The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4114 advisory.

    - KVM: SVM: Move spec control call after restore of GS (Thomas Gleixner)   {CVE-2018-3639}
    - x86/bugs: Fix the parameters alignment and missing void (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs: Make cpu_show_common() static (Jiri Kosina)   {CVE-2018-3639}
    - x86/bugs: Fix __ssb_select_mitigation() return type (Jiri Kosina)   {CVE-2018-3639}
    - Documentation/spec_ctrl: Do some minor cleanups (Borislav Petkov)   {CVE-2018-3639}
    - proc: Use underscores for SSBD in 'status' (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs: Rename _RDS to _SSBD (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/speculation: Make 'seccomp' the default mode for Speculative Store Bypass (Kees Cook)     {CVE-2018-3639}
    - seccomp: Move speculation migitation control to arch code (Thomas Gleixner)   {CVE-2018-3639}
    - seccomp: Add filter flag to opt-out of SSB mitigation (Kees Cook)   {CVE-2018-3639}
    - seccomp: Use PR_SPEC_FORCE_DISABLE (Thomas Gleixner)   {CVE-2018-3639}
    - prctl: Add force disable speculation (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - seccomp: Enable speculation flaw mitigations (Kees Cook)   {CVE-2018-3639}
    - proc: Provide details on speculation flaw mitigations (Kees Cook)   {CVE-2018-3639}
    - nospec: Allow getting/setting on non-current task (Kees Cook)   {CVE-2018-3639}
    - x86/bugs/IBRS: Disable SSB (RDS) if IBRS is sslected for spectre_v2. (Konrad Rzeszutek Wilk)     {CVE-2018-3639}
    - x86/speculation: Add prctl for Speculative Store Bypass mitigation (Thomas Gleixner)   {CVE-2018-3639}
    - x86: thread_info.h: move RDS from index 5 to 23 (Mihai Carabas)   {CVE-2018-3639}
    - x86/process: Allow runtime control of Speculative Store Bypass (Thomas Gleixner)   {CVE-2018-3639}
    - prctl: Add speculation control prctls (Thomas Gleixner)   {CVE-2018-3639}
    - x86/speculation: Create spec-ctrl.h to avoid include hell (Thomas Gleixner)   {CVE-2018-3639}
    - x86/KVM/VMX: Expose SPEC_CTRL Bit(2) to the guest (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs/AMD: Add support to disable RDS on Fam[15,16,17]h if requested (Konrad Rzeszutek Wilk)     {CVE-2018-3639}
    - x86/bugs: Whitelist allowed SPEC_CTRL MSR values (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs/intel: Set proper CPU features and setup RDS (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Konrad Rzeszutek Wilk)     {CVE-2018-3639}
    - x86/cpufeatures: Add X86_FEATURE_RDS (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs: Expose /sys/../spec_store_bypass (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/cpu/intel: Add Knights Mill to Intel family (Piotr Luc)   {CVE-2018-3639}
    - x86/cpu: Rename Merrifield2 to Moorefield (Andy Shevchenko)   {CVE-2018-3639}
    - x86/bugs, KVM: Support the combination of guest and host IBRS (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs/IBRS: Warn if IBRS is enabled during boot. (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs/IBRS: Use variable instead of defines for enabling IBRS (Konrad Rzeszutek Wilk)     {CVE-2018-3639}
    - x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Konrad Rzeszutek Wilk)     {CVE-2018-3639}
    - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/bugs/IBRS: Turn on IBRS in spectre_v2_select_mitigation (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - x86/msr: Add SPEC_CTRL_IBRS.. (Konrad Rzeszutek Wilk)   {CVE-2018-3639}
    - RDS: null pointer dereference in rds_atomic_free_op (Mohamed Ghannam)  [Orabug: 27422832]     {CVE-2018-5333}
    - ACPI: sbshc: remove raw pointer from printk() message (Greg Kroah-Hartman)  [Orabug: 27501257]     {CVE-2018-5750}
    - futex: Prevent overflow by strengthen input validation (Li Jinyue)  [Orabug: 27539548]  {CVE-2018-6927}
    - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao)  [Orabug: 27677556]     {CVE-2017-18203}
    - mm/mempolicy: fix use after free when calling get_mempolicy (zhong jiang)  [Orabug: 27963519]     {CVE-2018-10675}
    - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman)  [Orabug: 27963530]     {CVE-2018-8781}
    - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27963576]     {CVE-2018-10323}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-1319 advisory.

    - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
    - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562]     {CVE-2017-5754}
    - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long)     [1553283 1550599] {CVE-2017-5754}
    - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283     1550599] {CVE-2017-5754}
    - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599]     {CVE-2017-5754}
    - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
    - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long)     [1553283 1550599] {CVE-2017-5754}
    - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283     1550599] {CVE-2017-5754}
    - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
    - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
    - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432]     {CVE-2017-13166}
    - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432]     {CVE-2017-13166}
    - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091]     {CVE-2017-18017}
    - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089     1543091] {CVE-2017-18017}
    - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091]     {CVE-2017-18017}
    - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer overflow vulnerability was found in the     ring_buffer_resize() calculations in which a privileged     user can adjust the size of the ringbuffer message     size. These calculations can create an issue where the     kernel memory allocator will not allocate the correct     count of pages yet expect them to be usable. This can     lead to the ftrace() output to appear to corrupt kernel     memory and possibly be used for privileged escalation     or more likely kernel panic.(CVE-2016-9754)

  - A flaw was found in the Linux kernel's implementation     of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt()     system call. Users with non-namespace CAP_NET_ADMIN are     able to trigger this call and create a situation in     which the sockets sendbuff data size could be negative.
    This could adversely affect memory allocations and     create situations where the system could crash or cause     memory corruption.(CVE-2016-9793)

  - A use-after-free vulnerability was found in ALSA pcm     layer, which allows local users to cause a denial of     service, memory corruption, or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9794)

  - A double free vulnerability was found in netlink_dump,     which could cause a denial of service or possibly other     unspecified impact. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although we believe it is unlikely.(CVE-2016-9806)

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets are     implemented in the Linux kernel networking subsystem     handling synchronization. A local user able to open a     raw packet socket (requires the CAP_NET_RAW capability)     can use this issue to crash the     system.(CVE-2017-1000111)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

  - A stack buffer overflow flaw was found in the way the     Bluetooth subsystem of the Linux kernel processed     pending L2CAP configuration responses from a client. On     systems with the stack protection feature enabled in     the kernel (CONFIG_CC_STACKPROTECTOR=y, which is     enabled on all architectures other than s390x and     ppc64le), an unauthenticated attacker able to initiate     a connection to a system via Bluetooth could use this     flaw to crash the system. Due to the nature of the     stack protection feature, code execution cannot be     fully ruled out, although we believe it is unlikely. On     systems without the stack protection feature (ppc64le     the Bluetooth modules are not built on s390x), an     unauthenticated attacker able to initiate a connection     to a system via Bluetooth could use this flaw to     remotely execute arbitrary code on the system with ring     0 (kernel) privileges.(CVE-2017-1000251)

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (i1/4z1024) index value.(CVE-2017-1000252)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is a kernel-side mitigation which     increases the stack guard gap size from one page to 1     MiB to make successful exploitation of this issue more     difficult.(CVE-2017-1000364)

  - The Linux Kernel imposes a size restriction on the     arguments and environmental strings passed through     RLIMIT_STACK/RLIMIT_INFINITY, but does not take the     argument and environment pointers into account, which     allows attackers to bypass this     limitation.(CVE-2017-1000365)

  - The offset2lib patch as used in the Linux Kernel     contains a vulnerability that allows a PIE binary to be     execve()'ed with 1GB of arguments or environmental     strings then the stack occupies the address 0x80000000     and the PIE binary is mapped above 0x40000000     nullifying the protection of the offset2lib patch. This     affects Linux Kernel version 4.11.5 and earlier. This     is a different issue than CVE-2017-1000371. This issue     appears to be limited to i386 based     systems.(CVE-2017-1000370)

  - A flaw was found in the processing of incoming L2CAP     bluetooth commands. Uninitialized stack variables can     be sent to an attacker leaking data in kernel address     space.(CVE-2017-1000410)

  - A race condition was found in the Linux kernel before     version 4.11-rc1 in 'fs/timerfd.c' file which allows a     local user to cause a kernel list corruption or     use-after-free via simultaneous operations with a file     descriptor which leverage improper 'might_cancel'     queuing. An unprivileged local user could use this flaw     to cause a denial of service of the system. Due to the     nature of the flaw, privilege escalation cannot be     fully ruled out, although we believe it is     unlikely.(CVE-2017-10661)

  - Memory leak in the virtio_gpu_object_create function in     drivers/gpu/drm/virtio/virtgpu_object.c in the Linux     kernel through 4.11.8 allows attackers to cause a     denial of service (memory consumption) by triggering     object-initialization failures.(CVE-2017-10810)

  - The make_response function in     drivers/block/xen-blkback/blkback.c in the Linux kernel     before 4.11.8 allows guest OS users to obtain sensitive     information from host OS (or other guest OS) kernel     memory by leveraging the copying of uninitialized     padding fields in Xen block-interface response     structures, aka XSA-216.(CVE-2017-10911)

  - A use-after-free flaw was found in the Netlink     functionality of the Linux kernel networking subsystem.
    Due to the insufficient cleanup in the mq_notify     function, a local attacker could potentially use this     flaw to escalate their privileges on the     system.(CVE-2017-11176)

  - Buffer overflow in the mp_override_legacy_irq()     function in arch/x86/kernel/acpi/boot.c in the Linux     kernel through 4.12.2 allows local users to gain     privileges via a crafted ACPI table.(CVE-2017-11473)

  - The xfrm_migrate() function in the     net/xfrm/xfrm_policy.c file in the Linux kernel built     with CONFIG_XFRM_MIGRATE does not verify if the dir     parameter is less than XFRM_POLICY_MAX. This allows a     local attacker to cause a denial of service     (out-of-bounds access) or possibly have unspecified     other impact by sending a XFRM_MSG_MIGRATE netlink     message. This flaw is present in the Linux kernel since     an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up     to 4.13-rc3.(CVE-2017-11600)

  - A security flaw was discovered in     nl80211_set_rekey_data() function in the Linux kernel     since v3.1-rc1 through v4.13. This function does not     check whether the required attributes are present in a     netlink request. This request can be issued by a user     with CAP_NET_ADMIN privilege and may result in NULL     dereference and a system crash.(CVE-2017-12153)

  - Linux kernel built with the KVM visualization support     (CONFIG_KVM), with nested visualization (nVMX) feature     enabled (nested=1), is vulnerable to a crash due to     disabled external interrupts. As L2 guest could access     (r/w) hardware CR8 register of the host(L0). In a     nested visualization setup, L2 guest user could use     this flaw to potentially crash the host(L0) resulting     in DoS.(CVE-2017-12154)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the     system.(CVE-2017-12188)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4134 advisory.

    - x86/fpu: Make eager FPU default (Mihai Carabas)  [Orabug: 28156176]  {CVE-2018-3665}
    - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 27951287]  {CVE-2017-17741}     {CVE-2017-17741}
    - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989498]     {CVE-2018-10323}
    - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri)  [Orabug: 28030520]     {CVE-2017-1000410} {CVE-2017-1000410}
    - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2549}
    - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2547}     {CVE-2016-2548}
    - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2545}
    - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai)  [Orabug: 28058229]     {CVE-2016-2543}
    - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2544}
    - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov)  [Orabug: 28058229]     {CVE-2016-2384}
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]     {CVE-2018-1000199}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0654 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    The following packages have been upgraded to a later upstream version: kernel-alt (4.14.0). (BZ#1492717)

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of instructions (a commonly used performance optimization). There are three primary     variants of the issue which differ in the way the speculative execution can be exploited.

    Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted     cache side-channel attacks. (CVE-2017-5715, Important, ARM)

    Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on     the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that     memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel     attacks. (CVE-2017-5753, Important, ARM)

    Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution     of instruction permission faults, exception generation triggered by a faulting access is suppressed until     the retirement of the whole instruction block. In a combination with the fact that memory accesses may     populate the cache even when the block is being dropped and never committed (executed), an unprivileged     local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache     side-channel attacks. (CVE-2017-5754, Important, ARM)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Incorrect updates of uninstantiated keys crash the kernel (CVE-2017-15299, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Arbitrary stack overwrite causing oops via crafted signal frame (CVE-2017-1000255, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

    * kernel: Buffer overflow in mp_override_legacy_irq() (CVE-2017-11473, Low)

    * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact     (CVE-2018-6927, Low)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and     CVE-2017-5754; Vitaly Mayatskih for reporting CVE-2017-12190; Kirill Tkhai for reporting CVE-2017-15129;
    Michael Ellerman, Gustavo Romero, Breno Leitao, Paul Mackerras, and Cyril Bur for reporting     CVE-2017-1000255; and Armis Labs for reporting CVE-2017-1000410.

    Additional Changes:

    See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - hw: cpu: speculative execution permission faults     handling (CVE-2017-5754)

  - Kernel: error in exception handling leads to DoS     (CVE-2018-8897)

  - kernel: nfsd: Incorrect handling of long RPC replies     (CVE-2017-7645)

  - kernel: Use-after-free vulnerability in DCCP socket     (CVE-2017-8824)

  - kernel: v4l2: disabled memory access protection     mechanism allowing privilege escalation (CVE-2017-13166)

  - kernel: netfilter: use-after-free in     tcpmss_mangle_packet function in     net/netfilter/xt_TCPMSS.c (CVE-2017-18017)

  - kernel: Stack information leak in the EFS element     (CVE-2017-1000410)

An update for kernel is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* hw: cpu: speculative execution permission faults handling (CVE-2017-5754, x86 32-bit)

* Kernel: error in exception handling leads to DoS (CVE-2018-8897)

* kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)

* kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)

* kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166)

* kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017)

* kernel: Stack information leak in the EFS element (CVE-2017-1000410)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3431591

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-3099:04 advisory.

    * hw: cpu: speculative execution permission faults handling (CVE-2017-5754)
    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)
    * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)
    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166)
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017)
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1062 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power)

    * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important)

    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important)

    * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important)

    * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166,     Important)

    * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate)

    * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)

    * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate)

    * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate)

    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate)

    * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126,     Moderate)

    * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate)

    * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate)

    * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access     to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)

    * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe     systemwide activity (CVE-2017-17449, Moderate)

    * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558,     Moderate)

    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c     (CVE-2017-18017, Moderate)

    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of     service (CVE-2017-18203, Moderate)

    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate)

    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate)

    * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate)

    * kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially     allowing KASLR bypass (CVE-2018-5750, Moderate)

    * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate)

     * kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116,     CVE-2017-15127, CVE-2018-6927, Low)

    Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Google Project Zero for reporting     CVE-2017-5754; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting     CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for     reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schnherr (Amazon) for     reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was     discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red     Hat).

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
110071	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4114)	Nessus	Oracle Linux Local Security Checks	2018/5/24	2026/2/9	high
109629	Oracle Linux 6 : kernel (ELSA-2018-1319)	Nessus	Oracle Linux Local Security Checks	2018/5/9	2026/2/9	critical
105364	openSUSE Security Update : the Linux Kernel (openSUSE-2017-1391) (Dirty COW)	Nessus	SuSE Local Security Checks	2017/12/19	2025/11/11	high
124821	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1498)	Nessus	Huawei Local Security Checks	2019/5/13	2021/1/6	high
110583	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4134)	Nessus	Oracle Linux Local Security Checks	2018/6/18	2026/2/9	high
108942	RHEL 7 : kernel-alt (RHSA-2018:0654)	Nessus	Red Hat Local Security Checks	2018/4/10	2025/3/16	high
109643	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180508) (Meltdown)	Nessus	Scientific Linux Local Security Checks	2018/5/9	2026/1/13	critical
109655	CentOS 6 : kernel (CESA-2018:1319) (Meltdown)	Nessus	CentOS Local Security Checks	2018/5/10	2026/1/13	critical
289599	MiracleLinux 4 : kernel-2.6.32-696.28.1.el6 (AXSA:2018-3099:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	critical
108997	RHEL 7 : kernel (RHSA-2018:1062)	Nessus	Red Hat Local Security Checks	2018/4/11	2026/1/13	critical

检测

插件搜索

high

critical

high

high

high

high

critical

critical

critical

critical