the range of standard Bluetooth     transmission can create a specially crafted packet. The     response to this specially crafted packet can contain     part of the kernel stack which can be used in a further     attack.(CVE-2019-3459)

  - A flaw was found in the Linux kernel's implementation     of logical link control and adaptation protocol     (L2CAP), part of the Bluetooth stack in the     l2cap_parse_conf_rsp and l2cap_parse_conf_req     functions. An attacker with physical access within the     range of standard Bluetooth transmission can create a     specially crafted packet. The response to this     specially crafted packet can contain part of the kernel     stack which can be used in a further     attack.(CVE-2019-3460)

  - An information leakage issue was found in the way Linux     kernel's KVM hypervisor handled page fault exceptions     while emulating instructions like VMXON, VMCLEAR,     VMPTRLD, and VMWRITE with memory address as an operand.
    It occurs if the operand is a mmio address, as the     returned exception object holds uninitialized stack     memory contents. A guest user/process could use this     flaw to leak host's stack memory contents to a guest.
    (CVE-2019-7222)

  - A flaw was found in mmap in the Linux kernel allowing     the process to map a null page. This allows attackers     to abuse this mechanism to turn null pointer     dereferences into workable exploits(CVE-2019-9213)

  - A flaw was found in the Linux kernel's ext4 filesystem.
    A local user can cause an out-of-bound write in the     fs/jbd2/transaction.c code, a denial of service, and a     system crash by unmounting a crafted ext4 filesystem     image.(CVE-2018-10882)

  - An issue was discovered in the Linux kernel before     4.18.11. The ipddp_ioctl function in     drivers/net/appletalk/ipddp.c allows local users to     obtain sensitive kernel address information by     leveraging CAP_NET_ADMIN to read the ipddp_route dev     and next fields via an SIOCFINDIPDDPRT ioctl call.
    (CVE-2018-20511)

  - A flaw was found in the implementation of the 'fill     buffer', a mechanism used by modern CPUs when a     cache-miss is made on L1 CPU cache. If an attacker can     generate a load operation that would create a page     fault, the execution will continue speculatively with     incorrect data from the fill buffer while the data is     fetched from higher level caches. This response time     can be measured to infer data in the fill buffer.
    (CVE-2018-12130)

  - Modern Intel microprocessors implement hardware-level     micro-optimizations to improve the performance of     writing data back to CPU caches. The write operation is     split into STA (STore Address) and STD (STore Data)     sub-operations. These sub-operations allow the     processor to hand-off address generation logic into     these sub-operations for optimized writes. Both of     these sub-operations write to a shared distributed     processor structure called the 'processor store     buffer'. As a result, an unprivileged attacker could     use this flaw to read private data resident within the     CPU's processor store buffer. (CVE-2018-12126)

  - Microprocessors use a aEUR~load portaEURtm subcomponent to     perform load operations from memory or IO. During a     load operation, the load port receives data from the     memory or IO subsystem and then provides the data to     the CPU registers and operations in the CPUaEURtms     pipelines. Stale load operations results are stored in     the 'load port' table until overwritten by newer     operations. Certain load-port operations triggered by     an attacker can be used to reveal data about previous     stale requests leaking data back to the attacker via a     timing side-channel. (CVE-2018-12127)

  - Uncacheable memory on some microprocessors utilizing     speculative execution may allow an authenticated user     to potentially enable information disclosure via a side     channel with local access. (CVE-2019-11091)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In hid_debug_events_read of drivers/hid/hid-debug.c, there is a possible out of bounds write due to a     missing bounds check. This could lead to local escalation of privilege with System execution privileges     needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android     ID: A-71361580. (CVE-2018-9516)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of AOS installed on the remote host is prior to 5.11.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.11.3 advisory.

  - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated     the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
    (CVE-2019-5544)

  - A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell     WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a     denial of service, or execute arbitrary code. The highest threat with this vulnerability is with the     availability of the system. If code execution occurs, the code will run with the permissions of root. This     will affect both confidentiality and integrity of files on the system. (CVE-2019-14901)

  - In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy     blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user     ID. For example, this allows bypass of !root configuration, and USER= logging, for a sudo -u     \#$((0xffffffff)) command. (CVE-2019-14287)

  - Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly     sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox     < 68, and Thunderbird < 60.8. (CVE-2019-11729)

  - When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the     block size, a small out of bounds write could occur. This could have caused heap corruption and a     potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and     Firefox < 71. (CVE-2019-11745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - rds: congestion updates can be missed when kernel low on     memory (Mukesh Kacker) [Orabug: 28425811]

  - net/rds: ib: Fix endless RNR Retries caused by memory     allocation failures (Venkat Venkatsubra) [Orabug:
    28127993]

  - net: rds: fix excess initialization of the recv SGEs     (Zhu Yanjun) [Orabug: 29004503]

  - xhci: fix usb2 resume timing and races. (Mathias Nyman)     [Orabug: 29028940]

  - xhci: Fix a race in usb2 LPM resume, blocking U3 for     usb2 devices (Mathias Nyman) [Orabug: 29028940]

  - userfaultfd: check VM_MAYWRITE was set after verifying     the uffd is registered (Andrea Arcangeli) [Orabug:
    29163750] (CVE-2018-18397)

  - userfaultfd: shmem/hugetlbfs: only allow to register     VM_MAYWRITE vmas (Andrea Arcangeli) [Orabug: 29163750]     (CVE-2018-18397)

  - x86/apic/x2apic: set affinity of a single interrupt to     one cpu (Jianchao Wang) [Orabug: 29196396]

  - xen/blkback: rework validate_io_op (Dongli Zhang)     [Orabug: 29199843]

  - xen/blkback: optimize validate_io_op to filter     BLKIF_OP_RESERVED_1 operation (Dongli Zhang) [Orabug:
    29199843]

  - xen/blkback: do not BUG for invalid blkif_request from     frontend (Dongli Zhang) [Orabug: 29199843]

  - net/rds: WARNING: at net/rds/recv.c:222     rds_recv_hs_exthdrs+0xf8/0x1e0 (Venkat Venkatsubra)     [Orabug: 29201779]

  - xen-netback: wake up xenvif_dealloc_kthread when it     should stop (Dongli Zhang) [Orabug: 29217927]

  - Revert 'xfs: remove nonblocking mode from     xfs_vm_writepage' (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: remove xfs_cancel_ioend' (Wengang Wang)     [Orabug: 29279692]

  - Revert 'xfs: Introduce writeback context for writepages'     (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: xfs_cluster_write is redundant' (Wengang     Wang) [Orabug: 29279692]

  - Revert 'xfs: factor mapping out of xfs_do_writepage'     (Wengang Wang) [Orabug: 29279692]

  - Revert 'xfs: don't chain ioends during writepage     submission' (Wengang Wang) [Orabug: 29279692]

  - mstflint: Fix coding style issues - left with     LINUX_VERSION_CODE (Idan Mehalel) [Orabug: 28878697]

  - mstflint: Fix coding-style issues (Idan Mehalel)     [Orabug: 28878697]

  - mstflint: Fix errors found with checkpatch script (Idan     Mehalel) [Orabug: 28878697]

  - Added support for 5th Gen devices in Secure Boot module     and mtcr (Adham Masarwah) [Orabug: 28878697]

  - Fix typos in mst_kernel (Adham Masarwah) [Orabug:
    28878697]

  - bnxt_en: Report PCIe link properties with     pcie_print_link_status (Brian Maly) [Orabug: 28942099]

  - selinux: Perform both commoncap and selinux xattr checks     (Eric W. Biederman) [Orabug: 28951521]

  - Introduce v3 namespaced file capabilities (Serge E.
    Hallyn) [Orabug: 28951521]

  - rds: ib: Use a delay when reconnecting to the very same     IP address (H&aring kon Bugge) [Orabug: 29138813]

  - Change mincore to count 'mapped' pages rather than     'cached' pages (Linus Torvalds) [Orabug: 29187415]     (CVE-2019-5489)

  - NFSD: Set the attributes used to store the verifier for     EXCLUSIVE4_1 (Kinglong Mee) [Orabug: 29204157]

  - ext4: update i_disksize when new eof exceeds it (Shan     Hai) [Orabug: 28940828]

  - ext4: update i_disksize if direct write past ondisk size     (Eryu Guan) [Orabug: 28940828]

  - ext4: protect i_disksize update by i_data_sem in direct     write path (Eryu Guan) [Orabug: 28940828]

  - ALSA: usb-audio: Fix UAF decrement if card has no live     interfaces in card.c (Hui Peng) [Orabug: 29042981]     (CVE-2018-19824)

  - ALSA: usb-audio: Replace probing flag with active     refcount (Takashi Iwai) [Orabug: 29042981]     (CVE-2018-19824)

  - ALSA: usb-audio: Avoid nested autoresume calls (Takashi     Iwai) [Orabug: 29042981] (CVE-2018-19824)

  - ext4: validate that metadata blocks do not overlap     superblock (Theodore Ts'o) [Orabug: 29114440]     (CVE-2018-1094)

  - ext4: update inline int ext4_has_metadata_csum(struct     super_block *sb) (John Donnelly) [Orabug: 29114440]     (CVE-2018-1094)

  - ext4: always initialize the crc32c checksum driver     (Theodore Ts'o) [Orabug: 29114440] (CVE-2018-1094)     (CVE-2018-1094)

  - Revert 'bnxt_en: Reduce default rings on multi-port     cards.' (Brian Maly) [Orabug: 28687746]

  - mlx4_core: Disable P_Key Violation Traps (H&aring kon     Bugge) [Orabug: 27693633]

  - rds: RDS connection does not reconnect after CQ access     violation error (Venkat Venkatsubra) [Orabug: 28733324]

  - KVM/SVM: Allow direct access to MSR_IA32_SPEC_CTRL     (KarimAllah Ahmed) [Orabug: 28069548]

  - KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL -     reloaded (Mihai Carabas) [Orabug: 28069548]

  - KVM/x86: Add IBPB support (Ashok Raj) [Orabug: 28069548]

  - KVM: x86: pass host_initiated to functions that read     MSRs (Paolo Bonzini) [Orabug: 28069548]

  - KVM: VMX: make MSR bitmaps per-VCPU (Paolo Bonzini)     [Orabug: 28069548]

  - KVM: VMX: introduce alloc_loaded_vmcs (Paolo Bonzini)     [Orabug: 28069548]

  - KVM: nVMX: Eliminate vmcs02 pool (Jim Mattson) [Orabug:
    28069548]

  - KVM: nVMX: fix msr bitmaps to prevent L2 from accessing     L0 x2APIC (Radim Kr&#x10D m&aacute &#x159 ) [Orabug:
    28069548]

  - ocfs2: don't clear bh uptodate for block read (Junxiao     Bi) [Orabug: 28762940]

  - ocfs2: clear journal dirty flag after shutdown journal     (Junxiao Bi) [Orabug: 28924775]

  - ocfs2: fix panic due to unrecovered local alloc (Junxiao     Bi) [Orabug: 28924775]

  - net: rds: fix rds_ib_sysctl_max_recv_allocation error     (Zhu Yanjun) [Orabug: 28947481]

  - x86/speculation: Always disable IBRS in     disable_ibrs_and_friends (Alejandro Jimenez) [Orabug:
    29139710]

  - pinctrl: amd: Use devm_pinctrl_register for pinctrl     registration (Laxman Dewangan) [Orabug: 27539246]     (CVE-2017-18174)

  - mlock: fix mlock count can not decrease in race     condition (Yisheng Xie) [Orabug: 27677611]     (CVE-2017-18221)

  - perf/core: Fix the perf_cpu_time_max_percent check (Tan     Xiaojun) [Orabug: 27823815] (CVE-2017-18255)

  - x86/microcode/intel: Fix a wrong assignment of revision     in _save_mc (Zhenzhong Duan) [Orabug: 28190263]

  - mm: cma: fix incorrect type conversion for size during     dma allocation (Rohit Vaswani) [Orabug: 28407826]     (CVE-2017-9725)

  - x86/speculation: Make enhanced IBRS the default spectre     v2 mitigation (Alejandro Jimenez) [Orabug: 28474851]

  - x86/speculation: Enable enhanced IBRS usage (Alejandro     Jimenez) [Orabug: 28474851]

  - x86/speculation: functions for supporting enhanced IBRS     (Alejandro Jimenez) [Orabug: 28474851]

  - xen/blkback: fix disconnect while I/Os in flight     (Juergen Gross) [Orabug: 28744234]

  - mlx4_vnic: use the mlid while calling ib_detach_mcast     (aru kolappan) [Orabug: 29029705]

  - ext4: fail ext4_iget for root directory if unallocated     (Theodore Ts'o) [Orabug: 29048557] (CVE-2018-1092)     (CVE-2018-1092)

  - Bluetooth: hidp: buffer overflow in hidp_process_report     (Mark Salyzyn) [Orabug: 29121215] (CVE-2018-9363)     (CVE-2018-9363)

  - HID: debug: check length before copy_to_user (Daniel     Rosenberg) [Orabug: 29128165] (CVE-2018-9516)

  - x86/MCE: Serialize sysfs changes (Seunghun Han) [Orabug:
    29149888] (CVE-2018-7995)

  - Input: i8042 - fix crash at boot time (Chen Hong)     [Orabug: 29152328] (CVE-2017-18079)

  - base/memory, hotplug: fix a kernel oops in     show_valid_zones (Toshi Kani) [Orabug: 29050538]

  - mm/memory_hotplug.c: check start_pfn in     test_pages_in_a_zone (Toshi Kani) [Orabug: 29050538]

  - drivers/base/memory.c: prohibit offlining of memory     blocks with missing sections (Seth Jennings) [Orabug:
    29050538]

  - mm: Check if section present during memory block     (un)registering (Yinghai Lu) [Orabug: 29050538]

  - hugetlb: take PMD sharing into account when flushing     tlb/caches (Mike Kravetz) [Orabug: 28951854]

  - mm: migration: fix migration of huge PMD shared pages     (Mike Kravetz) [Orabug: 28951854]

  - hugetlbfs: use truncate mutex to prevent pmd sharing     race (Mike Kravetz) [Orabug: 28896255]

  - rds: ib: Improve tracing during failover/back     (H&aring kon Bugge) [Orabug: 28860366]

  - rds: ib: Remove superfluous add of address on fail-back     device (H&aring kon Bugge) [Orabug: 28860366]

  - libiscsi: Fix NULL pointer dereference in     iscsi_eh_session_reset (Fred Herard) [Orabug: 28946207]

  - wil6210: missing length check in wmi_set_ie (Lior David)     [Orabug: 28951265] (CVE-2018-5848)

  - netfilter: xt_osf: Add missing permission checks (Kevin     Cernekee) [Orabug: 29037831] (CVE-2017-17450)

  - x86/speculation: Fix bad argument to rdmsrl in     cpu_set_bug_bits (Alejandro Jimenez) [Orabug: 29044805]

ID	名前	製品	ファミリー	公開日	更新日	深刻度
118952	SUSE SLES11セキュリティ更新プログラム：カーネル（SUSE-SU-2018:3746-1）	Nessus	SuSE Local Security Checks	2018/11/14	2024/7/22	high
164593	Nutanix AOS : 複数の脆弱性 (NXSA-AOS-5.16.0.1)	Nessus	Misc.	2022/9/1	2025/7/22	critical
120976	Oracle Linux 6/7：Unbreakable Enterprise Kernel（ELSA-2019-4315）	Nessus	Oracle Linux Local Security Checks	2019/1/7	2024/10/23	critical
129063	Amazon Linux 2 : kernel (ALAS-2019-1278)	Nessus	Amazon Linux Local Security Checks	2019/9/20	2024/4/24	high
121593	Ubuntu 18.04 LTS : Linux kernel (AWS, GCP, KVM, OEM, Raspberry Pi 2) vulnerabilities (USN-3871-3)	Nessus	Ubuntu Local Security Checks	2019/2/5	2024/8/27	high
125514	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2019-1587)	Nessus	Huawei Local Security Checks	2019/5/29	2022/12/5	high
222707	Linux Distros Unpatched Vulnerability : CVE-2018-9516	Nessus	Misc.	2025/3/4	2025/9/2	high
164602	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.3)	Nessus	Misc.	2022/9/1	2025/7/22	critical
121605	OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0002)	Nessus	OracleVM Local Security Checks	2019/2/6	2024/6/24	critical

検出

プラグインの検索

high

critical

critical

high

high

high

high

critical

critical