The linux update issued as DLA-1731-1 caused a regression in the vmxnet3 (VMware virtual network adapter) driver. This update corrects that regression, and an earlier regression in the CIFS network filesystem implementation introduced in DLA-1422-1. For reference the original advisory text follows.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2016-10741

A race condition was discovered in XFS that would result in a crash (BUG). A local user permitted to write to an XFS volume could use this for denial of service.

CVE-2017-5753

Further instances of code that was vulnerable to Spectre variant 1 (bounds-check bypass) have been mitigated.

CVE-2017-13305

A memory over-read was discovered in the keys subsystem's encrypted key type. A local user could use this for denial of service or possibly to read sensitive information.

CVE-2018-3639 (SSB)

Multiple researchers have discovered that Speculative Store Bypass (SSB), a feature implemented in many processors, could be used to read sensitive information from another context. In particular, code in a software sandbox may be able to read sensitive information from outside the sandbox. This issue is also known as Spectre variant 4.

This update fixes bugs in the mitigations for SSB for AMD processors.

CVE-2018-5848

The wil6210 wifi driver did not properly validate lengths in scan and connection requests, leading to a possible buffer overflow. On systems using this driver, a local user with the CAP_NET_ADMIN capability could use this for denial of service (memory corruption or crash) or potentially for privilege escalation.

CVE-2018-5953

The swiotlb subsystem printed kernel memory addresses to the system log, which could help a local attacker to exploit other vulnerabilities.

CVE-2018-12896, CVE-2018-13053

Team OWL337 reported possible integer overflows in the POSIX timer implementation. These might have some security impact.

CVE-2018-16862

Vasily Averin and Pavel Tikhomirov from Virtuozzo Kernel Team discovered that the cleancache memory management feature did not invalidate cached data for deleted files. On Xen guests using the tmem driver, local users could potentially read data from other users' deleted files if they were able to create new files on the same volume.

CVE-2018-16884

A flaw was found in the NFS 4.1 client implementation. Mounting NFS shares in multiple network namespaces at the same time could lead to a user-after-free. Local users might be able to use this for denial of service (memory corruption or crash) or possibly for privilege escalation.

This can be mitigated by disabling unprivileged users from creating user namespaces, which is the default in Debian.

CVE-2018-17972

Jann Horn reported that the /proc/*/stack files in procfs leaked sensitive data from the kernel. These files are now only readable by users with the CAP_SYS_ADMIN capability (usually only root)

CVE-2018-18281

Jann Horn reported a race condition in the virtual memory manager that can result in a process briefly having access to memory after it is freed and reallocated. A local user permitted to create containers could possibly exploit this for denial of service (memory corruption) or for privilege escalation.

CVE-2018-18690

Kanda Motohiro reported that XFS did not correctly handle some xattr (extended attribute) writes that require changing the disk format of the xattr. A user with access to an XFS volume could use this for denial of service.

CVE-2018-18710

It was discovered that the cdrom driver does not correctly validate the parameter to the CDROM_SELECT_DISC ioctl. A user with access to a cdrom device could use this to read sensitive information from the kernel or to cause a denial of service (crash).

CVE-2018-19824

Hui Peng and Mathias Payer discovered a use-after-free bug in the USB audio driver. A physically present attacker able to attach a specially designed USB device could use this for privilege escalation.

CVE-2018-19985

Hui Peng and Mathias Payer discovered a missing bounds check in the hso USB serial driver. A physically present user able to attach a specially designed USB device could use this to read sensitive information from the kernel or to cause a denial of service (crash).

CVE-2018-20169

Hui Peng and Mathias Payer discovered missing bounds checks in the USB core. A physically present attacker able to attach a specially designed USB device could use this to cause a denial of service (crash) or possibly for privilege escalation.

CVE-2018-20511

InfoSect reported an information leak in the AppleTalk IP/DDP implemntation. A local user with CAP_NET_ADMIN capability could use this to read sensitive information from the kernel.

CVE-2019-3701

Muyu Yu and Marcus Meissner reported that the CAN gateway implementation allowed the frame length to be modified, typically resulting in out-of-bounds memory-mapped I/O writes. On a system with CAN devices present, a local user with CAP_NET_ADMIN capability in the initial net namespace could use this to cause a crash (oops) or other hardware-dependent impact.

CVE-2019-3819

A potential infinite loop was discovered in the HID debugfs interface exposed under /sys/kernel/debug/hid. A user with access to these files could use this for denial of service.

This interface is only accessible to root by default, which fully mitigates the issue.

CVE-2019-6974

Jann Horn reported a use-after-free bug in KVM. A local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

CVE-2019-7221

Jim Mattson and Felix Wilhelm reported a user-after-free bug in KVM's nested VMX implementation. On systems with Intel CPUs, a local user with access to /dev/kvm could use this to cause a denial of service (memory corruption or crash) or possibly for privilege escalation.

Nested VMX is disabled by default, which fully mitigates the issue.

CVE-2019-7222

Felix Wilhelm reported an information leak in KVM for x86. A local user with access to /dev/kvm could use this to read sensitive information from the kernel.

CVE-2019-9213

Jann Horn reported that privileged tasks could cause stack segments, including those in other processes, to grow downward to address 0. On systems lacking SMAP (x86) or PAN (ARM), this exacerbated other vulnerabilities: a NULL pointer dereference could be exploited for privilege escalation rather than only for denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 3.16.64-1.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The recent speculative execution CVEs address three     potential attacks across a wide variety of     architectures and hardware platforms.

  - Note: This issue is present in hardware and cannot be     fully fixed via software update. The nature of these     vulnerabilities and their fixes introduces the     possibility of reduced performance on patched systems.
    The performance impact depends on the hardware and the     applications in place.

  - The first two variants abuse speculative execution to     perform bounds-check bypass (CVE-2017-5753), or by     utilizing branch target injection (CVE-2017-5715) to     cause kernel code at an address under attacker control     to execute speculatively. Collectively these are known     as 'Spectre'.

  - Variant CVE-2017-5715 fixes require CPU microcode to     update.And advise to contact hardware vendors to     receive the appropriate microcode for your processor.

  - The third variant (CVE-2017-5754) relies on the fact     that, on impacted microprocessors, during speculative     execution of instruction permission faults, exception     generation triggered by a faulting access is suppressed     until the retirement of the whole instruction block.
    Researchers have called this exploit 'Meltdown'.

  - Note1: Upgrade and performance specifications,please     see     http://developer.huawei.com/ict/en/performance_update

  - Note2i1/4sDescription of microcode and security     patchesaEURtm switches,please see     https://developer.huawei.com/ict/en/site-euleros/articl     e/switch

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. The performance impact of these patches may vary considerably based on workload and hardware configuration.

In this update mitigations for x86-64 architecture are provided.

Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5753, Important)

Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. (CVE-2017-5715, Important)

Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. (CVE-2017-5754, Important)

Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue.

The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use attacker controllable speculative     execution over code patterns in the Linux Kernel to leak     content from otherwise not readable memory in the same     address space, allowing retrieval of passwords,     cryptographic keys and other secrets. This problem is     mitigated by adding speculative fencing on affected code     paths throughout the Linux kernel. This issue is     addressed for the x86_64, IBM Power and IBM zSeries     architecture.

  - CVE-2017-5715 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring branch prediction     could use mispredicted branches to speculatively execute     code patterns that in turn could be made to leak other     non-readable content in the same address space, an     attack similar to CVE-2017-5753. This problem is     mitigated by disabling predictive branches, depending on     CPU architecture either by firmware updates and/or fixes     in the user-kernel privilege boundaries. This is done     with help of Linux Kernel fixes on the Intel/AMD x86_64     and IBM zSeries architectures. On x86_64, this requires     also updates of the CPU microcode packages, delivered in     separate updates. For IBM Power and zSeries the required     firmware updates are supplied over regular channels by     IBM. As this feature can have a performance impact, it     can be disabled using the 'nospec' kernel commandline     option.

  - CVE-2017-5754 / 'MeltdownAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use code patterns in userspace to     speculative executive code that would read otherwise     read protected memory, an attack similar to     CVE-2017-5753. This problem is mitigated by unmapping     the Linux Kernel from the user address space during user     code execution, following a approach called 'KAISER'.
    The terms used here are 'KAISER' / 'Kernel Address     Isolation' and 'PTI' / 'Page Table Isolation'. This     update does this on the x86_64 architecture, it is not     required on the IBM zSeries architecture. This feature     can be enabled / disabled by the 'pti=[on|off|auto]' or     'nopti' commandline options. The following security bugs     were fixed :

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer. (bnc#1072876).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, did not restrict     observations of Netlink messages to a single net     namespace, which allowed local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system (bnc#1071694).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is     enabled, did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

  - CVE-2017-5753 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use attacker controllable speculative     execution over code patterns in the Linux Kernel to leak     content from otherwise not readable memory in the same     address space, allowing retrieval of passwords,     cryptographic keys and other secrets. This problem is     mitigated by adding speculative fencing on affected code     paths throughout the Linux kernel. This issue is     addressed for the x86_64, the IBM Power and IBM zSeries     architecture.

  - CVE-2017-5715 / 'SpectreAttack': Local attackers on     systems with modern CPUs featuring branch prediction     could use mispredicted branches to speculatively execute     code patterns that in turn could be made to leak other     non-readable content in the same address space, an     attack similar to CVE-2017-5753. This problem is     mitigated by disabling predictive branches, depending on     CPU architecture either by firmware updates and/or fixes     in the user-kernel privilege boundaries. This is done     with help of Linux Kernel fixes on the Intel/AMD x86_64     and IBM zSeries architectures. On x86_64, this requires     also updates of the CPU microcode packages, delivered in     separate updates. For IBM Power and zSeries the required     firmware updates are supplied over regular channels by     IBM. As this feature can have a performance impact, it     can be disabled using the 'nospec' kernel commandline     option.

  - CVE-2017-5754 / 'MeltdownAttack': Local attackers on     systems with modern CPUs featuring deep instruction     pipelining could use code patterns in userspace to     speculative executive code that would read otherwise     read protected memory, an attack similar to     CVE-2017-5753. This problem is mitigated by unmapping     the Linux Kernel from the user address space during user     code execution, following a approach called 'KAISER'.
    The terms used here are 'KAISER' / 'Kernel Address     Isolation' and 'PTI' / 'Page Table Isolation'. This     update does this on the x86_64 architecture, it is not     required on the IBM zSeries architecture. This feature     can be enabled / disabled by the 'pti=[on|off|auto]' or     'nopti' commandline options. The following security bugs     were fixed :

  - CVE-2017-15868: The bnep_add_connection function in     net/bluetooth/bnep/core.c in the Linux kernel did not     ensure that an l2cap socket is available, which allowed     local users to gain privileges via a crafted application     (bnc#1071470).

  - CVE-2017-13167: An elevation of privilege vulnerability     in the kernel sound timer. (bnc#1072876).

  - CVE-2017-16538: drivers/media/usb/dvb-usb-v2/lmedm04.c     in the Linux kernel allowed local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus dm04_lme2510_tuner)     (bnc#1066569).

  - CVE-2017-17558: The usb_destroy_configuration function     in drivers/usb/core/config.c in the USB core subsystem     in the Linux kernel did not consider the maximum number     of configurations and interfaces before attempting to     release resources, which allowed local users to cause a     denial of service (out-of-bounds write access) or     possibly have unspecified other impact via a crafted USB     device (bnc#1072561).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel through     4.14.4, when CONFIG_NLMON is enabled, did not restrict     observations of Netlink messages to a single net     namespace, which allowed local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system (bnc#1071694).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel through 4.12.3, when CONFIG_XFRM_MIGRATE is     enabled, did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-16534: The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066693).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3542-1 advisory.

    Jann Horn discovered that microprocessors utilizing speculative execution and branch prediction may allow     unauthorized memory reads via sidechannel attacks. This flaw is known as Spectre. A local attacker could     use this to expose sensitive information, including kernel memory. This update provides mitigations for     the i386 (CVE-2017-5753 only) and amd64 architectures.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for xen fixes several issues. These security issues were fixed :

  - CVE-2017-5753, CVE-2017-5715, CVE-2017-5754: Prevent     information leaks via side effects of speculative     execution, aka 'Spectre' and 'Meltdown' attacks     (bsc#1074562, bsc#1068032)

  - CVE-2017-15595: x86 PV guest OS users were able to cause     a DoS (unbounded recursion, stack consumption, and     hypervisor crash) or possibly gain privileges via     crafted page-table stacking (bsc#1061081)

  - CVE-2017-17566: Prevent PV guest OS users to cause a     denial of service (host OS crash) or gain host OS     privileges in shadow mode by mapping a certain auxiliary     page (bsc#1070158).

  - CVE-2017-17563: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging an incorrect mask for reference-count     overflow checking in shadow mode (bsc#1070159).

  - CVE-2017-17564: Prevent guest OS users to cause a denial     of service (host OS crash) or gain host OS privileges by     leveraging incorrect error handling for reference     counting in shadow mode (bsc#1070160).

  - CVE-2017-17565: Prevent PV guest OS users to cause a     denial of service (host OS crash) if shadow mode and     log-dirty mode are in place, because of an incorrect     assertion related to M2P (bsc#1070163).

  - CVE-2018-5683: The vga_draw_text function allowed local     OS guest privileged users to cause a denial of service     (out-of-bounds read and QEMU process crash) by     leveraging improper memory address validation     (bsc#1076116).

  - CVE-2017-18030: The cirrus_invalidate_region function     allowed local OS guest privileged users to cause a     denial of service (out-of-bounds array access and QEMU     process crash) via vectors related to negative pitch     (bsc#1076180).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: cpu: speculative execution branch target injection (s390-only) (CVE-2017-5715, Important)

* hw: cpu: speculative execution bounds-check bypass (s390 and powerpc) (CVE-2017-5753, Important)

* hw: cpu: speculative execution permission faults handling (powerpc-only) (CVE-2017-5754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes :

* If a fibre channel (FC) switch was powered down and then powered on again, the SCSI device driver stopped permanently the SCSI device's request queue. Consequently, the FC port login failed, leaving the port state as 'Bypassed' instead of 'Online', and users had to reboot the operating system. This update fixes the driver to avoid the permanent stop of the request queue. As a result, SCSI device now continues working as expected after power cycling the FC switch.
(BZ#1519857)

* Previously, on final close or unlink of a file, the find_get_pages() function in the memory management sometimes found no pages even if there were some pages left to save. Consequently, a kernel crash occurred when attempting to enter the unlink() function. This update fixes the find_get_pages() function in the memory management code to not return 0 too early. As a result, the kernel no longer crashes due to this behavior.(BZ# 1527811)

* Using IPsec connections under a heavy load could previously lead to a network performance degradation, especially when using the aesni-intel module. This update fixes the issue by making the cryptd queue length configurable so that it can be increased to prevent an overflow and packet drop. As a result, using IPsec under a heavy load no longer reduces network performance. (BZ#1527802)

* Previously, a deadlock in the bnx2fc driver caused all adapters to block and the SCSI error handler to become unresponsive. As a result, data transferring through the adapter was sometimes blocked. This update fixes bnx2fc, and data transferring through the adapter is no longer blocked due to this behavior. (BZ#1523783)

* If an NFSv3 client mounted a subdirectory of an exported file system, a directory entry to the mount hosting the export was incorrectly held even after clearing the cache. Consequently, attempts to unmount the subdirectory with the umount command failed with the EBUSY error. With this update, the underlying source code has been fixed, and the unmount operation now succeeds as expected in the described situation. (BZ#1535938)

Users of kernel are advised to upgrade to these updated packages, which fix these bugs. The system must be rebooted for this update to take effect.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-3639: Information leaks using 'Memory     Disambiguation' feature in modern CPUs were mitigated,     aka 'Spectre Variant 4' (bnc#1087082). A new boot     commandline option was introduced,     'spec_store_bypass_disable', which can have following     values :

  - auto: Kernel detects whether your CPU model contains an     implementation of Speculative Store Bypass and picks the     most appropriate mitigation.

  - on: disable Speculative Store Bypass

  - off: enable Speculative Store Bypass

  - prctl: Control Speculative Store Bypass per thread via     prctl. Speculative Store Bypass is enabled for a process     by default. The state of the control is inherited on     fork.

  - seccomp: Same as 'prctl' above, but all seccomp threads     will disable SSB unless they explicitly opt out. The     default is 'seccomp', meaning programs need explicit     opt-in into the mitigation. Status can be queried via     the     /sys/devices/system/cpu/vulnerabilities/spec_store_bypas     s file, containing :

  - 'Vulnerable'

  - 'Mitigation: Speculative Store Bypass disabled'

  - 'Mitigation: Speculative Store Bypass disabled via     prctl'

  - 'Mitigation: Speculative Store Bypass disabled via prctl     and seccomp'

  - CVE-2018-1000199: An address corruption flaw was     discovered while modifying a h/w breakpoint via     'modify_user_hw_breakpoint' routine, an unprivileged     user/process could use this flaw to crash the system     kernel resulting in DoS OR to potentially escalate     privileges on a the system. (bsc#1089895)

  - CVE-2018-10675: The do_get_mempolicy function in     mm/mempolicy.c allowed local users to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via crafted system calls (bnc#1091755).

  - CVE-2017-5715: The retpoline mitigation for Spectre v2     has been enabled also for 32bit x86.

  - CVE-2017-5753: Spectre v1 mitigations have been improved     by the versions merged from the upstream kernel.

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1848-1 advisory.

  - Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized     disclosure of information to an attacker with local user access via a side-channel analysis.
    (CVE-2017-5753)

  - A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a     privileged local account can leak kernel stack information when issuing commands to the     /dev/infiniband/rdma_cm device node. While this access is unlikely to leak sensitive user information, it     can be further used to defeat existing kernel protection mechanisms. (CVE-2021-3923)

  - A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and     SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a     user privileges may crash the system or leak internal kernel information. (CVE-2021-4203)

  - In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could     lead to local escalation of privilege with System execution privileges needed. User interaction is not     needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References:
    Upstream kernel (CVE-2022-20567)

  - A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network     subcomponent in the Linux kernel. This flaw causes the system to crash. (CVE-2023-0394)

  - A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race     problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 (net: sched: fix race     condition in qdisc_graft()) not applied yet, then kernel could be affected. (CVE-2023-0590)

  - A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a     type confusion in their initialization function. While it will be often correct, as tuntap devices require     CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This     would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing     network filters. (CVE-2023-1076)

  - In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the     transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list
    -- the list head is all zeroes, this results in a NULL pointer dereference. (CVE-2023-1095)

  - Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege     Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-     after-free when 'tcf_exts_exec()' is called with the destroyed tcf_ext. A local attacker user can use this     vulnerability to elevate its privileges to root. This issue affects Linux Kernel: from 4.14 before git     commit ee059170b1f7e94e55fa6cadee544e176a6e59c2. (CVE-2023-1281)

  - A remote denial of service vulnerability was found in the Linux kernel's TIPC kernel module. The while     loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue.
    Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system     to instantly spike to 100%, causing a denial of service condition. (CVE-2023-1390)

  - A flaw was found in KVM. When calling the KVM_GET_DEBUGREGS ioctl, on 32-bit systems, there might be some     uninitialized portions of the kvm_debugregs structure that could be copied to userspace, causing an     information leak. (CVE-2023-1513)

  - cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes     indicate a TC_ACT_SHOT condition rather than valid classification results). (CVE-2023-23454)

  - atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial     of service because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition     rather than valid classification results). (CVE-2023-23455)

  - A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in     the Linux Kernel. The message from user space is not checked properly before transferring into the device.
    This flaw allows a local user to crash the system or potentially cause a denial of service.
    (CVE-2023-28328)

  - hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free     (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free     that may lead to privilege escalation. (CVE-2023-28464)

  - An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer     overflow. (CVE-2023-28772)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1293-1 advisory.

    The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

    The following security bugs were fixed:

    - CVE-2021-46925: Fixed kernel panic caused by race of smc_sock (bsc#1220466).
    - CVE-2021-47645: media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com     (bsc#1237767).
    - CVE-2021-47648: gpu: host1x: Fix a memory leak in 'host1x_remove()' (bsc#1237725).
    - CVE-2022-49046: i2c: dev: check return value when calling dev_set_name() (bsc#1237842).
    - CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup (bsc#1237903).
    - CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237918).
    - CVE-2022-49059: nfc: nci: add flush_workqueue to prevent uaf (bsc#1238007).
    - CVE-2022-49074: irqchip/gic-v3: Fix GICR_CTLR.RWP polling (bsc#1237728).
    - CVE-2022-49075: btrfs: fix qgroup reserve overflow the qgroup limit (bsc#1237733).
    - CVE-2022-49084: qede: confirm skb is allocated before using (bsc#1237751).
    - CVE-2022-49107: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error (bsc#1237973).
    - CVE-2022-49109: ceph: fix inode reference leakage in ceph_get_snapdir() (bsc#1237836).
    - CVE-2022-49119: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() (bsc#1237925).
    - CVE-2022-49120: scsi: pm8001: Fix task leak in pm8001_send_abort_all() (bsc#1237969).
    - CVE-2022-49209: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full (bsc#1238252).
    - CVE-2022-49220: dax: make sure inodes are flushed before destroy cache (bsc#1237936).
    - CVE-2022-49275: can: m_can: m_can_tx_handler(): fix use after free of skb (bsc#1238719).
    - CVE-2022-49286: tpm: use try_get_ops() in tpm-space.c (bsc#1238647).
    - CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow (bsc#1238625).
    - CVE-2022-49308: extcon: Modify extcon device to be created after driver data is set (bsc#1238654).
    - CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling (bsc#1237813).
    - CVE-2022-49344: af_unix: Fix a data-race in unix_dgram_peer_wake_me() (bsc#1237988).
    - CVE-2022-49367: net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register (bsc#1238447).
    - CVE-2022-49370: firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle (bsc#1238467).
    - CVE-2022-49372: tcp: tcp_rtx_synack() can be called from process context (bsc#1238251).
    - CVE-2022-49388: ubi: ubi_create_volume: Fix use-after-free when volume creation failed (bsc#1237934).
    - CVE-2022-49395: um: Fix out-of-bounds read in LDT setup (bsc#1237953).
    - CVE-2022-49397: phy: qcom-qmp: fix struct clk leak on probe errors (bsc#1237823).
    - CVE-2022-49404: RDMA/hfi1: Fix potential integer multiplication overflow errors (bsc#1238430).
    - CVE-2022-49416: wifi: mac80211: fix use-after-free in chanctx code (bsc#1238293).
    - CVE-2022-49433: RDMA/hfi1: Prevent use of lock before it is initialized (bsc#1238268).
    - CVE-2022-49472: net: phy: micrel: Allow probing without .driver_data (bsc#1238951).
    - CVE-2022-49488: drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock (bsc#1238600).
    - CVE-2022-49495: drm/msm/hdmi: check return value after calling platform_get_resource_byname()     (bsc#1237932).
    - CVE-2022-49497: net: remove two BUG() from skb_checksum_help() (bsc#1238946).
    - CVE-2022-49505: NFC: NULL out the dev->rfkill to prevent UAF (bsc#1238615).
    - CVE-2022-49516: ice: always check VF VSI pointer values (bsc#1238953).
    - CVE-2022-49519: ath10k: skip ath10k_halt during suspend for driver state RESTARTING (bsc#1238943).
    - CVE-2022-49524: media: pci: cx23885: Fix the error handling in cx23885_initdev() (bsc#1238949).
    - CVE-2022-49530: drm/amd/pm: fix double free in si_parse_power_table() (bsc#1238944).
    - CVE-2022-49538: ALSA: jack: Fix mutex call in snd_jack_report() (bsc#1238843).
    - CVE-2022-49544: ipw2x00: Fix potential NULL dereference in libipw_xmit() (bsc#1238721).
    - CVE-2022-49545: ALSA: usb-audio: Cancel pending work at closing a MIDI substream (bsc#1238729).
    - CVE-2022-49546: x86/kexec: Fix double-free of elf header buffer (bsc#1238750).
    - CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238787).
    - CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238789).
    - CVE-2022-49578: ip: Fix data-races around sysctl_ip_prot_sock. (bsc#1238794).
    - CVE-2022-49581: be2net: Fix buffer overflow in be_get_module_eeprom (bsc#1238540).
    - CVE-2022-49589: kABI: protect mr_ifc_count change (bsc#1238598).
    - CVE-2022-49605: igc: Reinstate IGC_REMOVED logic and implement it properly (bsc#1238433).
    - CVE-2022-49607: perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()     (bsc#1238817).
    - CVE-2022-49610: KVM: VMX: Prevent RSB underflow before vmenter (bsc#1238952).
    - CVE-2022-49619: net: sfp: fix memory leak in sfp_probe() (bsc#1239003).
    - CVE-2022-49620: net: tipc: fix possible refcount leak in tipc_sk_create() (bsc#1239002).
    - CVE-2022-49640: sysctl: Fix data races in proc_douintvec_minmax() (bsc#1237782).
    - CVE-2022-49641: sysctl: Fix data races in proc_douintvec() (bsc#1237831).
    - CVE-2022-49667: net: bonding: fix use-after-free after 802.3ad slave unbind (bsc#1238282).
    - CVE-2022-49672: net: tun: unlink NAPI from device on destruction (bsc#1238816).
    - CVE-2022-49711: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() (bsc#1238416).
    - CVE-2022-49727: ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg (bsc#1239059).
    - CVE-2022-49740: wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads     (bsc#1240233).
    - CVE-2023-52935: mm/khugepaged: fix ->anon_vma race (bsc#1240276).
    - CVE-2023-52997: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() (bsc#1240303).
    - CVE-2023-53010: bnxt: Do not read past the end of test names (bsc#1240290).
    - CVE-2023-53019: net: mdio: validate parameter addr in mdiobus_get_phy() (bsc#1240286).
    - CVE-2024-35910: kABI fix for tcp: properly terminate timers for kernel sockets (bsc#1224489).
    - CVE-2024-36968: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (bsc#1226130).
    - CVE-2024-38559: scsi: qedf: Ensure the copied buf is NUL terminated (bsc#1226785).
    - CVE-2024-41005: netpoll: Fix race condition in netpoll_owner_active (bsc#1227858).
    - CVE-2024-49571: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg     (bsc#1235733).
    - CVE-2024-49935: ACPI: PAD: fix crash in exit_round_robin() (bsc#1232370).
    - CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow (bsc#1232812).
    - CVE-2024-50269: usb: musb: sunxi: Fix accessing an released usb phy (bsc#1233458).
    - CVE-2024-53124: net: fix data-races around sk->sk_forward_alloc (bsc#1234074).
    - CVE-2024-53140: netlink: terminate outstanding dump on socket close (bsc#1234222).
    - CVE-2024-53680: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (bsc#1235715).
    - CVE-2024-56640: net/smc: fix LGR and link use-after-free issue (bsc#1235436).
    - CVE-2024-56770: net/sched: netem: account for backlog updates from child qdisc (bsc#1235637).
    - CVE-2024-57900: ila: serialize calls to nf_register_net_hooks() (bsc#1235973).
    - CVE-2024-57973: rdma/cxgb4: Prevent potential integer overflow on 32bit (bsc#1238531).
    - CVE-2024-57979: kABI workaround for pps changes (bsc#1238521).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2024-58052: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table     (bsc#1238986).
    - CVE-2024-58071: team: prevent adding a device which is already a team device lower (bsc#1238970)
    - CVE-2024-58072: wifi: rtlwifi: remove unused check_buddy_priv (bsc#1238964).
    - CVE-2024-58083: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() (bsc#1239036).
    - CVE-2025-21703: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() (bsc#1237313).
    - CVE-2025-21708: net: usb: rtl8150: enable basic endpoint checking (bsc#1239087).
    - CVE-2025-21744: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() (bsc#1238903).
    - CVE-2025-21759: ipv6: mcast: extend RCU protection in igmp6_send() (bsc#1238738).
    - CVE-2025-21760: ndisc: extend RCU protection in ndisc_send_skb() (bsc#1238763).
    - CVE-2025-21762: arp: use RCU protection in arp_xmit() (bsc#1238780).
    - CVE-2025-21763: neighbour: use RCU protection in __neigh_notify() (bsc#1237897).
    - CVE-2025-21765: ipv6: use RCU protection in ip6_default_advmss() (bsc#1237906).
    - CVE-2025-21766: ipv4: use RCU protection in __ip_rt_update_pmtu() (bsc#1238754).
    - CVE-2025-21776: USB: hub: Ignore non-compliant devices with too many configs or interfaces     (bsc#1238909).
    - CVE-2025-21782: orangefs: fix a oob in orangefs_debug_write (bsc#1239117).
    - CVE-2025-21785: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (bsc#1238747).
    - CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1238512).
    - CVE-2025-21796: nfsd: clear acl_access/acl_default after releasing them (bsc#1238716).
    - CVE-2025-21802: net: hns3: fix oops when unload drivers paralleling (bsc#1238751).
    - CVE-2025-21821: fbdev: omap: use threaded IRQ for LCD DMA (bsc#1239174).
    - CVE-2025-21831: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (bsc#1239039).
    - CVE-2025-21846: acct: perform last write from workqueue (bsc#1239508).
    - CVE-2025-21848: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() (bsc#1239479).
    - CVE-2025-21865: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl() (bsc#1239481).
    - CVE-2025-21871: tee: optee: Fix supplicant wait loop (bsc#1240183).
    - CVE-2025-21877: usbnet: gl620a: fix endpoint checking in genelink_bind() (bsc#1240172).
    - CVE-2025-21891: ipvlan: ensure network headers are in skb linear part (bsc#1240186).
    - CVE-2025-21916: usb: atm: cxacru: fix a flaw in existing endpoint checks (bsc#1240582).
    - CVE-2025-21922: ppp: Fix KMSAN uninit-value warning with bpf (bsc#1240639).
    - CVE-2025-21934: rapidio: fix an API misues when rio_add_net() fails (bsc#1240708).
    - CVE-2025-21935: rapidio: add check for rio_add_net() in rio_scan_alloc_net() (bsc#1240700).
    - CVE-2025-21969: Bluetooth: L2CAP: Fix build errors in some archs (bsc#1240784).
    - CVE-2025-21993: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (bsc#1240797).
    - CVE-2025-21996: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() (bsc#1240801).
    - CVE-2025-22007: Bluetooth: Fix error code in chan_alloc_skb_cb() (bsc#1240582).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
123420	Debian DLA-1731-2 : linux regression update (Spectre)	Nessus	Debian Local Security Checks	2019/3/28	2026/1/9	high
125753	EulerOS Virtualization 2.5.1 : kernel (EulerOS-SA-2019-1638)	Nessus	Huawei Local Security Checks	2019/6/7	2026/1/12	medium
105535	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180103) (Meltdown) (Spectre)	Nessus	Scientific Linux Local Security Checks	2018/1/4	2026/1/14	medium
105647	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0031-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/1/8	2026/1/13	high
106095	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:0115-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/1/17	2026/1/13	high
106272	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3542-1)	Nessus	Ubuntu Local Security Checks	2018/1/23	2024/8/27	medium
106834	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2018:0438-1) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/2/15	2026/1/13	high
108341	CentOS 6 : kernel (CESA-2018:0512) (Meltdown) (Spectre)	Nessus	CentOS Local Security Checks	2018/3/15	2026/1/13	medium
110035	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1368-1) (Spectre)	Nessus	SuSE Local Security Checks	2018/5/23	2026/1/13	high
174373	SUSE SLES15 / openSUSE 15 Security Update : kernel (SUSE-SU-2023:1848-1)	Nessus	SuSE Local Security Checks	2023/4/15	2023/7/14	high
234545	SUSE SLES12 Security Update : kernel (SUSE-SU-2025:1293-1)	Nessus	SuSE Local Security Checks	2025/4/17	2025/10/28	high

检测

插件搜索

high

medium

medium

high

high

medium

high

medium

high

high

high