The SUSE Linux Enterprise Server 11 SP2 LTSS received a roll up update to fix several security and non-security issues.

The following security issues have been fixed :

  - CVE-2014-0055: The get_rx_bufs function in     drivers/vhost/net.c in the vhost-net subsystem in the     Linux kernel package before 2.6.32-431.11.2 on Red Hat     Enterprise Linux (RHEL) 6 does not properly handle     vhost_get_vq_desc errors, which allows guest OS users to     cause a denial of service (host OS crash) via     unspecified vectors. (bnc#870173)

  - CVE-2014-0077: drivers/vhost/net.c in the Linux kernel     before 3.13.10, when mergeable buffers are disabled,     does not properly validate packet lengths, which allows     guest OS users to cause a denial of service (memory     corruption and host OS crash) or possibly gain     privileges on the host OS via crafted packets, related     to the handle_rx and get_rx_bufs functions. (bnc#870576)

  - CVE-2014-1739: The media_device_enum_entities function     in drivers/media/media-device.c in the Linux kernel     before 3.14.6 does not initialize a certain data     structure, which allows local users to obtain sensitive     information from kernel memory by leveraging /dev/media0     read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.
    (bnc#882804)

  - CVE-2014-2706: Race condition in the mac80211 subsystem     in the Linux kernel before 3.13.7 allows remote     attackers to cause a denial of service (system crash)     via network traffic that improperly interacts with the     WLAN_STA_PS_STA state (aka power-save mode), related to     sta_info.c and tx.c. (bnc#871797)

  - CVE-2014-2851: Integer overflow in the ping_init_sock     function in net/ipv4/ping.c in the Linux kernel through     3.14.1 allows local users to cause a denial of service     (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an     improperly managed reference counter. (bnc#873374)

  - CVE-2014-3144: The (1) BPF_S_ANC_NLATTR and (2)     BPF_S_ANC_NLATTR_NEST extension implementations in the     sk_run_filter function in net/core/filter.c in the Linux     kernel through 3.14.3 do not check whether a certain     length value is sufficiently large, which allows local     users to cause a denial of service (integer underflow     and system crash) via crafted BPF instructions. NOTE:
    the affected code was moved to the __skb_get_nlattr and
    __skb_get_nlattr_nest functions before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3145: The BPF_S_ANC_NLATTR_NEST extension     implementation in the sk_run_filter function in     net/core/filter.c in the Linux kernel through 3.14.3     uses the reverse order in a certain subtraction, which     allows local users to cause a denial of service     (over-read and system crash) via crafted BPF     instructions. NOTE: the affected code was moved to the
    __skb_get_nlattr_nest function before the vulnerability     was announced. (bnc#877257)

  - CVE-2014-3917: kernel/auditsc.c in the Linux kernel     through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with     certain syscall rules, allows local users to obtain     potentially sensitive single-bit values from kernel     memory or cause a denial of service (OOPS) via a large     value of a syscall number. (bnc#880484)

  - CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux     kernel through 3.15.1 on 32-bit x86 platforms, when     syscall auditing is enabled and the sep CPU feature flag     is set, allows local users to cause a denial of service     (OOPS and system crash) via an invalid syscall number,     as demonstrated by number 1000. (bnc#883724)

  - CVE-2014-4652: Race condition in the tlv handler     functionality in the snd_ctl_elem_user_tlv function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allows local users to     obtain sensitive information from kernel memory by     leveraging /dev/snd/controlCX access. (bnc#883795)

  - CVE-2014-4653: sound/core/control.c in the ALSA control     implementation in the Linux kernel before 3.15.2 does     not ensure possession of a read/write lock, which allows     local users to cause a denial of service     (use-after-free) and obtain sensitive information from     kernel memory by leveraging /dev/snd/controlCX access.
    (bnc#883795)

  - CVE-2014-4654: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not check     authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands,     which allows local users to remove kernel controls and     cause a denial of service (use-after-free and system     crash) by leveraging /dev/snd/controlCX access for an     ioctl call. (bnc#883795)

  - CVE-2014-4655: The snd_ctl_elem_add function in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 does not properly     maintain the user_ctl_count value, which allows local     users to cause a denial of service (integer overflow and     limit bypass) by leveraging /dev/snd/controlCX access     for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl     calls. (bnc#883795)

  - CVE-2014-4656: Multiple integer overflows in     sound/core/control.c in the ALSA control implementation     in the Linux kernel before 3.15.2 allow local users to     cause a denial of service by leveraging     /dev/snd/controlCX access, related to (1) index values     in the snd_ctl_add function and (2) numid values in the     snd_ctl_remove_numid_conflict function. (bnc#883795)

  - CVE-2014-4667: The sctp_association_free function in     net/sctp/associola.c in the Linux kernel before 3.15.2     does not properly manage a certain backlog value, which     allows remote attackers to cause a denial of service     (socket outage) via a crafted SCTP packet. (bnc#885422)

  - CVE-2014-4699: The Linux kernel before 3.15.4 on Intel     processors does not properly restrict use of a     non-canonical value for the saved RIP address in the     case of a system call that does not use IRET, which     allows local users to leverage a race condition and gain     privileges, or cause a denial of service (double fault),     via a crafted application that makes ptrace and fork     system calls. (bnc#885725)

  - CVE-2014-5077: The sctp_assoc_update function in     net/sctp/associola.c in the Linux kernel through 3.15.8,     when SCTP authentication is enabled, allows remote     attackers to cause a denial of service (NULL pointer     dereference and OOPS) by starting to establish an     association between two endpoints immediately after an     exchange of INIT and INIT ACK chunks to establish an     earlier association between these endpoints in the     opposite direction. (bnc#889173)

  - CVE-2013-4299: Interpretation conflict in     drivers/md/dm-snap-persistent.c in the Linux kernel     through 3.11.6 allows remote authenticated users to     obtain sensitive information or modify data via a     crafted mapping to a snapshot block device. (bnc#846404)

The following bugs have been fixed :

  - pagecachelimit: reduce lru_lock contention for heavy     parallel reclaim (bnc#878509, bnc#864464).

  - pagecachelimit: reduce lru_lock contention for heavy     parallel reclaim kabi fixup (bnc#878509, bnc#864464).

  - ACPI / PAD: call schedule() when need_resched() is true     (bnc#866911).

  - kabi: Fix breakage due to addition of user_ctl_lock     (bnc#883795).

  - cpuset: Fix memory allocator deadlock (bnc#876590).

  - tcp: allow to disable cwnd moderation in TCP_CA_Loss     state (bnc#879921).

  - tcp: adapt selected parts of RFC 5682 and PRR logic     (bnc#879921).

  - vlan: more careful checksum features handling     (bnc#872634).

  - bonding: fix vlan_features computing (bnc#872634).

  - NFSv4: Minor cleanups for nfs4_handle_exception and     nfs4_async_handle_error (bnc#889324).

  - NFS: Do not lose sockets when nfsd shutdown races with     connection timeout (bnc#871854).

  - reiserfs: call truncate_setsize under tailpack mutex     (bnc#878115).

  - reiserfs: drop vmtruncate (bnc#878115).

  - megaraid_sas: mask off flags in ioctl path (bnc#886474).

  - block: fix race between request completion and timeout     handling (bnc#881051).

  - drivers/rtc/interface.c: fix infinite loop in     initializing the alarm (bnc#871676).

  - xfrm: check peer pointer for null before calling     inet_putpeer() (bnc#877775).

  - supported.conf: Add firewire/nosy as supported. This     driver is the replacement for the ieee1394/pcilynx     driver, which was supported.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267i1/4%0

  - fs/f2fs/segment.c in the Linux kernel allows local     users to cause a denial of service (NULL pointer     dereference and panic) by using a noflush_merge option     that triggers a NULL value for a flush_cmd_control data     structure.(CVE-2017-18241i1/4%0

  - fs/pnode.c in the Linux kernel before 4.5.4 does not     properly traverse a mount propagation tree in a certain     case involving a slave mount, which allows local users     to cause a denial of service (NULL pointer dereference     and OOPS) via a crafted series of mount system     calls.(CVE-2016-4581i1/4%0

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077i1/4%0

  - It was found that the fix for CVE-2016-9576 was     incomplete: the Linux kernel's sg implementation did     not properly restrict write operations in situations     where the KERNEL_DS option is set. A local attacker to     read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by     leveraging write access to a /dev/sg     device.(CVE-2016-10088i1/4%0

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 4.17.2. Since the page allocator does     not yield CPU resources to the owner of the oom_lock     mutex, a local unprivileged user can trivially lock up     the system forever by wasting CPU resources from the     page allocator (e.g., via concurrent page fault events)     when the global OOM killer is invoked. NOTE: the     software maintainer has not accepted certain proposed     patches, in part because of a viewpoint that 'the     underlying problem is non-trivial to     handle.'(CVE-2016-10723i1/4%0

  - A flaw was found in the way the Linux kernel's ASN.1     DER decoder processed certain certificate files with     tags of indefinite length. A local, unprivileged user     could use a specially crafted X.509 certificate DER     file to crash the system or, potentially, escalate     their privileges on the system.(CVE-2016-0758i1/4%0

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of     service.(CVE-2014-3688i1/4%0

  - A use-after-free flaw was found in the way the     ping_init_sock() function of the Linux kernel handled     the group_info reference counter. A local, unprivileged     user could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-2851i1/4%0

  - The compat_get_timex function in kernel/compat.c in the     Linux kernel before 4.16.9 allows local users to obtain     sensitive information from kernel memory via     adjtimex.(CVE-2018-11508i1/4%0

  - The cdc_parse_cdc_header() function in     'drivers/usb/core/message.c' in the Linux kernel,     before 4.13.6, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-16534i1/4%0

  - A flaw was found in the crypto subsystem of the Linux     kernel before version kernel-4.15-rc4. The 'null     skcipher' was being dropped when each af_alg_ctx was     freed instead of when the aead_tfm was freed. This can     cause the null skcipher to be freed while it is still     in use leading to a local user being able to crash the     system or possibly escalate     privileges.(CVE-2018-14619i1/4%0

  - The crypto_skcipher_init_tfm function in     crypto/skcipher.c in the Linux kernel through 4.11.2     relies on a setkey function that lacks a key-size     check, which allows local users to cause a denial of     service (NULL pointer dereference) via a crafted     application.(CVE-2017-9211i1/4%0

  - kernel/events/core.c in the performance subsystem in     the Linux kernel before 4.0 mismanages locks during     certain migrations, which allows local users to gain     privileges via a crafted application, aka Android     internal bug 30955111.(CVE-2016-6786i1/4%0

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on     it.(CVE-2017-17807i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's SCTP implementation handled authentication key     reference counting during INIT collisions. A remote     attacker could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2015-1421i1/4%0

  - The waitid implementation in kernel/exit.c in the Linux     kernel through 4.13.4 accesses rusage data structures     in unintended cases. This can allow local users to     obtain sensitive information and bypass the KASLR     protection mechanism via a crafted system     call.(CVE-2017-14954i1/4%0

  - It was found that the Linux kernel's keyring     implementation would leak memory when adding a key to a     keyring via the add_key() function. A local attacker     could use this flaw to exhaust all available memory on     the system.(CVE-2015-1333i1/4%0

  - The msm_ipc_router_close function in     net/ipc_router/ipc_router_socket.c in the ipc_router     component for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allow attackers to cause a     denial of service (NULL pointer dereference) or     possibly have unspecified other impact by triggering     failure of an accept system call for an AF_MSM_IPC     socket.(CVE-2016-5870i1/4%0

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (i1/4z1024) index value.(CVE-2017-1000252i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation :

  - CVE-2014-0196     Jiri Slaby discovered a race condition in the pty layer,     which could lead to denial of service or privilege     escalation.

  - CVE-2014-1737 / CVE-2014-1738     Matthew Daley discovered that missing input sanitising     in the FDRAWCMD ioctl and an information leak could     result in privilege escalation.

  - CVE-2014-2851     Incorrect reference counting in the ping_init_sock()     function allows denial of service or privilege     escalation.

  - CVE-2014-3122     Incorrect locking of memory can result in local denial     of service.

A flaw was discovered in the Linux kernel's pseudo tty (pty) device.
An unprivileged user could exploit this flaw to cause a denial of service (system crash) or potentially gain administrator privileges.
(CVE-2014-0196)

Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or gain administrative privileges.
(CVE-2014-3153)

Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-1738)

Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy disk module is loaded. (CVE-2014-1737)

A flaw was discovered in the handling of network packets when mergeable buffers are disabled for virtual machines in the Linux kernel. Guest OS users may exploit this flaw to cause a denial of service (host OS crash) or possibly gain privilege on the host OS.
(CVE-2014-0077)

An information leak was discovered in the netfilter subsystem of the Linux kernel. An attacker could exploit this flaw to obtain sensitive information from kernel memory. (CVE-2014-2568)

A flaw was discovered in the Linux kernel's ping sockets. An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges via a crafted application. (CVE-2014-2851)

Sasha Levin reported a bug in the Linux kernel's virtual memory management subsystem. An unprivileged local user could exploit this flaw to cause a denial of service (system crash). (CVE-2014-3122).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated kernel packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

* A flaw was found in the way the Linux kernel's futex subsystem handled the requeuing of certain Priority Inheritance (PI) futexes. A local, unprivileged user could use this flaw to escalate their privileges on the system. (CVE-2014-3153, Important)

* A use-after-free flaw was found in the way the ping_init_sock() function of the Linux kernel handled the group_info reference counter.
A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2014-2851, Important)

* Use-after-free and information leak flaws were found in the way the Linux kernel's floppy driver processed the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use these flaws to escalate their privileges on the system. (CVE-2014-1737, CVE-2014-1738, Important)

* It was found that the aio_read_events_ring() function of the Linux kernel's Asynchronous I/O (AIO) subsystem did not properly sanitize the AIO ring head received from user space. A local, unprivileged user could use this flaw to disclose random parts of the (physical) memory belonging to the kernel and/or other processes. (CVE-2014-0206, Moderate)

* An out-of-bounds memory access flaw was found in the Netlink Attribute extension of the Berkeley Packet Filter (BPF) interpreter functionality in the Linux kernel's networking implementation. A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user space via a specially crafted socket filter. (CVE-2014-3144, CVE-2014-3145, Moderate)

* An information leak flaw was found in the way the skb_zerocopy() function copied socket buffers (skb) that are backed by user-space buffers (for example vhost-net and Xen netback), potentially allowing an attacker to read data from those buffers. (CVE-2014-2568, Low)

Red Hat would like to thank Kees Cook of Google for reporting CVE-2014-3153 and Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738. Google acknowledges Pinkie Pie as the original reporter of CVE-2014-3153. The CVE-2014-0206 issue was discovered by Mateusz Guzik of Red Hat.

This update also fixes the following bugs :

* Due to incorrect calculation of Tx statistics in the qlcninc driver, running the 'ethtool -S ethX' command could trigger memory corruption.
As a consequence, running the sosreport tool, that uses this command, resulted in a kernel panic. The problem has been fixed by correcting the said statistics calculation. (BZ#1104972)

* When an attempt to create a file on the GFS2 file system failed due to a file system quota violation, the relevant VFS inode was not completely uninitialized. This could result in a list corruption error. This update resolves this problem by correctly uninitializing the VFS inode in this situation. (BZ#1097407)

* Due to a race condition in the kernel, the getcwd() system call could return '/' instead of the correct full path name when querying a path name of a file or directory. Paths returned in the '/proc' file system could also be incorrect. This problem was causing instability of various applications. The aforementioned race condition has been fixed and getcwd() now always returns the correct paths. (BZ#1099048)

In addition, this update adds the following enhancements :

* The kernel mutex code has been improved. The changes include improved queuing of the MCS spin locks, the MCS code optimization, introduction of the cancellable MCS spin locks, and improved handling of mutexes without wait locks. (BZ#1103631, BZ#1103629)

* The handling of the Virtual Memory Area (VMA) cache and huge page faults has been improved. (BZ#1103630)

All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. The system must be rebooted for this update to take effect.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001888 advisory.

    Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1     allows local users to cause a denial of service (use-after-free and system crash) or possibly gain     privileges via a crafted application that leverages an improperly managed reference counter.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The 3.13.10 stable update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2226-1 advisory.

    Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged     local user could exploit this flaw to obtain potentially sensitive information from kernel memory.
    (CVE-2014-1738)

    Matthew Daley reported a flaw in the handling of ioctl commands by the floppy disk driver in the Linux     kernel. An unprivileged local user could exploit this flaw to gain administrative privileges if the floppy     disk module is loaded. (CVE-2014-1737)

    A flaw was discovered in the handling of network packets when mergeable buffers are disabled for virtual     machines in the Linux kernel. Guest OS users may exploit this flaw to cause a denial of service (host OS     crash) or possibly gain privilege on the host OS. (CVE-2014-0077)

    Trk Edwin discovered a flaw with Xen netback driver when used with Linux configurations that do not     allow sleeping in softirq context. A guest administrator could exploit this flaw to cause a denial of     service (system crash) on the host. (CVE-2014-2580)

    A flaw was discovered in the Linux kernel's ping sockets. An unprivileged local user could exploit this     flaw to cause a denial of service (system crash) or possibly gain privileges via a crafted application.
    (CVE-2014-2851)

    Hannes Frederic Sowa reported a hash collision ordering problem in the xfs filesystem in the Linux kernel.
    A local user could exploit this flaw to cause filesystem corruption and a denial of service (oops or     panic). (CVE-2014-7283)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76557	SuSE 11.3 Security Update : Linux kernel (SAT Patch Numbers 9488 / 9491 / 9493)	Nessus	SuSE Local Security Checks	2014/7/17	2021/1/19	critical
83633	SUSE SLES11 Security Update : kernel (SUSE-SU-2014:1105-1)	Nessus	SuSE Local Security Checks	2015/5/20	2021/1/19	high
124987	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1534)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high
73971	Debian DSA-2926-1 : linux - security update	Nessus	Debian Local Security Checks	2014/5/13	2023/5/14	high
76295	Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2260-1)	Nessus	Ubuntu Local Security Checks	2014/6/28	2023/5/14	high
76901	RHEL 7 : kernel (RHSA-2014:0786)	Nessus	Red Hat Local Security Checks	2014/7/30	2022/5/25	high
286659	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001888)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/15	high
73628	Fedora 20 : kernel-3.13.10-200.fc20 (2014-5235)	Nessus	Fedora Local Security Checks	2014/4/21	2021/1/11	medium
74214	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2226-1)	Nessus	Ubuntu Local Security Checks	2014/5/28	2024/8/27	medium

检测

插件搜索

critical

high

high

high

high

high

high

medium

medium