The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002680 advisory.

    The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of     incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of     uninitialized stack variables that may be returned to an attacker in their uninitialized state. By     manipulating the code flows that precede the handling of these configuration messages, an attacker can     also gain some control over which data will be held in the uninitialized stack variables. This can allow     him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in     this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in     L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels     which were built with the above mitigations. These are the specifics of this vulnerability: In the     function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared     without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration     parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call     that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void
    *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of     these functions the efs variable would eventually be added to the outgoing configuration request that is     being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a     configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length     that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the     uninitialized variable would be returned to the attacker (16 bytes).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003203 advisory.

    The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of     incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of     uninitialized stack variables that may be returned to an attacker in their uninitialized state. By     manipulating the code flows that precede the handling of these configuration messages, an attacker can     also gain some control over which data will be held in the uninitialized stack variables. This can allow     him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in     this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in     L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels     which were built with the above mitigations. These are the specifics of this vulnerability: In the     function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared     without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration     parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call     that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void
    *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of     these functions the efs variable would eventually be added to the outgoing configuration request that is     being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a     configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length     that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the     uninitialized variable would be returned to the attacker (16 bytes).

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3933-1 advisory.

    It was discovered that an information leak vulnerability existed in the Bluetooth implementation of the     Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information (kernel     memory). (CVE-2017-1000410)

    It was discovered that the USB serial device driver in the Linux kernel did not properly validate baud     rate settings when debugging is enabled. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-18360)

    Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound     Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service     (system crash). (CVE-2018-19824)

    Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth     implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive     information (kernel memory). (CVE-2019-3459, CVE-2019-3460)

    Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free     vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of     service (guest VM crash). (CVE-2019-6974)

    Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux     kernel, when nested virtualization is used. A local attacker could use this to expose sensitive     information (host system memory to a guest VM). (CVE-2019-7222)

    Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap     minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL     pointer dereference vulnerability. (CVE-2019-9213)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1062 advisory.

    - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430]     {CVE-2017-13166}
    - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
    - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
    - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381]     {CVE-2017-15265}
    - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543088]     {CVE-2017-18017}
    - [sound] alsa: seq: Make ioctls race-free (CVE-2018-1000004) (Jaroslav Kysela) [1537203]     {CVE-2018-1000004}
    - [x86] mm: Fix use-after-free of ldt_struct (Oleg Nesterov) [1543352] {CVE-2017-17053}
    - [net] netlink: Add netns check on taps (William Townsend) [1538738] {CVE-2017-17449}
    - [net] netfilter: xt_osf: Add missing permission checks (Florian Westphal) [1539230] {CVE-2017-17448}
    - [net] netfilter: nfnetlink_cthelper: Add missing permission checks (Florian Westphal) [1539230]     {CVE-2017-17448}
    - [powerpc] kvm: book3s: Provide information about hardware/firmware CVE workarounds (Serhii Popovych)     [1532077] {CVE-2017-5754}
    - [net] Fix double free and memory corruption in get_net_ns_by_id() (Aristeu Rozanski) [1531551]     {CVE-2017-15129}
    - [media] xc2028: avoid use after free (Torez Smith) [1402893] {CVE-2016-7913}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities:

  - Integer overflow in the aio_setup_single_vector function     in fs/aio.c in the Linux kernel 4.0 allows local users     to cause a denial of service or possibly have     unspecified other impact via a large AIO iovec. NOTE:
    this vulnerability exists because of a CVE-2012-6701     regression. (CVE-2015-8830)

  - A weakness was found in the Linux ASLR implementation.
    Any user able to running 32-bit applications in a x86     machine can disable ASLR by setting the RLIMIT_STACK     resource to unlimited. (CVE-2016-3672)

  - The xc2028_set_config function in     drivers/media/tuners/tuner-xc2028.c in the Linux kernel     before 4.6 allows local users to gain privileges or     cause a denial of service (use-after-free) via vectors     involving omission of the firmware name from a certain     data structure. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2016-7913)

  - Use-after-free vulnerability in the snd_pcm_info()     function in the ALSA subsystem in the Linux kernel     allows attackers to induce a kernel memory corruption     and possibly crash or lock up a system. Due to the     nature of the flaw, a privilege escalation cannot be     fully ruled out, although we believe it is unlikely.
    (CVE-2017-0861)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (>1024) index value. (CVE-2017-1000252)

  - Linux kernel Virtualization Module (CONFIG_KVM) for the     Intel processor family (CONFIG_KVM_INTEL) is vulnerable     to a DoS issue. It could occur if a guest was to flood     the I/O port 0x80 with write requests. A guest user     could use this flaw to crash the host kernel resulting     in DoS. (CVE-2017-1000407)

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can be     sent to an attacker leaking data in kernel address     space. (CVE-2017-1000410)

  - A race condition was found in the Linux kernel before     version 4.11-rc1 in 'fs/timerfd.c' file which allows a     local user to cause a kernel list corruption or use-     after-free via simultaneous operations with a file     descriptor which leverage improper 'might_cancel'     queuing. An unprivileged local user could use this flaw     to cause a denial of service of the system. Due to the     nature of the flaw, privilege escalation cannot be fully     ruled out, although we believe it is unlikely.
    (CVE-2017-10661)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization (nVMX) feature     enabled (nested=1), is vulnerable to a crash due to     disabled external interrupts. As L2 guest could access     (r/w) hardware CR8 register of the host(L0). In a nested     visualization setup, L2 guest user could use this flaw     to potentially crash the host(L0) resulting in DoS.
    (CVE-2017-12154)

  - It was found that in the Linux kernel through v4.14-rc5,     bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'     do unbalanced pages refcounting if IO vector has small     consecutive buffers belonging to the same page.
    bio_add_pc_page() merges them into one, but the page     reference is never dropped, causing a memory leak and     possible system lockup due to out-of-memory condition.
    (CVE-2017-12190)

  - A flaw was found in the Linux kernel's implementation of     valid_master_desc() in which a memory buffer would be     compared to a userspace value with an incorrect size of     comparison. By bruteforcing the comparison, an attacker     could determine what was in memory after the description     and possibly obtain sensitive information from kernel     memory. (CVE-2017-13305)

  - A use-after-free vulnerability was found in a network     namespaces code affecting the Linux kernel since     v4.0-rc1 through v4.15-rc5. The function     get_net_ns_by_id() does not check for the net::count     value after it has found a peer network in netns_ids idr     which could lead to double free and memory corruption.
    This vulnerability could allow an unprivileged local     user to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     it is thought to be unlikely. (CVE-2017-15129)

  - A use-after-free vulnerability was found when issuing an     ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption or     possibly privilege escalation. (CVE-2017-15265)

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel oops).
    (CVE-2017-15274)

  - The net/netfilter/nfnetlink_cthelper.c function in the     Linux kernel through 4.14.4 does not require the     CAP_NET_ADMIN capability for new, get, and del     operations. This allows local users to bypass intended     access restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces.
    (CVE-2017-17448)

  - The __netlink_deliver_tap_skb function in     net/netlink/af_netlink.c in the Linux kernel, through     4.14.4, does not restrict observations of Netlink     messages to a single net namespace, when CONFIG_NLMON is     enabled. This allows local users to obtain sensitive     information by leveraging the CAP_NET_ADMIN capability     to sniff an nlmon interface for all Netlink activity on     the system. (CVE-2017-17449)

  - The usb_destroy_configuration() function, in     'drivers/usb/core/config.c' in the USB core subsystem,     in the Linux kernel through 4.14.5 does not consider the     maximum number of configurations and interfaces before     attempting to release resources. This allows local users     to cause a denial of service, due to out-of-bounds write     access, or possibly have unspecified other impact via a     crafted USB device. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2017-17558)

  - The Salsa20 encryption algorithm in the Linux kernel,     before 4.14.8, does not correctly handle zero-length     inputs. This allows a local attacker the ability to use     the AF_ALG-based skcipher interface to cause a denial of     service (uninitialized-memory free and kernel crash) or     have an unspecified other impact by executing a crafted     sequence of system calls that use the blkcipher_walk     API. Both the generic implementation     (crypto/salsa20_generic.c) and x86 implementation     (arch/x86/crypto/salsa20_glue.c) of Salsa20 are     vulnerable. (CVE-2017-17805)

  - The tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c in the Linux kernel before     4.11, and 4.9.x before 4.9.36, allows remote attackers     to cause a denial of service (use-after-free and memory     corruption) or possibly have unspecified other impact by     leveraging the presence of xt_TCPMSS in an iptables     action. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely. (CVE-2017-18017)

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with CAP_SYS_ADMIN     capability) can directly perform the ioctl operations     for dm device creation and removal and this would     typically be outside the direct control of the     unprivileged attacker. (CVE-2017-18203)

  - The madvise_willneed function in the Linux kernel allows     local users to cause a denial of service (infinite loop)     by triggering use of MADVISE_WILLNEED for a DAX mapping.
    (CVE-2017-18208)

  - A flaw was found where the kernel truncated the value     used to indicate the size of a buffer which it would     later become zero using an untruncated value. This can     corrupt memory outside of the original allocation.
    (CVE-2017-9725)

  - In the Linux kernel versions 4.12, 3.10, 2.6, and     possibly earlier, a race condition vulnerability exists     in the sound system allowing for a potential deadlock     and memory corruption due to use-after-free condition     and thus denial of service. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out,     although we believe it is unlikely. (CVE-2018-1000004)

  - Improper validation in the bnx2x network card driver of     the Linux kernel version 4.15 can allow for denial of     service (DoS) attacks via a packet with a gso_size     larger than ~9700 bytes. Untrusted guest VMs can exploit     this vulnerability in the host machine, causing a crash     in the network card. (CVE-2018-1000026)

  - By mmap()ing a FUSE-backed file onto a process's memory     containing command line arguments (or environment     strings), an attacker can cause utilities from psutils     or procps (such as ps, w) or any other program which     makes a read() call to the /proc//cmdline (or     /proc//environ) files to block indefinitely (denial     of service) or for some controlled time (as a     synchronization primitive for other attacks).
    (CVE-2018-1120)

  - A null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in the Linux kernel allows a local     user to cause a denial of service by a number of certain     crafted system calls. (CVE-2018-1130)

  - An issue was discovered in the proc_pid_stack function     in fs/proc/base.c in the Linux kernel. An attacker with     a local account can trick the stack unwinder code to     leak stack contents to userspace. The fix allows only     root to inspect the kernel stack of an arbitrary task.
    (CVE-2018-17972)

  - A flaw was found in the Linux kernel with files on tmpfs     and hugetlbfs. An attacker is able to bypass file     permissions on filesystems mounted with tmpfs/hugetlbs     to modify a file and possibly disrupt normal system     behavior. At this time there is an understanding there     is no crash or privilege escalation but the impact of     modifications on these filesystems of files in     production systems may have adverse affects.
    (CVE-2018-18397)

  - In the Linux kernel before 4.17, a local attacker able     to set attributes on an xfs filesystem could make this     filesystem non-operational until the next mount by     triggering an unchecked error condition during an xfs     attribute change, because xfs_attr_shortform_addname in     fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE     operations with conversion of an attr from short to long     form. (CVE-2018-18690)

  - A flaw was found in the Linux kernel's handling of     loopback devices. An attacker, who has permissions to     setup loopback disks, may create a denial of service or     other unspecified actions. (CVE-2018-5344)

  - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c     in the Linux kernel, through 4.14.15, allows local users     to obtain sensitive address information by reading dmesg     data from an SBS HC printk call. (CVE-2018-5750)

  - An error in the _sctp_make_chunk() function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS. (CVE-2018-5803)

  - In the function wmi_set_ie() in the Linux kernel the     length validation code does not handle unsigned integer     overflow properly. As a result, a large value of the     ie_len argument can cause a buffer overflow and thus a     memory corruption leading to a system crash or other or     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out, although     we believe it is unlikely. (CVE-2018-5848)

  - ALSA sequencer core initializes the event pool on demand     by invoking snd_seq_pool_init() when the first write     happens and the pool is empty. A user can reset the pool     size manually via ioctl concurrently, and this may lead     to UAF or out-of-bound access. (CVE-2018-7566)

  - A possible memory corruption due to a type confusion was     found in the Linux kernel in the sk_clone_lock()     function in the net/core/sock.c. The possibility of     local escalation of privileges cannot be fully ruled out     for a local unprivileged attacker. (CVE-2018-9568)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - KVM: SVM: Move spec control call after restore of GS     (Thomas Gleixner) (CVE-2018-3639)

  - x86/bugs: Fix the parameters alignment and missing void     (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Make cpu_show_common static (Jiri Kosina)     (CVE-2018-3639)

  - x86/bugs: Fix __ssb_select_mitigation return type (Jiri     Kosina) (CVE-2018-3639)

  - Documentation/spec_ctrl: Do some minor cleanups     (Borislav Petkov) (CVE-2018-3639)

  - proc: Use underscores for SSBD in 'status' (Konrad     Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Rename _RDS to _SSBD (Konrad Rzeszutek Wilk)     (CVE-2018-3639)

  - x86/speculation: Make 'seccomp' the default mode for     Speculative Store Bypass (Kees Cook) (CVE-2018-3639)

  - seccomp: Move speculation migitation control to arch     code (Thomas Gleixner) (CVE-2018-3639)

  - seccomp: Add filter flag to opt-out of SSB mitigation     (Kees Cook) (CVE-2018-3639)

  - seccomp: Use PR_SPEC_FORCE_DISABLE (Thomas Gleixner)     (CVE-2018-3639)

  - prctl: Add force disable speculation (Konrad Rzeszutek     Wilk) (CVE-2018-3639)

  - seccomp: Enable speculation flaw mitigations (Kees Cook)     (CVE-2018-3639)

  - proc: Provide details on speculation flaw mitigations     (Kees Cook) (CVE-2018-3639)

  - nospec: Allow getting/setting on non-current task (Kees     Cook) (CVE-2018-3639)

  - x86/bugs/IBRS: Disable SSB (RDS) if IBRS is sslected for     spectre_v2. (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/speculation: Add prctl for Speculative Store Bypass     mitigation (Thomas Gleixner) (CVE-2018-3639)

  - x86: thread_info.h: move RDS from index 5 to 23 (Mihai     Carabas) (CVE-2018-3639)

  - x86/process: Allow runtime control of Speculative Store     Bypass (Thomas Gleixner) (CVE-2018-3639)

  - prctl: Add speculation control prctls (Thomas Gleixner)     (CVE-2018-3639)

  - x86/speculation: Create spec-ctrl.h to avoid include     hell (Thomas Gleixner) (CVE-2018-3639)

  - x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest     (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs/AMD: Add support to disable RDS on     Fam[15,16,17]h if requested (Konrad Rzeszutek Wilk)     (CVE-2018-3639)

  - x86/bugs: Whitelist allowed SPEC_CTRL MSR values (Konrad     Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs/intel: Set proper CPU features and setup RDS     (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Provide boot parameters for the     spec_store_bypass_disable mitigation (Konrad Rzeszutek     Wilk) (CVE-2018-3639)

  - x86/cpufeatures: Add X86_FEATURE_RDS (Konrad Rzeszutek     Wilk) (CVE-2018-3639)

  - x86/bugs: Expose /sys/../spec_store_bypass (Konrad     Rzeszutek Wilk) (CVE-2018-3639)

  - x86/cpu/intel: Add Knights Mill to Intel family (Piotr     Luc) (CVE-2018-3639)

  - x86/cpu: Rename Merrifield2 to Moorefield (Andy     Shevchenko) (CVE-2018-3639)

  - x86/bugs, KVM: Support the combination of guest and host     IBRS (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs/IBRS: Warn if IBRS is enabled during boot.
    (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs/IBRS: Use variable instead of defines for     enabling IBRS (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Read SPEC_CTRL MSR during boot and re-use     reserved bits (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Concentrate bug reporting into a separate     function (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs: Concentrate bug detection into a separate     function (Konrad Rzeszutek Wilk) (CVE-2018-3639)

  - x86/bugs/IBRS: Turn on IBRS in     spectre_v2_select_mitigation (Konrad Rzeszutek Wilk)     (CVE-2018-3639)

  - x86/msr: Add SPEC_CTRL_IBRS.. (Konrad Rzeszutek Wilk)     (CVE-2018-3639)

  - scsi: libfc: Revisit kref handling (Hannes Reinecke)

  - scsi: libfc: reset exchange manager during LOGO handling     (Hannes Reinecke)

  - scsi: libfc: send LOGO for PLOGI failure (Hannes     Reinecke)

  - scsi: libfc: Issue PRLI after a PRLO has been received     (Hannes Reinecke)

  - libfc: Update rport reference counting (Hannes Reinecke)

  - amd/kvm: do not intercept new MSRs for spectre v2     mitigation (Elena Ufimtseva)

  - RDS: null pointer dereference in rds_atomic_free_op     (Mohamed Ghannam) [Orabug: 27422832] (CVE-2018-5333)

  - ACPI: sbshc: remove raw pointer from printk message     (Greg Kroah-Hartman) [Orabug: 27501257] (CVE-2018-5750)

  - futex: Prevent overflow by strengthen input validation     (Li Jinyue) [Orabug: 27539548] (CVE-2018-6927)

  - net: ipv4: add support for ECMP hash policy choice     (Venkat Venkatsubra) [Orabug: 27547114]

  - net: ipv4: Consider failed nexthops in multipath routes     (David Ahern) 

  - ipv4: L3 hash-based multipath (Peter N&oslash rlund)     [Orabug: 27547114]

  - dm: fix race between dm_get_from_kobject and
    __dm_destroy (Hou Tao) [Orabug: 27677556]     (CVE-2017-18203)

  - NFS: only invalidate dentrys that are clearly invalid.
    (NeilBrown) 

  - net: Improve handling of failures on link and route     dumps (David Ahern) [Orabug: 27959177]

  - mm/mempolicy: fix use after free when calling     get_mempolicy (zhong jiang) [Orabug: 27963519]     (CVE-2018-10675)

  - drm: udl: Properly check framebuffer mmap offsets (Greg     Kroah-Hartman) [Orabug: 27963530] (CVE-2018-8781)

  - xfs: set format back to extents if     xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug:
    27963576] (CVE-2018-10323)

  - Revert 'mlx4: change the ICM table allocations to lowest     needed size' (H&aring kon Bugge) [Orabug: 27980030]

  - Bluetooth: Prevent stack info leak from the EFS element.
    (Ben Seri) [Orabug: 28030514] (CVE-2017-1000410)     (CVE-2017-1000410)

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2017-1000410: The Linux kernel was affected by an     information lea that lies in the processing of incoming     L2CAP commands - ConfigRequest, and ConfigResponse     messages. (bnc#1070535).

  - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux     kernel did not ensure that the dir value of     xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which     allowed local users to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact via an XFRM_MSG_MIGRATE xfrm Netlink     message (bnc#1050231).

  - CVE-2017-12193: The     assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel mishandled node     splitting, which allowed local users to cause a denial     of service (NULL pointer dereference and panic) via a     crafted application, as demonstrated by the keyring key     type, and key addition and link creation operations     (bnc#1066192).

  - CVE-2017-15115: The sctp_do_peeloff function in     net/sctp/socket.c in the Linux kernel did not check     whether the intended netns is used in a peel-off action,     which allowed local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system calls     (bnc#1068671).

  - CVE-2017-16528: sound/core/seq_device.c in the Linux     kernel allowed local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1066629).

  - CVE-2017-16536: The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel allowed local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB device     (bnc#1066606).

  - CVE-2017-16537: The imon_probe function in     drivers/media/rc/imon.c in the Linux kernel allowed     local users to cause a denial of service (NULL pointer     dereference and system crash) or possibly have     unspecified other impact via a crafted USB device     (bnc#1066573).

  - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function     in drivers/input/misc/ims-pcu.c in the Linux kernel     allowed local users to cause a denial of service     (ims_pcu_parse_cdc_data out-of-bounds read and system     crash) or possibly have unspecified other impact via a     crafted USB device (bnc#1067132).

  - CVE-2017-16646:
    drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux     kernel allowed local users to cause a denial of service     (BUG and system crash) or possibly have unspecified     other impact via a crafted USB device (bnc#1067105).

  - CVE-2017-16994: The walk_hugetlb_range function in     mm/pagewalk.c in the Linux kernel mishandled holes in     hugetlb ranges, which allowed local users to obtain     sensitive information from uninitialized kernel memory     via crafted use of the mincore() system call     (bnc#1069996).

  - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in     the Linux kernel did not require the CAP_NET_ADMIN     capability for new, get, and del operations, which     allowed local users to bypass intended access     restrictions because the nfnl_cthelper_list data     structure is shared across all net namespaces     (bnc#1071693).

  - CVE-2017-17449: The __netlink_deliver_tap_skb function     in net/netlink/af_netlink.c in the Linux kernel did not     restrict observations of Netlink messages to a single     net namespace, which allowed local users to obtain     sensitive information by leveraging the CAP_NET_ADMIN     capability to sniff an nlmon interface for all Netlink     activity on the system (bnc#1071694).

  - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux     kernel did not require the CAP_NET_ADMIN capability for     add_callback and remove_callback operations, which     allowed local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all net namespaces (bnc#1071695).

  - CVE-2017-7482: Fixed an overflow when decoding a krb5     principal. (bnc#1046107).

  - CVE-2017-8824: The dccp_disconnect function in     net/dccp/proto.c in the Linux kernel allowed local users     to gain privileges or cause a denial of service     (use-after-free) via an AF_UNSPEC connect system call     during the DCCP_LISTEN state (bnc#1070771).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - The assoc_array_insert_into_terminal_node function in     lib/assoc_array.c in the Linux kernel before 4.13.11     mishandles node splitting, which allows local users to     cause a denial of service (NULL pointer dereference and     panic) via a crafted application, as demonstrated by     the keyring key type, and key addition and link     creation operations.(CVE-2017-12193)

  - The bio_map_user_iov and bio_unmap_user functions in     block/bio.c in the Linux kernel before 4.13.8 do     unbalanced refcounting when a SCSI I/O vector has small     consecutive buffers belonging to the same page. The     bio_add_pc_page function merges them into one, but the     page reference is never dropped. This causes a memory     leak and possible system lockup (exploitable against     the host OS by a guest OS user, if a SCSI disk is     passed through to a virtual machine) due to an     out-of-memory condition.(CVE-2017-12190)

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102)

  - The sctp_do_peeloff function in net/sctp/socket.c in     the Linux kernel before 4.14 does not check whether the     intended netns is used in a peel-off action, which     allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via crafted system     calls.(CVE-2017-15115)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - hw: cpu: speculative execution permission faults     handling (CVE-2017-5754, Important, KVM for Power)

  - kernel: Buffer overflow in firewire driver via crafted     incoming packets (CVE-2016-8633, Important)

  - kernel: Use-after-free vulnerability in DCCP socket     (CVE-2017-8824, Important)

  - Kernel: kvm: nVMX: L2 guest could access hardware(L0)     CR8 register (CVE-2017-12154, Important)

  - kernel: v4l2: disabled memory access protection     mechanism allowing privilege escalation (CVE-2017-13166,     Important)

  - kernel: media: use-after-free in [tuner-xc2028] media     driver (CVE-2016-7913, Moderate)

  - kernel: drm/vmwgfx: fix integer overflow in     vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

  - kernel: Incorrect type conversion for size during dma     allocation (CVE-2017-9725, Moderate)

  - kernel: memory leak when merging buffers in SCSI IO     vectors (CVE-2017-12190, Moderate)

  - kernel: vfs: BUG in truncate_inode_pages_range() and     fuse client (CVE-2017-15121, Moderate)

  - kernel: Use-after-free in     userfaultfd_event_wait_completion function in     userfaultfd.c (CVE-2017-15126, Moderate)

  - kernel: net: double-free and memory corruption in     get_net_ns_by_id() (CVE-2017-15129, Moderate)

  - kernel: Use-after-free in snd_seq_ioctl_create_port()     (CVE-2017-15265, Moderate)

  - kernel: Missing capabilities check in     net/netfilter/nfnetlink_cthelper.c allows for     unprivileged access to systemwide nfnl_cthelper_list     structure (CVE-2017-17448, Moderate)

  - kernel: Missing namespace check in     net/netlink/af_netlink.c allows for network monitors to     observe systemwide activity (CVE-2017-17449, Moderate)

  - kernel: Unallocated memory access by malicious USB     device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

  - kernel: netfilter: use-after-free in     tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)

  - kernel: Race condition in     drivers/md/dm.c:dm_get_from_kobject() allows local users     to cause a denial of service (CVE-2017-18203, Moderate)

  - kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ     (CVE-2017-1000252, Moderate)

  - Kernel: KVM: DoS via write flood to I/O port 0x80     (CVE-2017-1000407, Moderate)

  - kernel: Stack information leak in the EFS element     (CVE-2017-1000410, Moderate)

  - kernel: Kernel address information leak in     drivers/acpi/sbshc.c:acpi_smbus_hc_add() function     potentially allowing KASLR bypass (CVE-2018-5750,     Moderate)

  - kernel: Race condition in sound system can lead to     denial of service (CVE-2018-1000004, Moderate)

  - kernel: multiple Low security impact security issues     (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116,     CVE-2017-15127, CVE-2018-6927, Low)

Additional Changes :

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of instructions (a commonly used performance     optimization). There are three primary variants of the     issue which differ in the way the speculative execution     can be exploited. Variant CVE-2017-5754 relies on the     fact that, on impacted microprocessors, during     speculative execution of instruction permission faults,     exception generation triggered by a faulting access is     suppressed until the retirement of the whole     instruction block. In a combination with the fact that     memory accesses may populate the cache even when the     block is being dropped and never committed (executed),     an unprivileged local attacker could use this flaw to     read privileged (kernel space) memory by conducting     targeted cache side-channel attacks. NOTE: This update     fixes the 32-bit compatibility layer on x86-64     processors, i.e. when 32-bit containers are executed on     64-bit processors.

  - A bug in the 32-bit compatibility layer of the ioctl     handling code of the v4l2 video driver in the Linux     kernel has been found. A memory protection mechanism     ensuring that user-provided buffers always point to a     userspace memory were disabled, allowing destination     address to be in a kernel space. This flaw could be     exploited by an attacker to overwrite a kernel memory     from an unprivileged userspace process, leading to     privilege escalation.

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on it.

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.

  - Linux kernel before version 4.16-rc7 is vulnerable to a     null pointer dereference in dccp_write_xmit() function     in net/dccp/output.c in that allows a local user to     cause a denial of service by a number of certain     crafted system calls.

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.

  - net/netfilter/xt_osf.c in the Linux kernel through     4.14.4 does not require the CAP_NET_ADMIN capability     for add_callback and remove_callback operations. This     allows local users to bypass intended access     restrictions because the xt_osf_fingers data structure     is shared across all network namespaces.

  - The futex_requeue function in kernel/futex.c in the     Linux kernel, before 4.14.15, might allow attackers to     cause a denial of service (integer overflow) or     possibly have unspecified other impacts by triggering a     negative wake or requeue value.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
284968	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002680)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
286946	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003203)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
123682	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3933-1)	Nessus	Ubuntu Local Security Checks	2019/4/3	2024/8/27	high
109113	Oracle Linux 7 : kernel (ELSA-2018-1062)	Nessus	Oracle Linux Local Security Checks	2018/4/18	2026/2/9	critical
127281	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0074)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	critical
110072	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0223) (Spectre)	Nessus	OracleVM Local Security Checks	2018/5/24	2026/1/12	high
105460	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3398-1)	Nessus	SuSE Local Security Checks	2017/12/26	2025/11/10	high
105046	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)	Nessus	Huawei Local Security Checks	2017/12/7	2025/11/12	high
109449	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)	Nessus	Scientific Linux Local Security Checks	2018/5/1	2026/1/13	critical
109801	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-029)	Nessus	Virtuozzo Local Security Checks	2018/5/15	2026/1/13	high

检测

插件搜索

high

high

high

critical

critical

high

high

high

critical

high