The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4040 advisory.

    - gre: fix a possible skb leak (Eric Dumazet)  [Orabug: 26403972]  {CVE-2017-9074}
    - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074}
    - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403972]     {CVE-2017-9074}
    - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403972]     {CVE-2017-9074}
    - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403972]  {CVE-2017-9074}
    - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813390]  {CVE-2017-14106}
    - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug:
    26880517]  {CVE-2017-7482} {CVE-2017-7482}
    - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206837]     {CVE-2017-16525}
    - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206897]  {CVE-2017-16526}
    - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug:
    27206928]  {CVE-2017-16529}
    - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207240]     {CVE-2017-16531}
    - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (Alan Stern)  [Orabug: 27207983]     {CVE-2017-16535}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003139 advisory.

    The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - x86/entry/64: Don't use IST entry for #BP stack (Andy     Lutomirski) (CVE-2018-8897)

  - perf/hwbp: Simplify the perf-hwbp code, fix     documentation (Linus Torvalds) [Orabug: 27947608]     (CVE-2018-100199)

  - x86/microcode: probe CPU features on microcode update     (Ankur Arora) 

  - x86/microcode: microcode_write should not reference     boot_cpu_data (Ankur Arora) [Orabug: 27806667]

  - x86/cpufeatures: use cpu_data in     init_scattered_cpuid_flags (Ankur Arora) [Orabug:
    27806667]

  - Drivers: hv: fcopy: set .owner reference for file     operations (Joe Jin) [Orabug: 21191022]

  - ALSA: usb-audio: Kill stray URB at exiting (Takashi     Iwai) [Orabug: 27148281] (CVE-2017-16527)

  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)     [Orabug: 27207929] (CVE-2017-16533)

  - [media] cx231xx-cards: fix NULL-deref on missing     association descriptor (Johan Hovold) [Orabug: 27208072]     (CVE-2017-16536)

  - net: cdc_ether: fix divide by 0 on bad descriptors     (Bj&oslash rn Mork) [Orabug: 27215201] (CVE-2017-16649)

  - x86/microcode/intel: Extend BDW late-loading with a     revision check (Jia Zhang) [Orabug: 27343577]

  - x86/microcode/intel: Disable late loading on model 79     (Borislav Petkov) [Orabug: 27343577]

  - Bluetooth: bnep: bnep_add_connection should verify that     it's dealing with l2cap socket (Al Viro) [Orabug:
    27344793] (CVE-2017-15868)

  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)     [Orabug: 27344793] (CVE-2017-15868)

  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)     [Orabug: 27344843] (CVE-2017-0861) (CVE-2017-0861)

  - ptrace: use fsuid, fsgid, effective creds for fs access     checks (Jann Horn) [Orabug: 27364691] (CVE-2017-14140)

  - sctp: do not peel off an assoc from one netns to another     one (Xin Long) [Orabug: 27387001] (CVE-2017-15115)

  - Revert 'x86/spec_ctrl: Add 'nolfence' knob to disable     fallback for spectre_v2 mitigation' (Ankur Arora)     [Orabug: 27601787] (CVE-2017-5715)

  - Revert 'x86/spec: Add 'lfence_enabled' in sysfs' (Ankur     Arora) [Orabug: 27601787] (CVE-2017-5715)

  - Revert 'x86/mitigation/spectre_v2: Add reporting of     'lfence'' (Ankur Arora) [Orabug: 27601787]     (CVE-2017-5715)

  - x86/mitigation/spectre_v2: Add reporting of 'lfence'     (Konrad Rzeszutek Wilk) (CVE-2017-5715)

  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad     Rzeszutek Wilk) (CVE-2017-5715)

  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback     for spectre_v2 mitigation (Konrad Rzeszutek Wilk)     (CVE-2017-5715)

  - x86/spectre: bring spec_ctrl management logic closer to     UEK4 (Ankur Arora) [Orabug: 27516512] (CVE-2017-5715)

  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags     (David Woodhouse) [Orabug: 27516357] (CVE-2017-5715)

  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes     (Darren Kenny) [Orabug: 27516419] (CVE-2017-5715)

  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early     Spectre v2 microcodes (David Woodhouse) [Orabug:
    27516419] (CVE-2017-5715)

  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)     [Orabug: 27516419]

  - x86/cpu/intel: Introduce macros for Intel family numbers     (Dave Hansen) [Orabug: 27516419]

  - x86/spectre: expose 'stibp' (Konrad Rzeszutek Wilk)     [Orabug: 27516419] (CVE-2017-5715)

  - x86/speculation: Add basic IBPB (Indirect Branch     Prediction Barrier) support (David Woodhouse) [Orabug:
    27516379] (CVE-2017-5715)

  - x86/speculation: Use Indirect Branch Prediction Barrier     in context switch (Tim Chen) [Orabug: 27516379]     (CVE-2017-5715)

  - x86/spectre: fix spectre_v1 mitigation indicators (Ankur     Arora) [Orabug: 27509932] (CVE-2017-5715)

  - x86/ia32/syscall: Clear extended registers %r8-%r15     (Ankur Arora) [Orabug: 27452028] (CVE-2017-5715)

  - x86/ia32/syscall: Save full stack frame throughout the     entry code (Ankur Arora) [Orabug: 27452028]     (CVE-2017-5715)

  - x86/ia32/syscall: cleanup trailing whitespace (Ankur     Arora) [Orabug: 27452028] (CVE-2017-5715)

  - x86/syscall: Clear callee saved registers (%r12-%r15,     %rbp, %rbx) (Ankur Arora) [Orabug: 27452028]     (CVE-2017-5715)

  - x86/syscall: Save callee saved registers on syscall     entrance (Ankur Arora) [Orabug: 27452028]     (CVE-2017-5715)

  - gre: fix a possible skb leak (Eric Dumazet) [Orabug:
    26403972] (CVE-2017-9074)

  - ipv6: Fix leak in ipv6_gso_segment. (David S. Miller)     [Orabug: 26403972] (CVE-2017-9074)

  - ipv6: xfrm: Handle errors reported by     xfrm6_find_1stfragopt (Ben Hutchings) [Orabug: 26403972]     (CVE-2017-9074)

  - ipv6: Check ip6_find_1stfragopt return value properly.
    (David S. Miller) [Orabug: 26403972] (CVE-2017-9074)

  - ipv6: Prevent overrun when parsing v6 header options     (Craig Gallek) [Orabug: 26403972] (CVE-2017-9074)

  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei     Wang) [Orabug: 26813390] (CVE-2017-14106)

  - rxrpc: Fix several cases where a padded len isn't     checked in ticket decode (David Howells) [Orabug:
    26880517] (CVE-2017-7482) (CVE-2017-7482)

  - xen/mmu: Call xen_cleanhighmap with 4MB aligned for page     tables mapping (Zhenzhong Duan) [Orabug: 26883322]

  - KVM: x86: fix deadlock in clock-in-progress request     handling (Marcelo Tosatti) [Orabug: 27065995]

  - ocfs2: fstrim: Fix start offset of first cluster group     during fstrim (Ashish Samant) [Orabug: 27099835]

  - USB: serial: console: fix use-after-free after failed     setup (Johan Hovold) [Orabug: 27206837] (CVE-2017-16525)

  - uwb: properly check kthread_run return value (Andrey     Konovalov) [Orabug: 27206897] (CVE-2017-16526)

  - ALSA: usb-audio: Check out-of-bounds access by corrupted     buffer descriptor (Takashi Iwai) [Orabug: 27206928]     (CVE-2017-16529)

  - USB: fix out-of-bounds in usb_set_configuration (Greg     Kroah-Hartman) [Orabug: 27207240] (CVE-2017-16531)

  - USB: core: fix out-of-bounds access bug in     usb_get_bos_descriptor (Alan Stern) [Orabug: 27207983]     (CVE-2017-16535)

  - dccp: CVE-2017-8824: use-after-free in DCCP code     (Mohamed Ghannam) [Orabug: 27290301] (CVE-2017-8824)

The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages (bnc#1069702 1069708).

  - CVE-2017-1000405: The Linux Kernel had a problematic use     of pmd_mkdirty() in the touch_pmd() function inside the     THP implementation. touch_pmd() could be reached by     get_user_pages(). In such case, the pmd would become     dirty. This scenario breaks the new     can_follow_write_pmd()'s logic - pmd could become dirty     without going through a COW cycle. This bug was not as     severe as the original 'Dirty cow' because an ext4 file     (or any other regular file) could not be mapped using     THP. Nevertheless, it did allow us to overwrite     read-only huge pages. For example, the zero huge page     and sealed shmem files could be overwritten (since their     mapping could be populated using THP). Note that after     the first write page-fault to the zero page, it will be     replaced with a new fresh (and zeroed) thp (bnc#1069496     1070307).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c in the Linux kernel, when CONFIG_X86_X32 is     enabled, allowed local users to gain privileges via a     recvmmsg system call with a crafted timeout pointer     parameter (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067086).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations     (bnc#1066192).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067085).

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1066700).

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference     (bnc#1066705).

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor     (bnc#1066671).

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device (bnc#1066650).

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup (bnc#1066618).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066625).

  - CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2)     allowed reinstallation of the Group Temporal Key (GTK)     during the group key handshake, allowing an attacker     within radio range to replay frames from access points     to clients (bnc#1063667).

  - CVE-2017-15274: security/keys/keyctl.c in the Linux     kernel did not consider the case of a NULL payload in     conjunction with a nonzero length value, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192 (bnc#1045327).

  - CVE-2017-15265: Race condition in the ALSA subsystem in     the Linux kernel allowed local users to cause a denial     of service (use-after-free) or possibly have unspecified     other impact via crafted /dev/snd/seq ioctl calls,     related to sound/core/seq/seq_clientmgr.c and     sound/core/seq/seq_ports.c (bnc#1062520).

  - CVE-2017-14489: The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     allowed local users to cause a denial of service (panic)     by leveraging incorrect length validation (bnc#1059051).

  - CVE-2017-14340: The XFS_IS_REALTIME_INODE macro in     fs/xfs/xfs_linux.h in the Linux kernel did not verify     that a filesystem has a realtime device, which allowed     local users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory (bnc#1058524).

  - CVE-2017-14140: The move_pages system call in     mm/migrate.c in the Linux kernel doesn't check the     effective uid of the target process, enabling a local     attacker to learn the memory layout of a setuid     executable despite ASLR (bnc#1057179).

  - CVE-2017-14051: An integer overflow in the     qla2x00_sysfs_write_optrom_ctl function in     drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel     allowed local users to cause a denial of service (memory     corruption and system crash) by leveraging root access     (bnc#1056588).

  - CVE-2017-10661: Race condition in fs/timerfd.c in the     Linux kernel allowed local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel queueing     (bnc#1053152).

  - CVE-2017-12762: In /drivers/isdn/i4l/isdn_net.c: A     user-controlled buffer is copied into a local buffer of     constant size using strcpy without a length check which     can cause a buffer overflow. (bnc#1053148).

  - CVE-2017-8831: The saa7164_bus_get function in     drivers/media/pci/saa7164/saa7164-bus.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds array access) or possibly have     unspecified other impact by changing a certain     sequence-number value, aka a 'double fetch'     vulnerability (bnc#1037994).

  - CVE-2017-1000112: An exploitable memory corruption due     to UFO to non-UFO path switch was fixed. (bnc#1052311     bnc#1052365).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fuse: Call end_queued_requests after releasing fc->lock     in fuse_dev_release (Ashish Samant) [Orabug: 26431550]

  - rds: Fix inaccurate accounting of unsignaled wrs in     rds_ib_xmit_rdma (H&aring kon Bugge) [Orabug: 27097105]

  - rds: Fix inaccurate accounting of unsignaled wrs     (H&aring kon Bugge) 

  - rds: ib: Fix NULL pointer dereference in debug code     (H&aring kon Bugge) 

  - bnx2x: fix slowpath null crash (Zhu Yanjun) [Orabug:
    27133587]

  - rds: System panic if RDS netfilter is enabled and     RDS/TCP is used (Ka-Cheong Poon) [Orabug: 27150029]

  - USB: serial: console: fix use-after-free after failed     setup (Johan Hovold) [Orabug: 27206830] (CVE-2017-16525)

  - mlx4: Subscribe to PXM notifier (Konrad Rzeszutek Wilk)

  - xen/pci: Add PXM node notifier for PXM (NUMA) changes.
    (Konrad Rzeszutek Wilk)

  - xen/pcifront: Walk the PCI bus after XenStore     notification (Konrad Rzeszutek Wilk)

  - uwb: properly check kthread_run return value (Andrey     Konovalov) [Orabug: 27206880] (CVE-2017-16526)

  - ALSA: usb-audio: Check out-of-bounds access by corrupted     buffer descriptor (Takashi Iwai) [Orabug: 27206923]     (CVE-2017-16529)

  - USB: uas: fix bug in handling of alternate settings     (Alan Stern) [Orabug: 27206999] (CVE-2017-16530)

  - USB: fix out-of-bounds in usb_set_configuration (Greg     Kroah-Hartman) [Orabug: 27207224] (CVE-2017-16531)

  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)     [Orabug: 27207918] (CVE-2017-16533)

  - USB: core: fix out-of-bounds access bug in     usb_get_bos_descriptor (Alan Stern) [Orabug: 27207970]     (CVE-2017-16535)

  - [media] cx231xx-cards: fix NULL-deref on missing     association descriptor (Johan Hovold) [Orabug: 27208047]     (CVE-2017-16536)

  - Replace max_t with sub_positive in     dequeue_entity_load_avg (Gayatri Vasudevan) [Orabug:
    27222316]

  - sched/fair: Fix cfs_rq avg tracking underflow (Gayatri     Vasudevan) 

  - KVM: nVMX: Fix vmx_check_nested_events return value in     case an event was reinjected to L2 (Liran Alon) [Orabug:
    27250111]

  - KVM: VMX: use kvm_event_needs_reinjection (Wanpeng Li)     [Orabug: 27250111]

  - KVM: nVMX: Fix pending events injection (Wanpeng Li)     [Orabug: 27250111]

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3485-1 advisory.

    It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating     and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-15265)

    Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict     adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial     of service (system crash) or possibly execute arbitrary code. (CVE-2017-15299)

    It was discovered that a race condition existed in the packet fanout implementation in the Linux kernel. A     local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary     code. (CVE-2017-15649)

    Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys     in a negative state. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-15951)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    Andrey Konovalov discovered that the Ultra Wide Band driver in the Linux kernel did not properly check for     an error condition. A physically proximate attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16526)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel contained a use-after-free     vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-16527)

    Andrey Konovalov discovered that the ALSA subsystem in the Linux kernel did not properly validate USB     audio buffer descriptors. A physically proximate attacker could use this cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2017-16529)

    Andrey Konovalov discovered that the USB unattached storage driver in the Linux kernel contained out-of-     bounds error when handling alternative settings. A physically proximate attacker could use to cause a     denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16530)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB     interface association descriptors. A physically proximate attacker could use this to cause a denial of     service (system crash). (CVE-2017-16531)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB HID     descriptors. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16533)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate CDC     metadata. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16534)

    Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS     metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
    (CVE-2017-16535)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001316 advisory.

    The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649)

  - The keyctl_read_key function in security/keys/keyctl.c     in the Key Management subcomponent in the Linux kernel     before 4.13.5 does not properly consider that a key may     be possessed but negatively instantiated, which allows     local users to cause a denial of service (OOPS and     system crash) via a crafted KEYCTL_READ     operation.(CVE-2017-12192)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the     system.(CVE-2017-12188)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel before     4.13.10 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16534)

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel     before 4.13.8 allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

  - drivers/usb/core/config.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel before 4.13.6 allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

  - sound/core/seq_device.c in the Linux kernel before     4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16528)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8     allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16527)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6     allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mohamed Ghannam discovered that a use-after-free vulnerability existed in the Netlink subsystem (XFRM) in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16939)

It was discovered that the Linux kernel did not properly handle copy-on- write of transparent huge pages. A local attacker could use this to cause a denial of service (application crashes) or possibly gain administrative privileges. (CVE-2017-1000405)

Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-12193)

Eric Biggers discovered that the key management subsystem in the Linux kernel did not properly restrict adding a key that already exists but is uninstantiated. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
(CVE-2017-15299)

It was discovered that a NULL pointer dereference error existed in the PowerPC KVM implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-15306)

Eric Biggers discovered a race condition in the key management subsystem of the Linux kernel around keys in a negative state. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15951)

Andrey Konovalov discovered that the USB subsystem in the Linux kernel did not properly validate USB BOS metadata. A physically proximate attacker could use this to cause a denial of service (system crash).
(CVE-2017-16535)

Andrey Konovalov discovered an out-of-bounds read in the GTCO digitizer USB driver for the Linux kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-16643).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

CVE-2016-10208

Sergej Schumilo and Ralf Spenneberg discovered that a crafted ext4 filesystem could trigger memory corruption when it is mounted. A user that can provide a device or filesystem image to be mounted could use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-8824

Mohamed Ghannam discovered that the DCCP implementation did not correctly manage resources when a socket is disconnected and reconnected, potentially leading to a use-after-free. A local user could use this for denial of service (crash or data corruption) or possibly for privilege escalation. On systems that do not already have the dccp module loaded, this can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-dccp.conf install dccp false

CVE-2017-8831

Pengfei Wang discovered that the saa7164 video capture driver re-reads data from a PCI device after validating it. A physically present user able to attach a specially designed PCI device could use this for privilege escalation.

CVE-2017-12190

Vitaly Mayatskikh discovered that the block layer did not correctly count page references for raw I/O from user-space. This can be exploited by a guest VM with access to a host SCSI device for denial of service (memory exhaustion) or potentially for privilege escalation.

CVE-2017-13080

A vulnerability was found in the WPA2 protocol that could lead to reinstallation of the same Group Temporal Key (GTK), which substantially reduces the security of wifi encryption. This is one of the issues collectively known as 'KRACK'.

Updates to GTKs are usually handled by the wpa package, where this issue was already fixed (DLA-1150-1). However, some wifi devices can remain active and update GTKs autonomously while the system is suspended. The kernel must also check for and ignore key reinstallation.

CVE-2017-14051

'shqking' reported that the qla2xxx SCSI host driver did not correctly validate I/O to the 'optrom' sysfs attribute of the devices it creates. This is unlikely to have any security impact.

CVE-2017-15115

Vladis Dronov reported that the SCTP implementation did not correctly handle 'peel-off' of an association to another net namespace. This leads to a use-after-free, which a local user can exploit for denial of service (crash or data corruption) or possibly for privilege escalation. On systems that do not already have the sctp module loaded, this can be mitigated by disabling it: echo >> /etc/modprobe.d/disable-sctp.conf install sctp false

CVE-2017-15265

Michael23 Yu reported a race condition in the ALSA sequencer subsystem involving creation and deletion of ports, which could lead to a use-after-free. A local user with access to an ALSA sequencer device can use this for denial of service (crash or data loss) or possibly for privilege escalation.

CVE-2017-15299

Eric Biggers discovered that the KEYS subsystem did not correctly handle update of an uninstantiated key, leading to a null dereference.
A local user can use this for denial of service (crash).

CVE-2017-15649

'nixioaming' reported a race condition in the packet socket (AF_PACKET) implementation involving rebinding to a fanout group, which could lead to a use-after-free. A local user with the CAP_NET_RAW capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-15868

Al Viro found that the Bluebooth Network Encapsulation Protocol (BNEP) implementation did not validate the type of the second socket passed to the BNEPCONNADD ioctl(), which could lead to memory corruption. A local user with the CAP_NET_ADMIN capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-16525

Andrey Konovalov reported that the USB serial console implementation did not correctly handle disconnection of unusual serial devices, leading to a use-after-free. A similar issue was found in the case where setup of a serial console fails. A physically present user with a specially designed USB device can use this to cause a denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-16527

Andrey Konovalov reported that the USB sound mixer driver did not correctly cancel I/O in case it failed to probe a device, which could lead to a use-after-free. A physically present user with a specially designed USB device can use this to cause a denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-16529

Andrey Konovalov reported that the USB sound driver did not fully validate descriptor lengths, which could lead to a buffer over-read. A physically present user with a specially designed USB device may be able to use this to cause a denial of service (crash).

CVE-2017-16531

Andrey Konovalov reported that the USB core did not validate IAD lengths, which could lead to a buffer over-read. A physically present user with a specially designed USB device may be able to use this to cause a denial of service (crash).

CVE-2017-16532

Andrey Konovalov reported that the USB test driver did not correctly handle devices with specific combinations of endpoints. A physically present user with a specially designed USB device can use this to cause a denial of service (crash).

CVE-2017-16533

Andrey Konovalov reported that the USB HID driver did not fully validate descriptor lengths, which could lead to a buffer over-read. A physically present user with a specially designed USB device may be able to use this to cause a denial of service (crash).

CVE-2017-16535

Andrey Konovalov reported that the USB core did not validate BOS descriptor lengths, which could lead to a buffer over-read. A physically present user with a specially designed USB device may be able to use this to cause a denial of service (crash).

CVE-2017-16536

Andrey Konovalov reported that the cx231xx video capture driver did not fully validate the device endpoint configuration, which could lead to a null dereference. A physically present user with a specially designed USB device can use this to cause a denial of service (crash).

CVE-2017-16537

Andrey Konovalov reported that the imon RC driver did not fully validate the device interface configuration, which could lead to a null dereference. A physically present user with a specially designed USB device can use this to cause a denial of service (crash).

CVE-2017-16643

Andrey Konovalov reported that the gtco tablet driver did not fully validate descriptor lengths, which could lead to a buffer over-read. A physically present user with a specially designed USB device may be able to use this to cause a denial of service (crash).

CVE-2017-16649

Bj&oslash;rn Mork found that the cdc_ether network driver did not validate the device's maximum segment size, potentially leading to a division by zero. A physically present user with a specially designed USB device can use this to cause a denial of service (crash).

CVE-2017-16939

Mohamed Ghannam reported (through Beyond Security's SecuriTeam Secure Disclosure program) that the IPsec (xfrm) implementation did not correctly handle some failure cases when dumping policy information through netlink. A local user with the CAP_NET_ADMIN capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation.

CVE-2017-1000407

Andrew Honig reported that the KVM implementation for Intel processors allowed direct access to host I/O port 0x80, which is not generally safe. On some systems this allows a guest VM to cause a denial of service (crash) of the host.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.96-2. This version also includes bug fixes from upstream versions up to and including 3.2.96. It also fixes some regressions caused by the fix for CVE-2017-1000364, which was included in DLA-993-1.

We recommend that you upgrade your linux packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel before 4.13.10 allows     local users to cause a denial of service (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device. (CVE-2017-16535)

Note that Nessus relies on the presence of the package as reported by the vendor.

The SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-16939: The XFRM dump policy implementation in     net/xfrm/xfrm_user.c in the Linux kernel allowed local     users to gain privileges or cause a denial of service     (use-after-free) via a crafted SO_RCVBUF setsockopt     system call in conjunction with XFRM_MSG_GETPOLICY     Netlink messages. (bnc#1069702)

  - CVE-2017-1000405: mm, thp: do not dirty huge pages on     read fault (bnc#1069496).

  - CVE-2017-16649: The usbnet_generic_cdc_bind function in     drivers/net/usb/cdc_ether.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067085)

  - CVE-2014-0038: The compat_sys_recvmmsg function in     net/compat.c, when CONFIG_X86_X32 is enabled, allowed     local users to gain privileges via a recvmmsg system     call with a crafted timeout pointer parameter     (bnc#860993).

  - CVE-2017-16650: The qmi_wwan_bind function in     drivers/net/usb/qmi_wwan.c in the Linux kernel allowed     local users to cause a denial of service (divide-by-zero     error and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1067086)

  - CVE-2017-16535: The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel allowed     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device. (bnc#1066700)

  - CVE-2017-15102: The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     allowed local users (who are physically proximate for     inserting a crafted USB device) to gain privileges by     leveraging a write-what-where condition that occurs     after a race condition and a NULL pointer dereference.
    (bnc#1066705)

  - CVE-2017-16531: drivers/usb/core/config.c in the Linux     kernel allowed local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION descriptor.
    (bnc#1066671)

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations.
    (bnc#1066192)

  - CVE-2017-16529: The snd_usb_create_streams function in     sound/usb/card.c in the Linux kernel allowed local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device. (bnc#1066650)

  - CVE-2017-16525: The usb_serial_console_disconnect     function in drivers/usb/serial/console.c in the Linux     kernel allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed setup. (bnc#1066618)

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device.
    (bnc#1066573)

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device.
    (bnc#1066606)

  - CVE-2017-16527: sound/usb/mixer.c in the Linux kernel     allowed local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device. (bnc#1066625)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
107051	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4040)	Nessus	Oracle Linux Local Security Checks	2018/2/28	2026/2/9	high
287244	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003139)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
109668	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0041) (Spectre)	Nessus	OracleVM Local Security Checks	2018/5/10	2024/10/10	high
105150	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3249-1) (Dirty COW)	Nessus	SuSE Local Security Checks	2017/12/11	2025/11/12	high
105172	SUSE SLES11 Security Update : kernel (SUSE-SU-2017:3265-1) (KRACK)	Nessus	SuSE Local Security Checks	2017/12/12	2025/11/12	critical
105521	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0002)	Nessus	OracleVM Local Security Checks	2018/1/4	2025/11/10	high
104716	Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-3485-1)	Nessus	Ubuntu Local Security Checks	2017/11/21	2024/8/27	high
290488	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001316)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
104911	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1292)	Nessus	Huawei Local Security Checks	2017/12/1	2025/11/13	high
105100	Ubuntu 17.10 : linux, linux-raspi2 vulnerabilities (USN-3507-1) (Dirty COW)	Nessus	Ubuntu Local Security Checks	2017/12/8	2025/11/12	high
105116	Debian DLA-1200-1 : linux security update (KRACK)	Nessus	Debian Local Security Checks	2017/12/11	2025/11/12	high
220864	Linux Distros Unpatched Vulnerability : CVE-2017-16535	Nessus	Misc.	2025/3/4	2026/7/17	medium
105020	SUSE SLES12 Security Update : kernel (SUSE-SU-2017:3210-1) (Dirty COW)	Nessus	SuSE Local Security Checks	2017/12/5	2025/11/12	high

检测

插件搜索

high

medium

high

high

critical

high

high

medium

high

high

high

medium

high