The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3641-1 advisory.

    Nick Peterson discovered that the Linux kernel did not properly handle debug exceptions following a     MOV/POP to SS instruction. A local attacker could use this to cause a denial of service (system crash).
    This issue only affected the amd64 architecture. (CVE-2018-8897)

    Andy Lutomirski discovered that the KVM subsystem of the Linux kernel did not properly emulate the ICEBP     instruction following a MOV/POP to SS instruction. A local attacker in a KVM virtual machine could use     this to cause a denial of service (guest VM crash) or possibly escalate privileges inside of the virtual     machine. This issue only affected the i386 and amd64 architectures. (CVE-2018-1087)

    Andy Lutomirski discovered that the Linux kernel did not properly perform error handling on virtualized     debug registers. A local attacker could use this to cause a denial of service (system crash) or possibly     execute arbitrary code. (CVE-2018-1000199)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A statement in the System Programming Guide of the     Intel 64 and IA-32 Architectures Software Developer's     Manual (SDM) was mishandled in the development of some     or all operating-system kernels, resulting in     unexpected behavior for #DB exceptions that are     deferred by MOV SS or POP SS, as demonstrated by (for     example) privilege escalation in Windows, macOS, some     Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A     section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL i1/4oe 3,     the debug exception is delivered after the transfer to     CPL i1/4oe 3 is complete. OS kernels may not expect this     order of events and may therefore experience unexpected     behavior when it occurs.i1/4^CVE-2018-8897)

  - On x86, MOV SS and POP SS behave strangely if they     encounter a data breakpoint. If this occurs in a KVM     guest, KVM incorrectly thinks that a #DB instruction     was caused by the undocumented ICEBP instruction. This     results in #DB being delivered to the guest kernel with     an incorrect RIP on the stack. On most guest kernels,     this will allow a guest user to DoS the guest kernel or     even to escalate privilege to that of the guest kernel.
    (CVE-2018-1087)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A weakness was found in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
(CVE-2018-1108)

A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in the denial of service. (CVE-2018-8897)

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory. (CVE-2018-1068)

The Linux kernel is vulerable to a use-after-free flaw when Transformation User configuration interface(CONFIG_XFRM_USER) compile-time configuration were enabled. This vulnerability occurs while closing a xfrm netlink socket in xfrm_dump_policy_done. A user/process could abuse this flaw to potentially escalate their privileges on a system. (CVE-2017-16939)

A flaw was found in the Linux kernel where a crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration. This is due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.(CVE-2018-1091)

An address corruption flaw was discovered in the Linux kernel built with hardware breakpoint (CONFIG_HAVE_HW_BREAKPOINT) support. While modifying a h/w breakpoint via 'modify_user_hw_breakpoint' routine, an unprivileged user/process could use this flaw to crash the system kernel resulting in DoS OR to potentially escalate privileges on a the system.(CVE-2018-1000199)

A flaw was found in the way the Linux kernel's KVM hypervisor handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, the processor did not deliver interrupts and exceptions, rather they are delivered once the first instruction after the stack switch is executed. An unprivileged KVM guest user could use this flaw to crash the guest or, potentially, escalate their privileges in the guest.(CVE-2018-1087)

This update for the Linux Kernel 4.4.114-92_67 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.120-92_70 fixes several issues.
The following security issues were fixed :

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.74-92_32 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.59-92_24 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the cpupools / cpupools-features / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's KVM     hypervisor handled exceptions delivered after a stack     switch operation via Mov SS or Pop SS instructions.
    During the stack switch operation, the processor did     not deliver interrupts and exceptions, rather they are     delivered once the first instruction after the stack     switch is executed. An unprivileged KVM guest user     could use this flaw to crash the guest or, potentially,     escalate their privileges in the guest.

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load & Store instructions (a commonly used     performance optimization). It relies on the presence of     a precisely-defined instruction sequence in the     privileged code as well as the fact that memory read     from address to which a recent memory write has     occurred may see an older value and subsequently cause     an update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1318 advisory.

    The kernel packages contain the Linux kernel, the core of any Linux operating system.

    Security Fix(es):

    * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

    * kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick     Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

    Bug Fix(es):

    These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these     bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3431641

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1355 advisory.

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with     extremely high determinism requirements.

    Security Fix(es):

    * Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)

    * Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

    * kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c     (CVE-2018-1068)

    * kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick     Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

    Bug Fix(es):

    * The kernel-rt packages have been upgraded to the 3.10.0-862.2.3 source tree, which provides a number of     bug fixes over the previous version. (BZ#1549768)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es) :

* Kernel: KVM: error in exception handling leads to wrong debug stack value (CVE-2018-1087)

* Kernel: error in exception handling leads to DoS (CVE-2018-8897)

* Kernel: ipsec: xfrm: use-after-free leading to potential privilege escalation (CVE-2017-16939)

* kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c (CVE-2018-1068)

* kernel: ptrace() incorrect error handling leads to corruption and DoS (CVE-2018-1000199)

* kernel: guest kernel crash during core dump on POWER9 host (CVE-2018-1091)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Andy Lutomirski for reporting CVE-2018-1087 and CVE-2018-1000199 and Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897.

Bug Fix(es) :

These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article:
https://access.redhat.com/ articles/3431641

This update for the Linux Kernel 4.4.103-92_53 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.74-92_35 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for the Linux Kernel 4.4.74-92_38 fixes several issues.
The following security issues were fixed :

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver was fixed.
    (bsc#1085447).

  - CVE-2018-8897: A statement in the System Programming     Guide of the Intel 64 and IA-32 Architectures Software     Developer's Manual (SDM) was mishandled in the     development of some or all operating-system kernels,     resulting in unexpected behavior for #DB exceptions that     are deferred by MOV SS or POP SS, as demonstrated by     (for example) privilege escalation in Windows, macOS,     some Xen configurations, or FreeBSD, or a Linux kernel     crash. The MOV to SS and POP SS instructions inhibit     interrupts (including NMIs), data breakpoints, and     single step trap exceptions until the instruction     boundary following the next instruction (SDM Vol. 3A;
    section 6.8.3). (The inhibited data breakpoints are     those on memory accessed by the MOV to SS or POP to SS     instruction itself.) Note that debug exceptions are not     inhibited by the interrupt enable (EFLAGS.IF) system     flag (SDM Vol. 3A; section 2.3). If the instruction     following the MOV to SS or POP to SS instruction is an     instruction like SYSCALL, SYSENTER, INT 3, etc. that     transfers control to the operating system at CPL is     complete. OS kernels may not expect this order of events     and may therefore experience unexpected behavior when it     occurs (bsc#1090368).

  - CVE-2018-8781: The udl_fb_mmap function in     drivers/gpu/drm/udl/udl_fb.c had an integer-overflow     vulnerability allowing local users with access to the     udldrmfb driver to obtain full read and write     permissions on kernel physical pages, resulting in a     code execution in kernel space (bsc#1090646).

  - bsc#1083125: Fixed kgraft: small race in reversion code

  - CVE-2018-1087: kernel KVM was vulnerable to a flaw in     the way the Linux kernel's KVM hypervisor handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged KVM guest user could use this flaw to crash     the guest or, potentially, escalate their privileges in     the guest (bsc#1090869) before

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated to 4.4.121 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-8781: The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c had an integer-overflow vulnerability that allowed local users with access to the udldrmfb driver to obtain full read and write permissions on kernel physical pages, resulting in a code execution in kernel space (bnc#1090643).

CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).

CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).

CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl. (bnc#1088241)

CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).

CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).

CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).

CVE-2018-1087: And an unprivileged KVM guest user could use this flaw to potentially escalate their privileges inside a guest. (bsc#1087088)

CVE-2018-8897: An unprivileged system user could use incorrect set up interrupt stacks to crash the Linux kernel resulting in DoS issue.
(bsc#1087088)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:1711 advisory.

    The rhev-hypervisor7 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The     Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor.
    It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise     Linux operating environment and the Red Hat Enterprise Virtualization Agent.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639)

    Note: This is the rhev-hypervisor7 side of the CVE-2018-3639 mitigation.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the anaconda / anaconda-core / anaconda-dracut / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's KVM     hypervisor handled exceptions delivered after a stack     switch operation via Mov SS or Pop SS instructions.
    During the stack switch operation, the processor did     not deliver interrupts and exceptions, rather they are     delivered once the first instruction after the stack     switch is executed. An unprivileged KVM guest user     could use this flaw to crash the guest or, potentially,     escalate their privileges in the guest.

  - An industry-wide issue was found in the way many modern     microprocessor designs have implemented speculative     execution of Load & Store instructions (a commonly used     performance optimization). It relies on the presence of     a precisely-defined instruction sequence in the     privileged code as well as the fact that memory read     from address to which a recent memory write has     occurred may see an older value and subsequently cause     an update into the microprocessor's data cache even for     speculatively executed instructions that never actually     commit (retire). As a result, an unprivileged attacker     could use this flaw to read privileged memory by     conducting targeted cache side-channel attacks. NOTE:
    This fix also requires CPU microcode/firmware updates     and subscribers are advised to contact their hardware     OEM vendors to receive the appropriate     microcode/firmware for their processor. A kernel     update, without the appropriate firmware/microcode     updated for the processor, is insufficient to remediate     this vulnerability.

  - A flaw was found in the way the Linux kernel handled     exceptions delivered after a stack switch operation via     Mov SS or Pop SS instructions. During the stack switch     operation, the processor did not deliver interrupts and     exceptions, rather they are delivered once the first     instruction after the stack switch is executed. An     unprivileged system user could use this flaw to crash     the system kernel resulting in the denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109650	Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-3641-1)	Nessus	Ubuntu Local Security Checks	2018/5/9	2024/8/27	high
109813	EulerOS 2.0 SP3 : kernel (EulerOS-SA-2018-1121)	Nessus	Huawei Local Security Checks	2018/5/16	2024/10/8	high
110196	Amazon Linux 2 : kernel (ALAS-2018-1023)	Nessus	Amazon Linux Local Security Checks	2018/5/30	2024/9/30	high
110346	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1511-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110357	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1523-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110358	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1524-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110369	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1536-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110157	Virtuozzo 6 : cpupools / cpupools-features / etc (VZA-2018-034)	Nessus	Virtuozzo Local Security Checks	2018/5/29	2024/10/1	high
109620	EulerOS 2.0 SP2 : kernel (EulerOS-SA-2018-1120)	Nessus	Huawei Local Security Checks	2018/5/9	2024/10/11	high
109633	RHEL 7 : kernel (RHSA-2018:1318)	Nessus	Red Hat Local Security Checks	2018/5/9	2025/4/15	high
109642	RHEL 7 : kernel-rt (RHSA-2018:1355)	Nessus	Red Hat Local Security Checks	2018/5/9	2024/11/5	high
110245	CentOS 7 : kernel (CESA-2018:1318)	Nessus	CentOS Local Security Checks	2018/5/31	2024/9/30	high
110352	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1518-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110367	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1534-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
110376	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1545-1)	Nessus	SuSE Local Security Checks	2018/6/6	2024/9/25	high
118252	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1173-2)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	high
110113	RHEL 6 / 7 : rhev-hypervisor7 (RHSA-2018:1711)	Nessus	Red Hat Local Security Checks	2018/5/25	2024/6/3	high
110234	Virtuozzo 7 : anaconda / anaconda-core / anaconda-dracut / etc (VZA-2018-037)	Nessus	Virtuozzo Local Security Checks	2018/5/31	2024/9/30	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high