According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The NFSv2 and NFSv3 server implementations in the Linux     kernel through 4.10.13 lacked certain checks for the     end of a buffer. A remote attacker could trigger a     pointer-arithmetic error or possibly cause other     unspecified impacts using crafted requests related to     fs/nfsd/nfs3xdr.c and     fs/nfsd/nfsxdr.c.(CVE-2017-7895i1/4%0

  - A flaw was found in the Linux kernel's ACPI subsystem     where a function does not flush the operand cache and     causes a kernel stack dump. This allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism when using a     specially crafted ACPI table.(CVE-2017-13695i1/4%0

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649i1/4%0

  - Race condition in kernel/ucount.c in the Linux kernel     through 4.10.2 allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via crafted system calls     that leverage certain decrement behavior that causes     incorrect interaction between put_ucounts and     get_ucounts.(CVE-2017-6874i1/4%0

  - An out-of-bounds memory access flaw, CVE-2014-7825, was     found in the syscall tracing functionality of the Linux     kernel's perf subsystem. A local, unprivileged user     could use this flaw to crash the system. Additionally,     an out-of-bounds memory access flaw, CVE-2014-7826, was     found in the syscall tracing functionality of the Linux     kernel's ftrace subsystem. On a system with ftrace     syscall tracing enabled, a local, unprivileged user     could use this flaw to crash the system, or escalate     their privileges.(CVE-2014-7825i1/4%0

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial     of service (uninitialized-memory free and kernel crash)     or have an unspecified other impact by executing a     crafted sequence of system calls that use the     blkcipher_walk API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable.(CVE-2017-17805i1/4%0

  - The msm_ipc_router_bind_control_port function in     net/ipc_router/ipc_router_core.c in the IPC router     kernel module for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, does not verify     that a port is a client port, which allows attackers to     gain privileges or cause a denial of service (race     condition and list corruption) by making many     BIND_CONTROL_PORT ioctl calls.(CVE-2016-2059i1/4%0

  - The do_remount function in fs/namespace.c in the Linux     kernel through 3.16.1 does not maintain the     MNT_LOCK_READONLY bit across a remount of a bind mount,     which allows local users to bypass an intended     read-only restriction and defeat certain sandbox     protection mechanisms via a 'mount -o remount' command     within a user namespace.(CVE-2014-5206i1/4%0

  - The ati_remote2_probe function in     drivers/input/misc/ati_remote2.c in the Linux kernel     before 4.5.1 allows physically proximate attackers to     cause a denial of service (NULL pointer dereference and     system crash) via a crafted endpoints value in a USB     device descriptor.(CVE-2016-2185i1/4%0

  - It was found that the fix for CVE-2014-3601 was     incomplete: the Linux kernel's kvm_iommu_map_pages()     function still handled IOMMU mapping failures     incorrectly. A privileged user in a guest with an     assigned host device could use this flaw to crash the     host.(CVE-2014-8369i1/4%0

  - A NULL pointer dereference was found in     net/rds/rdma.c:__rds_rdma_map() function in the Linux     kernel allowing local attackers to cause a system panic     and a denial-of-service.(CVE-2018-7492i1/4%0

  - An issue was discovered in the XFS filesystem in     fs/xfs/xfs_icache.c in the Linux kernel. There is a     NULL pointer dereference leading to a system panic in     lookup_slow() on a NULL inode-i1/4zi_ops pointer when     doing pathwalks on a corrupted xfs image. This occurs     because of a lack of proper validation that cached     inodes are free during an allocation.(CVE-2018-13093i1/4%0

  - The iowarrior_probe function in     drivers/usb/misc/iowarrior.c in the Linux kernel before     4.5.1 allows physically proximate attackers to cause a     denial of service (NULL pointer dereference and system     crash) via a crafted endpoints value in a USB device     descriptor.(CVE-2016-2188i1/4%0

  - Linux kernel built with the 802.1Q/802.1ad     VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local     Area Network(CONFIG_VXLAN) with Transparent Ethernet     Bridging(TEB) GRO support, is vulnerable to a stack     overflow issue. It could occur while receiving large     packets via GRO path, as an unlimited recursion could     unfold in both VLAN and TEB modules, leading to a stack     corruption in the kernel.(CVE-2016-7039i1/4%0

  - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in     the Linux kernel before 4.6.1 supports MSR 0x2f8, which     allows guest OS users to read or write to the     kvm_arch_vcpu data structure, and consequently obtain     sensitive information or cause a denial of service     (system crash), via a crafted ioctl     call.(CVE-2016-3713i1/4%0

  - A flaw was found in the way the Linux kernel's VFS     subsystem handled reference counting when performing     unmount operations on symbolic links. A local,     unprivileged user could use this flaw to exhaust all     available memory on the system or, potentially, trigger     a use-after-free error, resulting in a system crash or     privilege escalation.(CVE-2014-5045i1/4%0

  - The KEYS subsystem in the Linux kernel before 4.13.10     does not correctly synchronize the actions of updating     versus finding a key in the 'negative' state to avoid a     race condition, which allows local users to cause a     denial of service or possibly have unspecified other     impact via crafted system calls.(CVE-2017-15951i1/4%0

  - The skb_flow_dissect function in     net/core/flow_dissector.c in the Linux kernel through     3.12 allows remote attackers to cause a denial of     service (infinite loop) via a small value in the IHL     field of a packet with IPIP     encapsulation.(CVE-2013-4348i1/4%0

  - The Linux kernel through 3.17.4 does not properly     restrict dropping of supplemental group memberships in     certain namespace scenarios, which allows local users     to bypass intended file permissions by leveraging a     POSIX ACL containing an entry for the group category     that is more restrictive than the entry for the other     category, aka a 'negative groups' issue, related to     kernel/groups.c, kernel/uid16.c, and     kernel/user_namespace.c.(CVE-2014-8989i1/4%0

  - An infinite-loop flaw was found in the kernel. When a     local user calls the sys_writev syscall with a     specially crafted sequence of iov structs, the     fuse_fill_write_pages kernel function might never     terminate, instead continuing in a tight loop. This     process cannot be terminated and requires a     reboot.(CVE-2015-8785i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

远程 OracleVM 系统缺少解决关键安全更新的必要补丁：

  - nsfs：使用 DCACHE_RCUACCESS 标记 dentry (Cong Wang) [Orabug：28576290] (CVE-2018-5873)

  - dm crypt：添加 plain64 IV 的 middle-endian 变量 (Konrad Rzeszutek Wilk) [Orabug：28604628]

  - IB/ipoib：改进日志消息过滤 (Yuval Shaia) [Orabug：28655409]

  - IB/ipoib：修复 arp_blocked 计数器的错误更新 (Yuval Shaia) 

  - IB/ipoib：在 ACL 过滤后更新 RX 计数器 (Yuval Shaia) 

  - IB/ipoib：在添加伪标头之前过滤 RX 数据包 (Yuval Shaia) 

  - cdrom：修复 cdrom_ioctl_drive_status 中的信息泄露/OOB 读取 (Scott Bauer) [Orabug：
    28664501] (CVE-2018-16658)

  - ACPICA：acpi：acpica：修复 nseval.c 中的 acpi 操作数缓存泄漏 (Seunghun Han) [Orabug：28664577] (CVE-2017-13695)

  - uek-rpm：停用已经弃用的 CONFIG_ACPI_PROCFS_POWER (Victor Erminpour) [Orabug：28680213]

远程 Oracle Linux 6 / 7 主机上安装的程序包受到 ELSA-2018-4227 公告中提及的多个漏洞的影响。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

  - 在 Linux 内核 4.18.6 之前的版本中发现问题。本地攻击者可利用 drivers/cdrom/cdrom.c 中的 cdrom_ioctl_drive_status 的信息泄露读取内核内存，因为从未签名的 long 转换到 int 会干扰边界检查。此问题类似于 CVE-2018-10940。(CVE-2018-16658)

  - 在低于 4.11 的 Linux 内核版本的 fs/nsfs.c 中的 __ns_get_path 函数中发现一个问题。因访问文件时存在争用条件，可造成释放后使用情况。此问题还会影响 CAF 中发布的使用低于 2018 年 7 月 5 日安全修补程序级别的 Linux 内核的所有 Android 版本（Android for MSM、Firefox OS for MSM、QRD Android）。(CVE-2018-5873)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 Oracle Linux 6 / 7 主机上安装的程序包受到 ELSA-2018-4245 公告中提及的多个漏洞的影响。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

  - 在 Linux 内核 4.18.6 之前的版本中发现问题。本地攻击者可利用 drivers/cdrom/cdrom.c 中的 cdrom_ioctl_drive_status 的信息泄露读取内核内存，因为从未签名的 long 转换到 int 会干扰边界检查。此问题类似于 CVE-2018-10940。(CVE-2018-16658)

  - 在低于 4.14.7 的 Linux 内核版本中，net/rds/rdma.c 的 __rds_rdma_map() 函数中存在空指针取消引用，本地攻击者可利用此漏洞，造成系统错误和拒绝服务，此问题与 RDS_GET_MR 和 RDS_GET_MR_FOR_DEST 相关。(CVE-2018-7492)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

远程 Ubuntu 18.04 LTS 主机上安装的一个程序包受到 USN-3762-1 公告中提及的多个漏洞影响。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

  - 在版本高于 4.8 的 Linux 内核 vhost 中，vhost/vhost.c: vhost_new_msg() 函数未正确初始化虚拟客户机和主机操作系统之间所传递消息的内存。在 /dev/vhost-net 设备文件中读取数据时，本地特权用户可利用此漏洞，读取某些内核内存内容。(CVE-2018-1118)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 16.04 LTS 主机上安装的一个程序包受到 USN-3696-1 公告中提及的多个漏洞影响。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

  - 在 4.11 之前的 Linux 内核中，kernel/events/core.c 的 perf_cpu_time_max_percent_handler 函数让本地用户可以通过较大的值造成拒绝服务（整数溢出）或其他不明影响，sample-rate 计算错误即为一例。(CVE-2017-18255)

  - 在 4.11 之前的 Linux 内核中，fs/f2fs/data.c 的 __get_data_block 函数让本地用户可以通过使用 FS_IOC_FIEMAP ioctl 构建而来的 open 和 fallocate 系统调用造成拒绝服务（整数溢出和循环）。(CVE-2017-18257)

  - Linux 内核 3.18 至 4.16 版本未正确使用 dxfer_direction=SG_DXFER_FROM_DEV 和 6 字节空 cmdp 来处理 /dev/sg0 中的 SG_IO ioctl。此漏洞可导致最多将 1000 个内核堆页面复制到用户空间。此问题已在 https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 中的上游版本中修复。此问题影响的范围有限，因为用户通常无权访问 SCSI 设备。此外，Nero 用户手册建议通过执行“chmod o+r+w /dev/sg*”访问这些设备。注意：第三方对此报告的相关内容存在争议，并指出攻击者必须使用 CAP_SYS_ADMIN 和 CAP_SYS_RAWIO 功能，因此很难利用此漏洞。(CVE-2018-1000204)

  - 在 4.16 之前的 Linux 内核中，本地用户可利用 drivers/scsi/libsas/sas_scsi_host.c，通过触发某些失败情形，造成拒绝服务（ata qc 泄露）。注意：第三方对此报告的相关内容存在争议，因为只有在物理邻近攻击者拔出 SAS 主机总线适配器电缆时才会造成失败 (CVE-2018-10021)

  - 在低于 4.13 的 Linux 内核版本中，使用不明架构和编译器时，本地用户可利用 kernel/exit.c 中的 kernel_wait4 函数，通过触发尝试使用 -INT_MIN 值，造成拒绝服务。(CVE-2018-10087)

  - 在低于 4.13 的 Linux 内核版本中，使用不明架构和编译器时，本地用户可利用 kernel/signal.c 中的 kill_something_info 函数，通过 INT_MIN 参数，造成拒绝服务。(CVE-2018-10124)

  - 在使用基于 Intel 核心的微处理器的系统上，本地进程可能会利用使用 Lazy FP 状态恢复技术的系统软件，通过推测执行边信道，根据另一进程推断数据。(CVE-2018-3665)

  - 在版本低于 4.16.11、4.14.43、4.9.102 和 4.4.133 的 Linux 内核中，处理探测、断开连接和重新绑定操作时存在多个争用条件错误，利用此漏洞，攻击者可以通过发送多个 USB over IP 数据包触发释放后使用条件或空指针取消引用。(CVE-2018-5814)

  - 在 Linux 内核 4.15.7 及之前版本的 drivers/block/floppy.c 中的 fd_locked_ioctl 函数中发现一个问题。软盘驱动程序将内核指针复制到用户内存，可响应 FDGETPRM ioctl。攻击者可发送 FDGETPRM ioctl 并使用已获取的内核指针，发现内核代码和数据的位置，并绕过内核安全保护机制，例如 KASLR。(CVE-2018-7755)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

远程 Ubuntu 14.04 LTS 主机上安装的一个程序包受到 USN-3696-2 公告中提及的多个漏洞影响。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

  - 在 4.11 之前的 Linux 内核中，kernel/events/core.c 的 perf_cpu_time_max_percent_handler 函数让本地用户可以通过较大的值造成拒绝服务（整数溢出）或其他不明影响，sample-rate 计算错误即为一例。(CVE-2017-18255)

  - 在 4.11 之前的 Linux 内核中，fs/f2fs/data.c 的 __get_data_block 函数让本地用户可以通过使用 FS_IOC_FIEMAP ioctl 构建而来的 open 和 fallocate 系统调用造成拒绝服务（整数溢出和循环）。(CVE-2017-18257)

  - Linux 内核 3.18 至 4.16 版本未正确使用 dxfer_direction=SG_DXFER_FROM_DEV 和 6 字节空 cmdp 来处理 /dev/sg0 中的 SG_IO ioctl。此漏洞可导致最多将 1000 个内核堆页面复制到用户空间。此问题已在 https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 中的上游版本中修复。此问题影响的范围有限，因为用户通常无权访问 SCSI 设备。此外，Nero 用户手册建议通过执行“chmod o+r+w /dev/sg*”访问这些设备。注意：第三方对此报告的相关内容存在争议，并指出攻击者必须使用 CAP_SYS_ADMIN 和 CAP_SYS_RAWIO 功能，因此很难利用此漏洞。(CVE-2018-1000204)

  - 在 4.16 之前的 Linux 内核中，本地用户可利用 drivers/scsi/libsas/sas_scsi_host.c，通过触发某些失败情形，造成拒绝服务（ata qc 泄露）。注意：第三方对此报告的相关内容存在争议，因为只有在物理邻近攻击者拔出 SAS 主机总线适配器电缆时才会造成失败 (CVE-2018-10021)

  - 在低于 4.13 的 Linux 内核版本中，使用不明架构和编译器时，本地用户可利用 kernel/exit.c 中的 kernel_wait4 函数，通过触发尝试使用 -INT_MIN 值，造成拒绝服务。(CVE-2018-10087)

  - 在低于 4.13 的 Linux 内核版本中，使用不明架构和编译器时，本地用户可利用 kernel/signal.c 中的 kill_something_info 函数，通过 INT_MIN 参数，造成拒绝服务。(CVE-2018-10124)

  - 在使用基于 Intel 核心的微处理器的系统上，本地进程可能会利用使用 Lazy FP 状态恢复技术的系统软件，通过推测执行边信道，根据另一进程推断数据。(CVE-2018-3665)

  - 在版本低于 4.16.11、4.14.43、4.9.102 和 4.4.133 的 Linux 内核中，处理探测、断开连接和重新绑定操作时存在多个争用条件错误，利用此漏洞，攻击者可以通过发送多个 USB over IP 数据包触发释放后使用条件或空指针取消引用。(CVE-2018-5814)

  - 在 Linux 内核 4.15.7 及之前版本的 drivers/block/floppy.c 中的 fd_locked_ioctl 函数中发现一个问题。软盘驱动程序将内核指针复制到用户内存，可响应 FDGETPRM ioctl。攻击者可发送 FDGETPRM ioctl 并使用已获取的内核指针，发现内核代码和数据的位置，并绕过内核安全保护机制，例如 KASLR。(CVE-2018-7755)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Linux 内核 4.12.9 及之前版本中，drivers/acpi/acpica/nseval.c 中的 acpi_ns_evaluate() 函数未刷新操作数缓存并造成内核堆栈转储，本地用户可利用此漏洞，通过构建的 ACPI 表，从内核内存获取敏感信息并绕过 KASLR 保护机制（在内核 4.9 及之前版本中）。(CVE-2017-13695)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The 4.12.11 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4250 advisory.

    - Fix up non-directory creation in SGID directories (Linus Torvalds)  [Orabug: 28459479]  {CVE-2018-13405}
    - ALSA: seq: Make ioctls race-free (Takashi Iwai)  [Orabug: 28459730]  {CVE-2018-7566}
    - rds: CVE-2018-7492: Fix NULL pointer dereference in __rds_rdma_map (Hakon Bugge)  [Orabug: 28539910]     {CVE-2018-7492}
    - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status (Scott Bauer)  [Orabug: 28664549]     {CVE-2018-16658}
    - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (Seunghun Han)  [Orabug: 28664580]     {CVE-2017-13695}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2077-1 advisory.

  - The acpi_ns_evaluate() function in drivers/acpi/acpica/nseval.c in the Linux kernel through 4.12.9 does     not flush the operand cache and causes a kernel stack dump, which allows local users to obtain sensitive     information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a     crafted ACPI table. (CVE-2017-13695)

  - In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to     cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other     impact by inducing a high load. (CVE-2018-20784)

  - An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel     through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM     ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the     location of kernel code and data and bypass kernel security protections such as KASLR. (CVE-2018-7755)

  - In the Linux kernel 5.0.21, mounting a crafted btrfs filesystem image, performing some operations, and     unmounting can lead to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c. (CVE-2019-19377)

  - A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in     crypto/authenc.c in the IPsec Cryptographic algorithm's module, authenc. When a payload longer than 4     bytes, and is not following 4-byte alignment boundary guidelines, it causes a buffer over-read threat,     leading to a system crash. This flaw allows a local attacker with user privileges to cause a denial of     service. (CVE-2020-10769)

  - There is a flaw reported in the Linux kernel in versions before 5.9 in     drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm in Nouveau DRM subsystem. The issue     results from the lack of validating the existence of an object prior to performing operations on the     object. An attacker with a local account with a root privilege, can leverage this vulnerability to     escalate privileges and execute code in the context of the kernel. (CVE-2021-20292)

  - A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users     do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
    (CVE-2021-20321)

  - The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use     uninitialized or stale values. This initialization went too far and may under certain conditions also     overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking     persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died,     leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable.
    XSA-365 was classified to affect versions back to at least 3.11. (CVE-2021-28688)

  - Insufficient control flow management for the Intel(R) 82599 Ethernet Controllers and Adapters may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2021-33061)

  - net/nfc/llcp_sock.c in the Linux kernel before 5.12.10 allows local unprivileged users to cause a denial     of service (NULL pointer dereference and BUG) by making a getsockname call after a certain type of failure     of a bind call. (CVE-2021-38208)

  - A use-after-free flaw was found in the Linux kernel's FUSE filesystem in the way a user triggers write().
    This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in     privilege escalation. (CVE-2022-1011)

  - A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel's filesystem sub-     component. This flaw allows a local attacker with a user privilege to cause a denial of service.
    (CVE-2022-1184)

  - A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This     flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a     leak of internal kernel information. (CVE-2022-1353)

  - The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount     of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will     access the freed drm_vgem_gem_object. (CVE-2022-1419)

  - A NULL pointer dereference flaw was found in the Linux kernel's X.25 set of standardized network protocols     functionality in the way a user terminates their session using a simulated Ethernet card and continued     usage of this connection. This flaw allows a local user to crash the system. (CVE-2022-1516)

  - Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency     use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker     could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the     system. (CVE-2022-1652)

  - A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged     user to gain root privileges. The bug allows to build several exploit primitives such as kernel address     information leak, arbitrary execution, etc. (CVE-2022-1729)

  - A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use     after free both read or write when non synchronized between cleanup routine and firmware download routine.
    (CVE-2022-1734)

  - A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition     between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN     privilege to leak kernel information. (CVE-2022-1974)

  - There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by     simulating a nfc device from user-space. (CVE-2022-1975)

  - Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated     user to potentially enable information disclosure via local access. (CVE-2022-21123)

  - Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21125)

  - Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21127)

  - Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2022-21166)

  - Improper input validation for some Intel(R) Processors may allow an authenticated user to potentially     cause a denial of service via local access. (CVE-2022-21180)

  - KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown.
    An attacker with access to a serial port could trigger the debugger so it is important that the debugger     respect the lockdown mode when/if it is triggered. (CVE-2022-21499)

  - usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double     free. (CVE-2022-28388)

  - ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
    (CVE-2022-28390)

  - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-13693, CVE-2017-13694, CVE-2017-13695.

This provides fixes for the user space ACPICA tools only. Any kernel updates are handled separately.

This update also includes the upgrade to the 20190209 version of the upstream source. 

---------------------------------------- 09 February 2018. Summary of changes for version 20180209 :

1) ACPICA kernel-resident subsystem :

Completed the final integration of the recent changes to Package Object handling and the module-level AML code support. This allows forward references from individual package elements when the package object is declared from within module-level code blocks. Provides compatibility with other ACPI implementations.

The new architecture for the AML module-level code has been completed and is now the default for the ACPICA code. This new architecture executes the module-level code in-line as the ACPI table is loaded/parsed instead of the previous architecture which deferred this code until after the table was fully loaded. This solves some ASL code ordering issues and provides compatibility with other ACPI implementations. At this time, there is an option to fallback to the earlier architecture, but this support is deprecated and is planned to be completely removed later this year.

Added a compile-time option to ignore AE_NOT_FOUND exceptions during resolution of named reference elements within Package objects.
Although this is potentially a serious problem, it can generate a lot of noise/errors on platforms whose firmware carries around a bunch of unused Package objects. To disable these errors, define ACPI_IGNORE_PACKAGE_RESOLUTION_ERRORS in the OS-specific header. All errors are always reported for ACPICA applications such as AcpiExec.

Fixed a regression related to the explicit type-conversion AML operators (ToXXXX). The regression was introduced early in 2017 but was not seen until recently because these operators are not fully supported by other ACPI implementations and are thus rarely used by firmware developers. The operators are defined by the ACPI specification to not implement the 'implicit result object conversion'. The regression incorrectly introduced this object conversion for the following explicit conversion operators :

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2) iASL Compiler/Disassembler and Tools :

iASL: Fixed a problem with the compiler constant folding feature as related to the ToXXXX explicit conversion operators. These operators do not support the 'implicit result object conversion' by definition.
Thus, ASL expressions that use these operators cannot be folded to a simple Store operator because Store implements the implicit conversion. This change uses the CopyObject operator for the ToXXXX operator folding instead. CopyObject is defined to not implement implicit result conversions and is thus appropriate for folding the ToXXXX operators.

iASL: Changed the severity of an error condition to a simple warning for the case where a symbol is declared both locally and as an external symbol. This accommodates existing ASL code.

AcpiExec: The -ep option to enable the new architecture for module-level code has been removed. It is replaced by the -dp option which instead has the opposite effect: it disables the new architecture (the default) and enables the legacy architecture. When the legacy code is removed in the future, the -dp option will be removed also.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Array index error in the tcm_vhost_make_tpg function in     drivers/vhost/scsi.c in the Linux kernel before 4.0     might allow guest OS users to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl     call. NOTE: the affected function was renamed to     vhost_scsi_make_tpg before the vulnerability was     announced.(CVE-2015-4036)

  - The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3     allows local users to gain privileges or cause a denial     of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames,     leading to recursive pagefault handling.(CVE-2016-1583)

  - It was found that SCSI driver in the Linux kernel can     improperly access userspace memory outside the provided     buffer. A local privileged attacker could potentially     use this flaw to expose information from the kernel     memory.(CVE-2017-13168)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h     in the Linux kernel before 4.13.2 does not verify that     a filesystem has a realtime device, which allows local     users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory.(CVE-2017-14340)

  - The xfs_bmap_extents_to_btree function in     fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through     4.16.3 allows local users to cause a denial of service     (xfs_bmapi_write NULL pointer dereference) via a     crafted xfs image.(CVE-2018-10323)

  - A flaw was found in Linux kernel in the ext4 filesystem     code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and     operating a crafted ext4 image.(CVE-2018-10876)

  - A flaw was found in the Linux kernel ext4 filesystem.
    An out-of-bound access is possible in the     ext4_ext_drop_refs() function when operating on a     crafted ext4 filesystem image.(CVE-2018-10877)

  - The pcpu_embed_first_chunk function in mm/percpu.c in     the Linux kernel through 4.14.14 allows local users to     obtain sensitive address information by reading dmesg     data from a(CVE-2018-5995)

  - Memory leak in the irda_bind function in     net/irda/af_irda.c and later in     drivers/staging/irda/net/af_irda.c in the Linux kernel     before 4.17 allows local users to cause a denial of     service (memory consumption) by repeatedly binding an     AF_IRDA socket.(CVE-2018-6554)

  - A NULL pointer dereference was found in the     net/rds/rdma.c __rds_rdma_map() function in the Linux     kernel before 4.14.7 allowing local attackers to cause     a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST.(CVE-2018-7492)

  - ** DISPUTED ** Race condition in the     store_int_with_restart() function in     arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel     through 4.15.7 allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck<cpu     number> directory. NOTE: a third party has indicated     that this report is not security     relevant.(CVE-2018-7995)

  - Non-optimized code for key handling of shared futexes     was found in the Linux kernel in the form of unbounded     contention time due to the page lock for real-time     users. Before the fix, the page lock was an     unnecessarily heavy lock for the futex path that     protected too much. After the fix, the page lock is     only required in a specific corner case.(CVE-2018-9422)

  - A memory leak in the ccp_run_sha_cmd() function in     drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-128c66429247.(CVE-2019-18808)

  - In the Linux kernel before 5.1, there is a memory leak     in __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
124974	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1521)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
117764	OracleVM 3.4：Unbreakable /等 (OVMSA-2018-0258)	Nessus	OracleVM Local Security Checks	2018/9/27	2022/3/4	high
117769	Oracle Linux 6 / 7：Unbreakable Enterprise 内核 (ELSA-2018-4227)	Nessus	Oracle Linux Local Security Checks	2018/9/27	2024/10/22	high
118055	Oracle Linux 6 / 7：Unbreakable Enterprise 内核 (ELSA-2018-4245)	Nessus	Oracle Linux Local Security Checks	2018/10/11	2024/10/22	medium
117454	Ubuntu 18.04 LTS：Linux 内核漏洞 (USN-3762-1)	Nessus	Ubuntu Local Security Checks	2018/9/12	2024/8/27	medium
110896	Ubuntu 16.04 LTS：Linux 内核漏洞 (USN-3696-1)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/8/27	high
110897	Ubuntu 14.04 LTS：Linux 内核 (Xenial HWE) 漏洞 (USN-3696-2)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/8/28	high
220705	Linux Distros 未修补的漏洞: CVE-2017-13695	Nessus	Misc.	2025/3/4	2025/9/30	medium
103117	Fedora 26 : kernel (2017-6764d16965)	Nessus	Fedora Local Security Checks	2017/9/12	2021/1/6	medium
103151	Fedora 25 : kernel (2017-a3a8638a60)	Nessus	Fedora Local Security Checks	2017/9/13	2021/1/6	medium
118107	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2018-4250)	Nessus	Oracle Linux Local Security Checks	2018/10/15	2024/10/22	high
162232	SUSE SLES12 Security Update : kernel (SUSE-SU-2022:2077-1)	Nessus	SuSE Local Security Checks	2022/6/15	2023/7/13	critical
108777	Fedora 27 : acpica-tools (2018-7c2e0a998d)	Nessus	Fedora Local Security Checks	2018/4/2	2024/11/21	medium
141697	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-2222)	Nessus	Huawei Local Security Checks	2020/10/21	2021/1/6	high

检测

插件搜索

critical

high

high

medium

medium

high

high

medium

medium

medium

high

critical

medium

high