The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0151 advisory.

  - kernel: local privesc in key management (CVE-2015-8539)

  - hw: cpu: speculative execution bounds-check bypass (CVE-2017-5753)

  - kernel: keyctl_set_reqkey_keyring() leaks thread keyrings (CVE-2017-7472)

  - kernel: NULL pointer dereference due to KEYCTL_READ on negative key (CVE-2017-12192)

  - kernel: Null pointer dereference due to incorrect node-splitting in assoc_array implementation     (CVE-2017-12193)

  - kernel: Use-after-free in the af_packet.c (CVE-2017-15649)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0035 for details.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5,     when nested virtualisation is used, does not properly     traverse guest pagetable entries to resolve a guest     virtual address, which allows L1 guest OS users to     execute arbitrary code on the host OS or cause a denial     of service (incorrect index during page walking, and     host OS crash), aka an MMU potential stack buffer     overrun.(CVE-2017-12188)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - security/keys/keyctl.c in the Linux kernel before     4.11.5 does not consider the case of a NULL payload in     conjunction with a nonzero length value, which allows     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192.(CVE-2017-15274)

  - Linux kernel: heap out-of-bounds in AF_PACKET sockets.
    This new issue is analogous to previously disclosed     CVE-2016-8655. In both cases, a socket option that     changes socket state may race with safety checks in     packet_set_ring. Previously with PACKET_VERSION. This     time with PACKET_RESERVE. The solution is similar: lock     the socket for the update. This issue may be     exploitable, we did not investigate further. As this     issue affects PF_PACKET sockets, it requires     CAP_NET_RAW in the process namespace. But note that     with user namespaces enabled, any process can create a     namespace in which it has     CAP_NET_RAW.(CVE-2017-1000111)

  - Use-after-free vulnerability in the Linux kernel before     4.14-rc5 allows local users to have unspecified impact     via vectors related to /dev/snd/seq.(CVE-2017-15265)

  - net/packet/af_packet.c in the Linux kernel before     4.13.6 allows local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free, a different     vulnerability than CVE-2017-6346.(CVE-2017-15649)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel     heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0.(CVE-2017-14991)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited.

Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel packages provide software mitigation for this hardware issue at a cost of potential performance penalty. Please refer to References section for further information about this issue and the performance impact.

In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are provided.

* Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)

* Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)

* Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
(CVE-2017-5754, Important)

Red Hat would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and CVE-2017-5754.

This update also fixes the following security issues and bugs :

Space precludes documenting all of the bug fixes and enhancements included in this advisory. To see the complete list of bug fixes and enhancements, refer to the following KnowledgeBase article:
https://access.redhat.com/articles/ 3327131.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3583-1 advisory.

    It was discovered that an out-of-bounds write vulnerability existed in the Flash-Friendly File System     (f2fs) in the Linux kernel. An attacker could construct a malicious file system that, when mounted, could     cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-0750)

    It was discovered that a race condition leading to a use-after-free vulnerability existed in the ALSA PCM     subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash)     or possibly execute arbitrary code. (CVE-2017-0861)

    It was discovered that the KVM implementation in the Linux kernel allowed passthrough of the diagnostic     I/O port 0x80. An attacker in a guest VM could use this to cause a denial of service (system crash) in the     host OS. (CVE-2017-1000407)

    Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly     validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this     to cause a denial of service (system crash). (CVE-2017-12153)

    Vitaly Mayatskikh discovered that the SCSI subsystem in the Linux kernel did not properly track reference     counts when merging buffers. A local attacker could use this to cause a denial of service (memory     exhaustion). (CVE-2017-12190)

    It was discovered that the key management subsystem in the Linux kernel did not properly restrict key     reads on negatively instantiated keys. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-12192)

    It was discovered that an integer overflow existed in the sysfs interface for the QLogic 24xx+ series SCSI     driver in the Linux kernel. A local privileged attacker could use this to cause a denial of service     (system crash). (CVE-2017-14051)

    Otto Ebeling discovered that the memory manager in the Linux kernel did not properly check the effective     UID in some situations. A local attacker could use this to expose sensitive information. (CVE-2017-14140)

    It was discovered that the ATI Radeon framebuffer driver in the Linux kernel did not properly initialize a     data structure returned to user space. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14156)

    ChunYu Wang discovered that the iSCSI transport implementation in the Linux kernel did not properly     validate data structures. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-14489)

    James Patrick-Evans discovered a race condition in the LEGO USB Infrared Tower driver in the Linux kernel.
    A physically proximate attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-15102)

    ChunYu Wang discovered that a use-after-free vulnerability existed in the SCTP protocol implementation in     the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code, (CVE-2017-15115)

    It was discovered that the key management subsystem in the Linux kernel did not properly handle NULL     payloads with non-zero length values. A local attacker could use this to cause a denial of service (system     crash). (CVE-2017-15274)

    It was discovered that the Bluebooth Network Encapsulation Protocol (BNEP) implementation in the Linux     kernel did not validate the type of socket passed in the BNEPCONNADD ioctl(). A local attacker with the     CAP_NET_ADMIN privilege could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-15868)

    Andrey Konovalov discovered a use-after-free vulnerability in the USB serial console driver in the Linux     kernel. A physically proximate attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2017-16525)

    It was discovered that the netfilter passive OS fingerprinting (xt_osf) module did not properly perform     access control checks. A local attacker could improperly modify the system-wide OS fingerprint list.
    (CVE-2017-17450)

    It was discovered that the HMAC implementation did not validate the state of the underlying cryptographic     hash algorithm. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2017-17806)

    Denys Fedoryshchenko discovered a use-after-free vulnerability in the netfilter xt_TCPMSS filter of the     Linux kernel. A remote attacker could use this to cause a denial of service (system crash).
    (CVE-2017-18017)

    Gareth Evans discovered that the shm IPC subsystem in the Linux kernel did not properly restrict mapping     page zero. A local privileged attacker could use this to execute arbitrary code. (CVE-2017-5669)

    It was discovered that an integer overflow vulnerability existing in the IPv6 implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (infinite loop). (CVE-2017-7542)

    Tommi Rantala and Brad Spengler discovered that the memory manager in the Linux kernel did not properly     enforce the CONFIG_STRICT_DEVMEM protection mechanism. A local attacker with access to /dev/mem could use     this to expose sensitive information or possibly execute arbitrary code. (CVE-2017-7889)

    Mohamed Ghannam discovered a use-after-free vulnerability in the DCCP protocol implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-8824)

    Mohamed Ghannam discovered a null pointer dereference in the RDS (Reliable Datagram Sockets) protocol     implementation of the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-5333)

     discovered that a race condition existed in loop block device implementation in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-5344)

    USN-3524-1 mitigated CVE-2017-5754 (Meltdown) for the amd64 architecture in Ubuntu 14.04 LTS. This update     provides the corresponding mitigations for the ppc64el architecture.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
106330	RHEL 7 : kernel (RHSA-2018:0151)	Nessus	Red Hat Local Security Checks	2018/1/25	2024/4/27	high
109158	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0035) (Dirty COW) (Meltdown) (Spectre)	Nessus	OracleVM Local Security Checks	2018/4/19	2024/10/30	high
104296	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1271)	Nessus	Huawei Local Security Checks	2017/11/1	2021/1/6	high
106353	CentOS 7 : kernel (CESA-2018:0151) (Meltdown) (Spectre)	Nessus	CentOS Local Security Checks	2018/1/26	2019/12/31	high
107003	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-3583-1)	Nessus	Ubuntu Local Security Checks	2018/2/26	2024/10/29	critical

检测

插件搜索

high

high

high

high

critical