The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2578:02 advisory.

    An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of instructions (a commonly used performance optimization). There are three primary     variants of the issue which differ in the way the speculative execution can be exploited.
    Note: This issue is present in hardware and cannot be fully fixed via software update. The updated kernel     packages provide software mitigation for this hardware issue at a cost of potential performance penalty.
    Please refer to References section for further information about this issue and the performance impact.
    In this update initial mitigations for IBM Power (PowerPC) and IBM zSeries (S390) architectures are     provided.
      * Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It     relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the     fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall and guest/host boundaries and read privileged memory by conducting targeted     cache side-channel attacks. This fix specifically addresses S390 processors. (CVE-2017-5715, Important)
      * Variant CVE-2017-5753 triggers the speculative execution by performing a bounds-check bypass. It     relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the     fact that memory accesses may cause allocation into the microprocessor's data cache even for speculatively     executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use     this flaw to cross the syscall boundary and read privileged memory by conducting targeted cache side-     channel attacks. This fix specifically addresses S390 and PowerPC processors. (CVE-2017-5753, Important)
      * Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative     execution of instruction permission faults, exception generation triggered by a faulting access is     suppressed until the retirement of the whole instruction block. In a combination with the fact that memory     accesses may populate the cache even when the block is being dropped and never committed (executed), an     unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting     targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64     microprocessors are not affected by this issue. This fix specifically addresses PowerPC processors.
    (CVE-2017-5754, Important)     Asianux would like to thank Google Project Zero for reporting CVE-2017-5715, CVE-2017-5753, and     CVE-2017-5754.
    This update also fixes the following security issues and bugs:
    CVE-2015-8539     The KEYS subsystem in the Linux kernel before 4.4 allows local users     to gain privileges or cause a denial of service (BUG) via crafted     keyctl commands that negatively instantiate a key, related to     security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and     security/keys/user_defined.c.
    CVE-2017-12192     The keyctl_read_key function in security/keys/keyctl.c in the Key     Management subcomponent in the Linux kernel before 4.13.5 does not     properly consider that a key may be possessed but negatively     instantiated, which allows local users to cause a denial of service     (OOPS and system crash) via a crafted KEYCTL_READ operation.
    CVE-2017-12193     The assoc_array_insert_into_terminal_node function in lib/assoc_array.c     in the Linux kernel before 4.13.11 mishandles node splitting, which     allows local users to cause a denial of service (NULL pointer     dereference and panic) via a crafted application, as demonstrated by     the keyring key type, and key addition and link creation operations.
    CVE-2017-15649     net/packet/af_packet.c in the Linux kernel before 4.13.6 allows local     users to gain privileges via crafted system calls that trigger     mishandling of packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free, a different vulnerability than CVE-2017-6346.
    CVE-2017-5715     Systems with microprocessors utilizing speculative execution and     indirect branch prediction may allow unauthorized disclosure of     information to an attacker with local user access via a side-channel     analysis.
    CVE-2017-5753     Systems with microprocessors utilizing speculative execution and     branch prediction may allow unauthorized disclosure of information to     an attacker with local user access via a side-channel analysis.
    CVE-2017-5754     Systems with microprocessors utilizing speculative execution and     indirect branch prediction may allow unauthorized disclosure of     information to an attacker with local user access via a side-channel     analysis of the data cache.
    CVE-2017-7472     The KEYS subsystem in the Linux kernel before 4.10.13 allows local     users to cause a denial of service (memory consumption) via a series of     KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5,     when nested virtualisation is used, does not properly     traverse guest pagetable entries to resolve a guest     virtual address, which allows L1 guest OS users to     execute arbitrary code on the host OS or cause a denial     of service (incorrect index during page walking, and     host OS crash), aka an MMU potential stack buffer     overrun.(CVE-2017-12188)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - security/keys/keyctl.c in the Linux kernel before     4.11.5 does not consider the case of a NULL payload in     conjunction with a nonzero length value, which allows     local users to cause a denial of service (NULL pointer     dereference and OOPS) via a crafted add_key or keyctl     system call, a different vulnerability than     CVE-2017-12192.(CVE-2017-15274)

  - Linux kernel: heap out-of-bounds in AF_PACKET sockets.
    This new issue is analogous to previously disclosed     CVE-2016-8655. In both cases, a socket option that     changes socket state may race with safety checks in     packet_set_ring. Previously with PACKET_VERSION. This     time with PACKET_RESERVE. The solution is similar: lock     the socket for the update. This issue may be     exploitable, we did not investigate further. As this     issue affects PF_PACKET sockets, it requires     CAP_NET_RAW in the process namespace. But note that     with user namespaces enabled, any process can create a     namespace in which it has     CAP_NET_RAW.(CVE-2017-1000111)

  - Use-after-free vulnerability in the Linux kernel before     4.14-rc5 allows local users to have unspecified impact     via vectors related to /dev/snd/seq.(CVE-2017-15265)

  - net/packet/af_packet.c in the Linux kernel before     4.13.6 allows local users to gain privileges via     crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free, a different     vulnerability than CVE-2017-6346.(CVE-2017-15649)

  - The sg_ioctl function in drivers/scsi/sg.c in the Linux     kernel before 4.13.4 allows local users to obtain     sensitive information from uninitialized kernel     heap-memory locations via an SG_GET_REQUEST_TABLE ioctl     call for /dev/sg0.(CVE-2017-14991)

  - An exploitable memory corruption flaw was found in the     Linux kernel. The append path can be erroneously     switched from UFO to non-UFO in ip_ufo_append_data()     when building an UFO packet with MSG_MORE option. If     unprivileged user namespaces are available, this flaw     can be exploited to gain root     privileges.(CVE-2017-1000112)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2017-0174 for details.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - mm, thp: Do not make page table dirty unconditionally in     follow_trans_huge_pmd (Kirill A. Shutemov) [Orabug:
    27200879] (CVE-2017-1000405)

  - NFS: Add static NFS I/O tracepoints (Chuck Lever)

  - storvsc: don't assume SG list is contiguous (Aruna     Ramakrishna) 

  - fix unbalanced page refcounting in bio_map_user_iov     (Vitaly Mayatskikh) [Orabug: 27069038] (CVE-2017-12190)

  - more bio_map_user_iov leak fixes (Al Viro) [Orabug:
    27069038] (CVE-2017-12190)

  - packet: in packet_do_bind, test fanout with bind_lock     held (Willem de Bruijn) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: hold bind lock when rebinding to fanout hook     (Willem de Bruijn) [Orabug: 27069065] (CVE-2017-15649)

  - net: convert packet_fanout.sk_ref from atomic_t to     refcount_t (Reshetova, Elena) [Orabug: 27069065]     (CVE-2017-15649)

  - packet: fix races in fanout_add (Eric Dumazet) [Orabug:
    27069065] (CVE-2017-15649)

  - refcount_t: Introduce a special purpose refcount type     (Peter Zijlstra) [Orabug: 27069065] (CVE-2017-15649)

  - locking/atomics: Add _[acquire|release|relaxed] variants     of some atomic operations (Will Deacon) [Orabug:
    27069065] (CVE-2017-15649)

  - net: qmi_wwan: fix divide by 0 on bad descriptors     (Bj&oslash rn Mork) [Orabug: 27215225] (CVE-2017-16650)

  - ALSA: usb-audio: Kill stray URB at exiting (Takashi     Iwai) [Orabug: 27148276] (CVE-2017-16527)

  - scsi: Add STARGET_CREATED_REMOVE state to     scsi_target_state (Ewan D. Milne) [Orabug: 27187217]

  - ocfs2: fix posix_acl_create deadlock (Junxiao Bi)     [Orabug: 27126129]

  - scsi: Don't abort scsi_scan due to unexpected response     (John Sobecki) 

  - ocfs2: code clean up for direct io (Ryan Ding)

  - xscore: add dma address check (Zhu Yanjun) [Orabug:
    27076919]

  - KVM: nVMX: Fix loss of L2's NMI blocking state (Wanpeng     Li) [Orabug: 27062498]

  - KVM: nVMX: track NMI blocking state separately for each     VMCS (Paolo Bonzini) [Orabug: 27062498]

  - KVM: VMX: require virtual NMI support (Paolo Bonzini)     [Orabug: 27062498]

  - KVM: nVMX: Fix the NMI IDT-vectoring handling (Wanpeng     Li) [Orabug: 27062498]

  - uek-rpm: disable CONFIG_NUMA_BALANCING_DEFAULT_ENABLED     (Fred Herard) 

  - thp: run vma_adjust_trans_huge outside i_mmap_rwsem     (Kirill A. Shutemov) [Orabug: 27026180]

  - selinux: fix off-by-one in setprocattr (Stephen Smalley)     [Orabug: 27001717] (CVE-2017-2618) (CVE-2017-2618)     (CVE-2017-2618)

  - sysctl: Drop reference added by grab_header in     proc_sys_readdir (Zhou Chengming) [Orabug: 27036903]     (CVE-2016-9191) (CVE-2016-9191) (CVE-2016-9191)

  - KEYS: prevent KEYCTL_READ on negative key (Eric Biggers)     [Orabug: 27050248] (CVE-2017-12192)

  - IB/ipoib: For sendonly join free the multicast group on     leave (Christoph Lameter) [Orabug: 27077718]

  - IB/ipoib: increase the max mcast backlog queue (Doug     Ledford) 

  - IB/ipoib: Make sendonly multicast joins create the mcast     group (Doug Ledford) [Orabug: 27077718]

  - IB/ipoib: Expire sendonly multicast joins (Christoph     Lameter) 

  - IB/ipoib: Suppress warning for send only join failures     (Jason Gunthorpe) [Orabug: 27077718]

  - IB/ipoib: Clean up send-only multicast joins (Doug     Ledford) [Orabug: 27077718]

  - netlink: allow to listen 'all' netns (Nicolas Dichtel)     [Orabug: 27077944]

  - netlink: rename private flags and states (Nicolas     Dichtel) [Orabug: 27077944]

  - netns: use a spin_lock to protect nsid management     (Nicolas Dichtel) 

  - netns: notify new nsid outside __peernet2id (Nicolas     Dichtel) 

  - netns: rename peernet2id to peernet2id_alloc (Nicolas     Dichtel) 

  - netns: always provide the id to rtnl_net_fill (Nicolas     Dichtel) 

  - netns: returns always an id in __peernet2id (Nicolas     Dichtel) 

  - Hang/soft lockup in d_invalidate with simultaneous calls     (Al Viro) 

  - Revert 'drivers/char/mem.c: deny access in open     operation when securelevel is set' (Brian Maly) [Orabug:
    27037811]

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649)

  - The keyctl_read_key function in security/keys/keyctl.c     in the Key Management subcomponent in the Linux kernel     before 4.13.5 does not properly consider that a key may     be possessed but negatively instantiated, which allows     local users to cause a denial of service (OOPS and     system crash) via a crafted KEYCTL_READ     operation.(CVE-2017-12192)

  - The Linux kernel built with the KVM visualization     support (CONFIG_KVM), with nested visualization(nVMX)     feature enabled (nested=1), was vulnerable to a stack     buffer overflow issue. The vulnerability could occur     while traversing guest page table entries to resolve     guest virtual address(gva). An L1 guest could use this     flaw to crash the host kernel resulting in denial of     service (DoS) or potentially execute arbitrary code on     the host to gain privileges on the     system.(CVE-2017-12188)

  - The imon_probe function in drivers/media/rc/imon.c in     the Linux kernel through 4.13.11 allows local users to     cause a denial of service (NULL pointer dereference and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16537)

  - drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (general protection fault and system     crash) or possibly have unspecified other impact via a     crafted USB device, related to a missing warm-start     check and incorrect attach timing     (dm04_lme2510_frontend_attach versus     dm04_lme2510_tuner).(CVE-2017-16538)

  - The cx231xx_usb_probe function in     drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux     kernel through 4.13.11 allows local users to cause a     denial of service (NULL pointer dereference and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16536)

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel before     4.13.10 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535)

  - The cdc_parse_cdc_header function in     drivers/usb/core/message.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16534)

  - The usbhid_parse function in     drivers/hid/usbhid/hid-core.c in the Linux kernel     before 4.13.8 allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device.(CVE-2017-16533)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

  - drivers/usb/core/config.c in the Linux kernel before     4.13.6 allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash) or possibly have unspecified     other impact via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel before 4.13.6 allows local users to     cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

  - sound/core/seq_device.c in the Linux kernel before     4.13.4 allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16528)

  - sound/usb/mixer.c in the Linux kernel before 4.13.8     allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16527)

  - drivers/uwb/uwbd.c in the Linux kernel before 4.13.6     allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel before     4.13.8 allows local users to cause a denial of service     (use-after-free and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0181 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * A flaw was found in the Linux kernel's key management system where it was possible for an attacker to     escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is     cached in the payload area. A negatively instantiated key may be then be positively instantiated by     updating it with valid data. However, the ->update key type method must be aware that the error code may     be there. (CVE-2015-8539, Important)

    * It was found that fanout_add() in 'net/packet/af_packet.c' in the Linux kernel, before version 4.13.6,     allows local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout     data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a     use-after-free bug. (CVE-2017-15649, Important)

    * A vulnerability was found in the Linux kernel where the keyctl_set_reqkey_keyring() function leaks the     thread keyring. This allows an unprivileged local user to exhaust kernel memory and thus cause a DoS.
    (CVE-2017-7472, Moderate)

    Red Hat would like to thank Dmitry Vyukov of Google engineering for reporting CVE-2015-8539.

    Bug Fix(es):

    * The mlx5 driver has a number of configuration options, including the selective support for network     protocols, such as InfiniBand and Ethernet. Due to a regression in the configuration of the MRG-RT kernel,     the Ethernet mode of the driver was turned off. The regression has been resolved by enabling the mlx5     Ethernet mode, making the Ethernet protocol to work again. (BZ#1422778)

    * The migrate_disable/enable() kernel operations are used to pin a thread to a CPU temporarily. This     method is a kernel-rt specific. To keep RHEL-RT's kernel up-to-date with the latest real-time kernel, the     migrate_disable/enable routine was updated to the version present on kernel v4.9-rt. However, this version     showed to be problematic. The changes in the migrate_disable/enabled have been thus reverted to a stable     version, avoiding the kernel BUG. (BZ#1507831)

    * The kernel-rt packages have been upgraded to version 3.10.0-693.15.1.rt56.601, which provides a number     of security and bug fixes over the previous version. (BZ#1519504)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000727 advisory.

    The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that in the Linux kernel through     v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in     'block/bio.c' do unbalanced pages refcounting if IO     vector has small consecutive buffers belonging to the     same page. bio_add_pc_page() merges them into one, but     the page reference is never dropped, causing a memory     leak and possible system lockup due to out-of-memory     condition.(CVE-2017-12190)

  - A vulnerability was found in the Key Management sub     component of the Linux kernel, where when trying to     issue a KEYTCL_READ on a negative key would lead to a     NULL pointer dereference. A local attacker could use     this flaw to crash the kernel.(CVE-2017-12192)

  - A flaw was found in the Linux kernel's implementation     of associative arrays introduced in 3.13. This     functionality was backported to the 3.10 kernels in Red     Hat Enterprise Linux 7. The flaw involved a null     pointer dereference in assoc_array_apply_edit() due to     incorrect node-splitting in assoc_array implementation.
    This affects the keyring key type and thus key addition     and link creation operations may cause the kernel to     panic.(CVE-2017-12193)

  - A divide-by-zero vulnerability was found in the
    __tcp_select_window function in the Linux kernel. This     can result in a kernel panic causing a local denial of     service.(CVE-2017-14106)

  - The move_pages system call in mm/migrate.c in the Linux     kernel doesn't check the effective uid of the target     process. This enables a local attacker to learn the     memory layout of a setuid executable allowing     mitigation of ASLR.(CVE-2017-14140)

  - The iscsi_if_rx() function in     'drivers/scsi/scsi_transport_iscsi.c' in the Linux     kernel from v2.6.24-rc1 through 4.13.2 allows local     users to cause a denial of service (a system panic) by     making a number of certain syscalls by leveraging     incorrect length validation in the kernel     code.(CVE-2017-14489)

  - The sg_ioctl() function in 'drivers/scsi/sg.c' in the     Linux kernel, from version 4.12-rc1 to 4.14-rc2, allows     local users to obtain sensitive information from     uninitialized kernel heap-memory locations via an     SG_GET_REQUEST_TABLE ioctl call for     '/dev/sg0'.(CVE-2017-14991)

  - The tower_probe function in     drivers/usb/misc/legousbtower.c in the Linux kernel     before 4.8.1 allows local users (who are physically     proximate for inserting a crafted USB device) to gain     privileges by leveraging a write-what-where condition     that occurs after a race condition and a NULL pointer     dereference.(CVE-2017-15102)

  - A vulnerability was found in the Linux kernel when     peeling off an association to the socket in another     network namespace. All transports in this association     are not to be rehashed and keep using the old key in     hashtable, thus removing transports from hashtable when     closing the socket, all transports are being freed.
    Later on a use-after-free issue could be caused when     looking up an association and dereferencing the     transports.(CVE-2017-15115)

  - A use-after-free vulnerability was found in a network     namespaces code affecting the Linux kernel since     v4.0-rc1 through v4.15-rc5. The function     get_net_ns_by_id() does not check for the net::count     value after it has found a peer network in netns_ids     idr which could lead to double free and memory     corruption. This vulnerability could allow an     unprivileged local user to induce kernel memory     corruption on the system, leading to a crash. Due to     the nature of the flaw, privilege escalation cannot be     fully ruled out, although it is thought to be     unlikely.(CVE-2017-15129)

  - A use-after-free vulnerability was found when issuing     an ioctl to a sound device. This could allow a user to     exploit a race condition and create memory corruption     or possibly privilege escalation.(CVE-2017-15265)

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel     oops).(CVE-2017-15274)

  - A vulnerability was found in the key management     subsystem of the Linux kernel. An update on an     uninstantiated key could cause a kernel panic, leading     to denial of service (DoS).(CVE-2017-15299)

  - It was found that fanout_add() in     'net/packet/af_packet.c' in the Linux kernel, before     version 4.13.6, allows local users to gain privileges     via crafted system calls that trigger mishandling of     packet_fanout data structures, because of a race     condition (involving fanout_add and packet_do_bind)     that leads to a use-after-free bug.(CVE-2017-15649)

  - The usb_serial_console_disconnect function in     drivers/usb/serial/console.c in the Linux kernel,     before 4.13.8, allows local users to cause a denial of     service (use-after-free and system crash) or possibly     have unspecified other impact via a crafted USB device,     related to disconnection and failed     setup.(CVE-2017-16525)

  - The drivers/uwb/uwbd.c in the Linux kernel, before     4.13.6, allows local users to cause a denial of service     (general protection fault and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16526)

  - The sound/usb/mixer.c in the Linux kernel, before     4.13.8, allows local users to cause a denial of service     (snd_usb_mixer_interrupt use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16527)

  - The sound/core/seq_device.c in the Linux kernel, before     4.13.4, allows local users to cause a denial of service     (snd_rawmidi_dev_seq_free use-after-free and system     crash) or possibly have unspecified other impact via a     crafted USB device.(CVE-2017-16528)

  - The snd_usb_create_streams function in sound/usb/card.c     in the Linux kernel, before 4.13.6, allows local users     to cause a denial of service (out-of-bounds read and     system crash) or possibly have unspecified other impact     via a crafted USB device.(CVE-2017-16529)

  - The uas driver in the Linux kernel before 4.13.6 allows     local users to cause a denial of service (out-of-bounds     read and system crash), or possibly have unspecified     other impacts via a crafted USB device, related to     drivers/usb/storage/uas-detect.h and     drivers/usb/storage/uas.c.(CVE-2017-16530)

  - The function drivers/usb/core/config.c in the Linux     kernel, allows local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB device,     related to the USB_DT_INTERFACE_ASSOCIATION     descriptor.(CVE-2017-16531)

  - The get_endpoints function in     drivers/usb/misc/usbtest.c in the Linux kernel through     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) or possibly     have unspecified other impact via a crafted USB     device.(CVE-2017-16532)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.06, has kernel packages installed that are affected by multiple vulnerabilities:

  - The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to     RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack     will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance     between the end of the PIE binary's read-write segment and the start of the stack becomes small enough     that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5.
    This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to     i386 based systems. (CVE-2017-1000371)

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R)     Processors may allow an authenticated user to potentially enable denial of service of the host system via     local access. (CVE-2018-12207)

  - Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an     authenticated user to potentially enable denial of service via local access. (CVE-2019-0154)

  - Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold     Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900     Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R)     Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077     (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11,     4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of     privilege via local access. (CVE-2019-0155)

  - TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated     user to potentially enable information disclosure via a side channel with local access. (CVE-2019-11135)

  - The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow, with resultant use-after-     free issues, if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c, fs/pipe.c, fs/splice.c,     include/linux/mm.h, include/linux/pipe_fs_i.h, kernel/trace/trace.c, mm/gup.c, and mm/hugetlb.c. It can     occur with FUSE requests. (CVE-2019-11487)

  - An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux     kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer     'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be     supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm'     device could use this flaw to crash the host kernel, resulting in a denial of service or potentially     escalating privileges on the system. (CVE-2019-14821)

  - base_sock_create in drivers/isdn/mISDN/socket.c in the AF_ISDN network module in the Linux kernel through     5.3.2 does not enforce CAP_NET_RAW, which means that unprivileged users can create a raw socket, aka     CID-b91ee4aa2a21. (CVE-2019-17055)

  - In the Linux kernel through 5.3.2, cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c does not reject a     long SSID IE, leading to a Buffer Overflow. (CVE-2019-17133)

  - rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel through 5.3.6 lacks a     certain upper-bound check, leading to a buffer overflow. (CVE-2019-17666)

  - An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including     v5.1-rc6, while handling incoming packets in handle_rx(). It could occur if one end sends packets faster     than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the     vhost_net kernel thread, resulting in a DoS scenario. (CVE-2019-3900)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

  - A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13.
    drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.
    (CVE-2020-29661)

  - A flaw was found in the way memory resources were freed in the unix_stream_recvmsg function in the Linux     kernel when a signal was pending. This flaw allows an unprivileged local user to crash the system by     exhausting available memory. The highest threat from this vulnerability is to system availability.
    (CVE-2021-20265)

  - An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is     adversely affected by the ability of an unprivileged user to craft Netlink messages. (CVE-2021-27364)

  - An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have     appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can     send a Netlink message that is associated with iSCSI, and has a length up to the maximum length of a     Netlink message. (CVE-2021-27365)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2430 advisory.

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities:

  - The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux     kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated,     which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ     operation. (CVE-2017-12192)

  - The KEYS subsystem in the Linux kernel before 3.18 allows local users to gain privileges or cause a denial     of service (NULL pointer dereference and system crash) via vectors involving a NULL value for a certain     match field, related to the keyring_search_iterator function in keyring.c. (CVE-2017-2647)

  - A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7.
    This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into     the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO     restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate     that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer     dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network     user to crash the system kernel, resulting in a denial of service. (CVE-2020-10711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3469-2 advisory.

    USN-3469-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the     corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu     14.04 LTS.

    Anthony Perard discovered that the Xen virtual block driver did not properly initialize some data     structures before passing them to user space. A local attacker in a guest VM could use this to expose     sensitive information from the host OS or other guest VMs. (CVE-2017-10911)

    Bo Zhang discovered that the netlink wireless configuration interface in the Linux kernel did not properly     validate attributes when handling certain requests. A local attacker with the CAP_NET_ADMIN could use this     to cause a denial of service (system crash). (CVE-2017-12153)

    It was discovered that the nested KVM implementation in the Linux kernel in some situations did not     properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker     in a guest could use this to cause a denial of service (system crash).

    It was discovered that the key management subsystem in the Linux kernel did not properly restrict key     reads on negatively instantiated keys. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-12192)

    It was discovered that an integer overflow existed in the sysfs interface for the QLogic 24xx+ series SCSI     driver in the Linux kernel. A local privileged attacker could use this to cause a denial of service     (system crash). (CVE-2017-14051)

    It was discovered that the ATI Radeon framebuffer driver in the Linux kernel did not properly initialize a     data structure returned to user space. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14156)

    Dave Chinner discovered that the XFS filesystem did not enforce that the realtime inode flag was settable     only on filesystems on a realtime device. A local attacker could use this to cause a denial of service     (system crash). (CVE-2017-14340)

    ChunYu Wang discovered that the iSCSI transport implementation in the Linux kernel did not properly     validate data structures. A local attacker could use this to cause a denial of service (system crash).
    (CVE-2017-14489)

    It was discovered that the generic SCSI driver in the Linux kernel did not properly initialize data     returned to user space in some situations. A local attacker could use this to expose sensitive information     (kernel memory). (CVE-2017-14991)

    Dmitry Vyukov discovered that the Floating Point Unit (fpu) subsystem in the Linux kernel did not properly     handle attempts to set reserved bits in a task's extended state (xstate) area. A local attacker could use     this to cause a denial of service (system crash). (CVE-2017-15537)

    Pengfei Wang discovered that the Turtle Beach MultiSound audio device driver in the Linux kernel contained     race conditions when fetching from the ring-buffer. A local attacker could use this to cause a denial of     service (infinite loop). (CVE-2017-9984, CVE-2017-9985)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289677	MiracleLinux 7 : kernel-3.10.0-693.17.1.el7 (AXSA:2018-2578:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/2/9	high
104296	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1271)	Nessus	Huawei Local Security Checks	2017/11/1	2025/11/17	high
105248	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0174) (BlueBorne) (Dirty COW) (Stack Clash)	Nessus	OracleVM Local Security Checks	2017/12/14	2025/11/11	high
105146	OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0172) (Dirty COW)	Nessus	OracleVM Local Security Checks	2017/12/11	2025/11/12	high
104911	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1292)	Nessus	Huawei Local Security Checks	2017/12/1	2025/11/13	high
106525	RHEL 6 : kernel-rt (RHSA-2018:0181)	Nessus	Red Hat Local Security Checks	2018/1/31	2024/6/3	high
290920	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000727)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
124822	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1499)	Nessus	Huawei Local Security Checks	2019/5/13	2022/5/20	high
160761	NewStart CGSL MAIN 4.06 : kernel Multiple Vulnerabilities (NS-SA-2022-0075)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2023/10/30	critical
137336	CentOS 6 : kernel (RHSA-2020:2430)	Nessus	CentOS Local Security Checks	2020/6/11	2024/10/9	medium
160776	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2022-0001)	Nessus	NewStart CGSL Local Security Checks	2022/5/9	2022/5/9	high
104321	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3469-2)	Nessus	Ubuntu Local Security Checks	2017/11/1	2024/8/27	high

检测

插件搜索

high

high

high

high

high

high

medium

high

critical

medium

high

high