According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the Linux kernel's client-side     implementation of the cifs protocol. This flaw allows     an attacker controlling the server to kernel panic a     client which has the CIFS server     mounted.(CVE-2018-1066)

  - In the Linux Kernel before version 4.15.8, 4.14.25,     4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the     '_sctp_make_chunk()' function     (net/sctp/sm_make_chunk.c) when handling SCTP packets     length can be exploited to cause a kernel     crash.(CVE-2018-5803)

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757)

  - A race condition in the store_int_with_restart()     function in arch/x86/kernel/cpu/mcheck/mce.c in the     Linux kernel allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck (cpu     number) directory.(CVE-2018-7995)

  - ALSA sequencer core initializes the event pool on     demand by invoking snd_seq_pool_init() when the first     write happens and the pool is empty. A user can reset     the pool size manually via ioctl concurrently, and this     may lead to UAF or out-of-bound access.(CVE-2018-7566)

  - A flaw was found in the Linux kernel's implementation     of 32-bit syscall interface for bridging. This allowed     a privileged user to arbitrarily write to a limited     range of kernel memory.(CVE-2018-1068)

  - A vulnerability was found in the Linux kernel's     kernel/events/core.c:perf_cpu_time_max_percent_handler(     ) function. Local privileged users could exploit this     flaw to cause a denial of service due to integer     overflow or possibly have unspecified other     impact.(CVE-2017-18255)

  - The code in the drivers/scsi/libsas/sas_scsi_host.c     file in the Linux kernel allow a physically proximate     attacker to cause a memory leak in the ATA command     queue and, thus, denial of service by triggering     certain failure conditions.(CVE-2018-10021)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003609 advisory.

    Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux     kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read     accesses to files in the /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2015-9016     Ming Lei reported a race condition in the multiqueue     block layer (blk-mq). On a system with a driver using     blk-mq (mtip32xx, null_blk, or virtio_blk), a local user     might be able to use this for denial of service or     possibly for privilege escalation.

  - CVE-2017-0861     Robb Glasser reported a potential use-after-free in the     ALSA (sound) PCM core. We believe this was not possible     in practice.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated for the x86 architecture (amd64 and   i386) by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated by identifying vulnerable code sections   (array bounds checking followed by array access) and replacing the   array access with the speculation-safe array_index_nospec()   function.

  More use sites will be added over time.

  - CVE-2017-13166     A bug in the 32-bit compatibility layer of the v4l2     ioctl handling code has been found. Memory protections     ensuring user-provided buffers always point to userland     memory were disabled, allowing destination addresses to     be in kernel space. On a 64-bit kernel a local user with     access to a suitable video device can exploit this to     overwrite kernel memory, leading to privilege     escalation.

  - CVE-2017-13220     Al Viro reported that the Bluetooth HIDP implementation     could dereference a pointer before performing the     necessary type check. A local user could use this to     cause a denial of service.

  - CVE-2017-16526     Andrey Konovalov reported that the UWB subsystem may     dereference an invalid pointer in an error case. A local     user might be able to use this for denial of service.

  - CVE-2017-16911     Secunia Research reported that the USB/IP vhci_hcd     driver exposed kernel heap addresses to local users.
    This information could aid the exploitation of other     vulnerabilities.

  - CVE-2017-16912     Secunia Research reported that the USB/IP stub driver     failed to perform a range check on a received packet     header field, leading to an out-of-bounds read. A remote     user able to connect to the USB/IP server could use this     for denial of service.

  - CVE-2017-16913     Secunia Research reported that the USB/IP stub driver     failed to perform a range check on a received packet     header field, leading to excessive memory allocation. A     remote user able to connect to the USB/IP server could     use this for denial of service.

  - CVE-2017-16914     Secunia Research reported that the USB/IP stub driver     failed to check for an invalid combination of fields in     a received packet, leading to a NULL pointer     dereference. A remote user able to connect to the USB/IP     server could use this for denial of service.

  - CVE-2017-18017     Denys Fedoryshchenko reported that the netfilter     xt_TCPMSS module failed to validate TCP header lengths,     potentially leading to a use-after-free. If this module     is loaded, it could be used by a remote attacker for     denial of service or possibly for code execution.

  - CVE-2017-18203     Hou Tao reported that there was a race condition in     creation and deletion of device-mapper (DM) devices. A     local user could potentially use this for denial of     service.

  - CVE-2017-18216     Alex Chen reported that the OCFS2 filesystem failed to     hold a necessary lock during nodemanager sysfs file     operations, potentially leading to a NULL pointer     dereference. A local user could use this for denial of     service.

  - CVE-2017-18232     Jason Yan reported a race condition in the SAS     (Serial-Attached SCSI) subsystem, between probing and     destroying a port. This could lead to a deadlock. A     physically present attacker could use this to cause a     denial of service.

  - CVE-2017-18241     Yunlei He reported that the f2fs implementation does not     properly initialise its state if the 'noflush_merge'     mount option is used. A local user with access to a     filesystem mounted with this option could use this to     cause a denial of service.

  - CVE-2018-1066     Dan Aloni reported to Red Hat that the CIFS client     implementation would dereference a NULL pointer if the     server sent an invalid response during NTLMSSP setup     negotiation. This could be used by a malicious server     for denial of service.

  - CVE-2018-1068     The syzkaller tool found that the 32-bit compatibility     layer of ebtables did not sufficiently validate offset     values. On a 64-bit kernel, a local user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this to overwrite kernel memory, possibly leading to     privilege escalation. Debian disables unprivileged user     namespaces by default.

  - CVE-2018-1092     Wen Xu reported that a crafted ext4 filesystem image     would trigger a null dereference when mounted. A local     user able to mount arbitrary filesystems could use this     for denial of service.

  - CVE-2018-5332     Mohamed Ghannam reported that the RDS protocol did not     sufficiently validate RDMA requests, leading to an     out-of-bounds write. A local attacker on a system with     the rds module loaded could use this for denial of     service or possibly for privilege escalation.

  - CVE-2018-5333     Mohamed Ghannam reported that the RDS protocol did not     properly handle an error case, leading to a NULL pointer     dereference. A local attacker on a system with the rds     module loaded could possibly use this for denial of     service.

  - CVE-2018-5750     Wang Qize reported that the ACPI sbshc driver logged a     kernel heap address. This information could aid the     exploitation of other vulnerabilities.

  - CVE-2018-5803     Alexey Kodanev reported that the SCTP protocol did not     range-check the length of chunks to be created. A local     or remote user could use this to cause a denial of     service.

  - CVE-2018-6927     Li Jinyue reported that the FUTEX_REQUEUE operation on     futexes did not check for negative parameter values,     which might lead to a denial of service or other     security impact.

  - CVE-2018-7492     The syzkaller tool found that the RDS protocol was     lacking a null pointer check. A local attacker on a     system with the rds module loaded could use this for     denial of service.

  - CVE-2018-7566     Fan LongFei reported a race condition in the ALSA     (sound) sequencer core, between write and ioctl     operations. This could lead to an out-of-bounds access     or use-after-free. A local user with access to a     sequencer device could use this for denial of service or     possibly for privilege escalation.

  - CVE-2018-7740     Nic Losby reported that the hugetlbfs filesystem's mmap     operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs     filesystem could use this to cause a denial of service.

  - CVE-2018-7757     Jason Yan reported a memory leak in the SAS     (Serial-Attached SCSI) subsystem. A local user on a     system with SAS devices could use this to cause a denial     of service.

  - CVE-2018-7995     Seunghun Han reported a race condition in the x86 MCE     (Machine Check Exception) driver. This is unlikely to     have any security impact.

  - CVE-2018-8781     Eyal Itkin reported that the udl (DisplayLink) driver's     mmap operation did not properly range-check the file     offset. A local user with access to a udl framebuffer     device could exploit this to overwrite kernel memory,     leading to privilege escalation.

  - CVE-2018-8822     Dr Silvio Cesare of InfoSect reported that the ncpfs     client implementation did not validate reply lengths     from the server. An ncpfs server could use this to cause     a denial of service or remote code execution in the     client.

  - CVE-2018-1000004     Luo Quan reported a race condition in the ALSA (sound)     sequencer core, between multiple ioctl operations. This     could lead to a deadlock or use-after-free. A local user     with access to a sequencer device could use this for     denial of service or possibly for privilege escalation.

  - CVE-2018-1000199     Andy Lutomirski discovered that the ptrace subsystem did     not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,     or possibly for privilege escalation, on x86 (amd64 and     i386) and possibly other architectures.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

  - CVE-2017-5715     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 2 (branch target   injection) and is mitigated for the x86 architecture (amd64 and   i386) by using the 'retpoline' compiler feature which allows   indirect branches to be isolated from speculative execution.

  - CVE-2017-5753     Multiple researchers have discovered a vulnerability in     various processors supporting speculative execution,     enabling an attacker controlling an unprivileged process     to read memory from arbitrary addresses, including from     the kernel and all other processes running on the     system.

  This specific attack has been named Spectre variant 1 (bounds-check   bypass) and is mitigated by identifying vulnerable code sections   (array bounds checking followed by array access) and replacing the   array access with the speculation-safe array_index_nospec()   function.

  More use sites will be added over time.

  - CVE-2017-17975     Tuba Yavuz reported a use-after-free flaw in the     USBTV007 audio-video grabber driver. A local user could     use this for denial of service by triggering failure of     audio registration.

  - CVE-2017-18193     Yunlei He reported that the f2fs implementation does not     properly handle extent trees, allowing a local user to     cause a denial of service via an application with     multiple threads.

  - CVE-2017-18216     Alex Chen reported that the OCFS2 filesystem failed to     hold a necessary lock during nodemanager sysfs file     operations, potentially leading to a NULL pointer     dereference. A local user could use this for denial of     service.

  - CVE-2017-18218     Jun He reported a use-after-free flaw in the Hisilicon     HNS ethernet driver. A local user could use this for     denial of service.

  - CVE-2017-18222     It was reported that the Hisilicon Network Subsystem     (HNS) driver implementation does not properly handle     ethtool private flags. A local user could use this for     denial of service or possibly have other impact.

  - CVE-2017-18224     Alex Chen reported that the OCFS2 filesystem omits the     use of a semaphore and consequently has a race condition     for access to the extent tree during read operations in     DIRECT mode. A local user could use this for denial of     service.

  - CVE-2017-18241     Yunlei He reported that the f2fs implementation does not     properly initialise its state if the 'noflush_merge'     mount option is used. A local user with access to a     filesystem mounted with this option could use this to     cause a denial of service.

  - CVE-2017-18257     It was reported that the f2fs implementation is prone to     an infinite loop caused by an integer overflow in the
    __get_data_block() function. A local user can use this     for denial of service via crafted use of the open and     fallocate system calls with an FS_IOC_FIEMAP ioctl.

  - CVE-2018-1065     The syzkaller tool found a NULL pointer dereference flaw     in the netfilter subsystem when handling certain     malformed iptables rulesets. A local user with the     CAP_NET_RAW or CAP_NET_ADMIN capability (in any user     namespace) could use this to cause a denial of service.
    Debian disables unprivileged user namespaces by default.

  - CVE-2018-1066     Dan Aloni reported to Red Hat that the CIFS client     implementation would dereference a NULL pointer if the     server sent an invalid response during NTLMSSP setup     negotiation. This could be used by a malicious server     for denial of service.

  - CVE-2018-1068     The syzkaller tool found that the 32-bit compatibility     layer of ebtables did not sufficiently validate offset     values. On a 64-bit kernel, a local user with the     CAP_NET_ADMIN capability (in any user namespace) could     use this to overwrite kernel memory, possibly leading to     privilege escalation. Debian disables unprivileged user     namespaces by default.

  - CVE-2018-1092     Wen Xu reported that a crafted ext4 filesystem image     would trigger a null dereference when mounted. A local     user able to mount arbitrary filesystems could use this     for denial of service.

  - CVE-2018-1093     Wen Xu reported that a crafted ext4 filesystem image     could trigger an out-of-bounds read in the     ext4_valid_block_bitmap() function. A local user able to     mount arbitrary filesystems could use this for denial of     service.

  - CVE-2018-1108     Jann Horn reported that crng_ready() does not properly     handle the crng_init variable states and the RNG could     be treated as cryptographically safe too early after     system boot.

  - CVE-2018-5803     Alexey Kodanev reported that the SCTP protocol did not     range-check the length of chunks to be created. A local     or remote user could use this to cause a denial of     service.

  - CVE-2018-7480     Hou Tao discovered a double-free flaw in the     blkcg_init_queue() function in block/blk-cgroup.c. A     local user could use this to cause a denial of service     or have other impact.

  - CVE-2018-7566     Fan LongFei reported a race condition in the ALSA     (sound) sequencer core, between write and ioctl     operations. This could lead to an out-of-bounds access     or use-after-free. A local user with access to a     sequencer device could use this for denial of service or     possibly for privilege escalation.

  - CVE-2018-7740     Nic Losby reported that the hugetlbfs filesystem's mmap     operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs     filesystem could use this to cause a denial of service.

  - CVE-2018-7757     Jason Yan reported a memory leak in the SAS     (Serial-Attached SCSI) subsystem. A local user on a     system with SAS devices could use this to cause a denial     of service.

  - CVE-2018-7995     Seunghun Han reported a race condition in the x86 MCE     (Machine Check Exception) driver. This is unlikely to     have any security impact.

  - CVE-2018-8087     A memory leak flaw was found in the hwsim_new_radio_nl()     function in the simulated radio testing tool driver for     mac80211, allowing a local user to cause a denial of     service.

  - CVE-2018-8781     Eyal Itkin reported that the udl (DisplayLink) driver's     mmap operation did not properly range-check the file     offset. A local user with access to a udl framebuffer     device could exploit this to overwrite kernel memory,     leading to privilege escalation.

  - CVE-2018-8822     Dr Silvio Cesare of InfoSect reported that the ncpfs     client implementation did not validate reply lengths     from the server. An ncpfs server could use this to cause     a denial of service or remote code execution in the     client.

  - CVE-2018-10323     Wen Xu reported a NULL pointer dereference flaw in the     xfs_bmapi_write() function triggered when mounting and     operating a crafted xfs filesystem image. A local user     able to mount arbitrary filesystems could use this for     denial of service.

  - CVE-2018-1000199     Andy Lutomirski discovered that the ptrace subsystem did     not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,     or possibly for privilege escalation, on x86 (amd64 and     i386) and possibly other architectures.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3654-2 advisory.

    USN-3654-1 fixed vulnerabilities and added mitigations in the Linux kernel for Ubuntu 16.04 LTS. This     update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04     LTS for Ubuntu 14.04 LTS.

    Jann Horn and Ken Johnson discovered that microprocessors utilizing speculative execution of a memory read     may allow unauthorized memory reads via a sidechannel attack. This flaw is known as Spectre Variant 4. A     local attacker could use this to expose sensitive information, including kernel memory. (CVE-2018-3639)

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3656-1 advisory.

    Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local     attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.
    (CVE-2017-17975)

    It was discovered that a race condition existed in the F2FS implementation in the Linux kernel. A local     attacker could use this to cause a denial of service (system crash). (CVE-2017-18193)

    It was discovered that a buffer overflow existed in the Hisilicon HNS Ethernet Device driver in the Linux     kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2017-18222)

    It was discovered that the netfilter subsystem in the Linux kernel did not validate that rules containing     jumps contained user-defined chains. A local attacker could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-1065)

    It was discovered that the netfilter subsystem of the Linux kernel did not properly validate ebtables     offsets. A local attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-1068)

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that a double free error existed in the block layer subsystem of the Linux kernel when     setting up a request queue. A local attacker could use this to cause a denial of service (system crash) or     possibly execute arbitrary code. (CVE-2018-7480)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

    It was discovered that a race condition existed in the x86 machine check handler in the Linux kernel. A     local privileged attacker could use this to cause a denial of service (system crash) or possibly execute     arbitrary code. (CVE-2018-7995)

    Eyal Itkin discovered that the USB displaylink video adapter driver in the Linux kernel did not properly     validate mmap offsets sent from userspace. A local attacker could use this to expose sensitive information     (kernel memory) or possibly execute arbitrary code. (CVE-2018-8781)

    Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A     remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system     crash) or possibly execute arbitrary code. (CVE-2018-8822)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed :

  - CVE-2018-1087: And an unprivileged KVM guest user could     use this flaw to potentially escalate their privileges     inside a guest. (bsc#1087088)

  - CVE-2018-8897: An unprivileged system user could use     incorrect set up interrupt stacks to crash the Linux     kernel resulting in DoS issue. (bsc#1087088)

  - CVE-2018-10124: The kill_something_info function in     kernel/signal.c might allow local users to cause a     denial of service via an INT_MIN argument (bnc#1089752).

  - CVE-2018-10087: The kernel_wait4 function in     kernel/exit.c might allow local users to cause a denial     of service by triggering an attempted use of the
    -INT_MIN value (bnc#1089608).

  - CVE-2018-7757: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c allowed     local users to cause a denial of service (memory     consumption) via many read accesses to files in the     /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file     (bnc#1084536 1087209).

  - CVE-2018-7566: A Buffer Overflow via an     SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to     /dev/snd/seq by a local user was fixed (bnc#1083483).

  - CVE-2017-0861: Use-after-free vulnerability in the     snd_pcm_info function in the ALSA subsystem allowed     attackers to gain privileges via unspecified vectors     (bnc#1088260).

  - CVE-2018-8822: Incorrect buffer length handling in the     ncp_read_kernel function in fs/ncpfs/ncplib_kernel.c     could be exploited by malicious NCPFS servers to crash     the kernel or execute code (bnc#1086162).

  - CVE-2017-13166: An elevation of privilege vulnerability     in the kernel v4l2 video driver. (bnc#1072865).

  - CVE-2017-18203: The dm_get_from_kobject function in     drivers/md/dm.c allow local users to cause a denial of     service (BUG) by leveraging a race condition with
    __dm_destroy during creation and removal of DM devices     (bnc#1083242).

  - CVE-2017-16911: The vhci_hcd driver allowed allows local     attackers to disclose kernel memory addresses.
    Successful exploitation requires that a USB device is     attached over IP (bnc#1078674).

  - CVE-2017-18208: The madvise_willneed function in     mm/madvise.c allowed local users to cause a denial of     service (infinite loop) by triggering use of     MADVISE_WILLNEED for a DAX mapping (bnc#1083494).

  - CVE-2017-16644: The hdpvr_probe function in     drivers/media/usb/hdpvr/hdpvr-core.c allowed local users     to cause a denial of service (improper error handling     and system crash) or possibly have unspecified other     impact via a crafted USB device (bnc#1067118).

  - CVE-2018-6927: The futex_requeue function in     kernel/futex.c might allow attackers to cause a denial     of service (integer overflow) or possibly have     unspecified other impact by triggering a negative wake     or requeue value (bnc#1080757).

  - CVE-2017-16914: The 'stub_send_ret_submit()' function     (drivers/usb/usbip/stub_tx.c) allowed attackers to cause     a denial of service (NULL pointer dereference) via a     specially crafted USB over IP packet (bnc#1078669).

  - CVE-2016-7915: The hid_input_field function in     drivers/hid/hid-core.c allowed physically proximate     attackers to obtain sensitive information from kernel     memory or cause a denial of service (out-of-bounds read)     by connecting a device, as demonstrated by a Logitech DJ     receiver (bnc#1010470).

  - CVE-2015-5156: The virtnet_probe function in     drivers/net/virtio_net.c attempted to support a FRAGLIST     feature without proper memory allocation, which allowed     guest OS users to cause a denial of service (buffer     overflow and memory corruption) via a crafted sequence     of fragmented packets (bnc#940776).

  - CVE-2017-12190: The bio_map_user_iov and bio_unmap_user     functions in block/bio.c did unbalanced refcounting when     a SCSI I/O vector has small consecutive buffers     belonging to the same page. The bio_add_pc_page function     merges them into one, but the page reference is never     dropped. This causes a memory leak and possible system     lockup (exploitable against the host OS by a guest OS     user, if a SCSI disk is passed through to a virtual     machine) due to an out-of-memory condition     (bnc#1062568).

  - CVE-2017-16912: The 'get_pipe()' function     (drivers/usb/usbip/stub_rx.c) allowed attackers to cause     a denial of service (out-of-bounds read) via a specially     crafted USB over IP packet (bnc#1078673).

  - CVE-2017-16913: The 'stub_recv_cmd_submit()' function     (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT     packets allowed attackers to cause a denial of service     (arbitrary memory allocation) via a specially crafted     USB over IP packet (bnc#1078672).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-3697-2 advisory.

    It was discovered that a null pointer dereference vulnerability existed in the DCCP protocol     implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system     crash). (CVE-2018-1130)

    Jann Horn discovered that the 32 bit adjtimex() syscall implementation for 64 bit Linux kernels did not     properly initialize memory returned to user space in some situations. A local attacker could use this to     expose sensitive information (kernel memory). (CVE-2018-11508)

    Wang Qize discovered that an information disclosure vulnerability existed in the SMBus driver for ACPI     Embedded Controllers in the Linux kernel. A local attacker could use this to expose sensitive information     (kernel pointer addresses). (CVE-2018-5750)

    It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate     userspace provided payload lengths in some situations. A local attacker could use this to cause a denial     of service (system crash). (CVE-2018-5803)

    It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel.
    A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927)

    It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel.
    A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755)

    It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local     attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.156 to receive various security and bugfixes.

The following security bugs were fixed :

CVE-2018-16597: Incorrect access checking in overlayfs mounts could have been used by local attackers to modify or truncate files in the underlying filesystem (bnc#1106512).

CVE-2018-14613: Prevent invalid pointer dereference in io_ctl_map_page() when mounting and operating a crafted btrfs image, caused by a lack of block group item validation in check_leaf_item (bsc#1102896)

CVE-2018-14617: Prevent NULL pointer dereference and panic in hfsplus_lookup() when opening a file (that is purportedly a hard link) in an hfs+ filesystem that has malformed catalog data, and is mounted read-only without a metadata directory (bsc#1102870)

CVE-2018-16276: Incorrect bounds checking in the yurex USB driver in yurex_read allowed local attackers to use user access read/writes to crash the kernel or potentially escalate privileges (bsc#1106095)

CVE-2018-7757: Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c allowed local users to cause a denial of service (memory consumption) via many read accesses to files in the /sys/class/sas_phy directory, as demonstrated by the /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file (bnc#1084536)

CVE-2018-7480: The blkcg_init_queue function allowed local users to cause a denial of service (double free) or possibly have unspecified other impact by triggering a creation failure (bsc#1082863).

CVE-2018-17182: The vmacache_flush_all function in mm/vmacache.c mishandled sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations (bnc#1108399).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities :

  - The do_get_mempolicy() function in 'mm/mempolicy.c' in     the Linux kernel allows local users to hit a     use-after-free bug via crafted system calls and thus     cause a denial of service (DoS) or possibly have     unspecified other impact. Due to the nature of the     flaw, privilege escalation cannot be fully ruled out.

  - It was found that AIO interface didn't use the proper     rw_verify_area() helper function with extended     functionality, for example, mandatory locking on the     file. Also rw_verify_area() makes extended checks, for     example, that the size of the access doesn't cause     overflow of the provided offset limits. This integer     overflow in fs/aio.c in the Linux kernel before 3.4.1     allows local users to cause a denial of service or     possibly have unspecified other impact via a large AIO     iovec.

  - Integer overflow in the aio_setup_single_vector     function in fs/aio.c in the Linux kernel 4.0 allows     local users to cause a denial of service or possibly     have unspecified other impact via a large AIO iovec.
    NOTE: this vulnerability exists because of a     CVE-2012-6701 regression.

  - A flaw was found in the Linux kernel key management     subsystem in which a local attacker could crash the     kernel or corrupt the stack and additional memory     (denial of service) by supplying a specially crafted     RSA key. This flaw panics the machine during the     verification of the RSA key.

  - A race condition leading to a NULL pointer dereference     was found in the Linux kernel's Link Layer Control     implementation. A local attacker with access to ping     sockets could use this flaw to crash the system.

  - It was found that the original fix for CVE-2016-6786     was incomplete. There exist a race between two     concurrent sys_perf_event_open() calls when both try     and move the same pre-existing software group into a     hardware context.

  - Incorrect error handling in the set_mempolicy() and     mbind() compat syscalls in 'mm/mempolicy.c' in the     Linux kernel allows local users to obtain sensitive     information from uninitialized stack data by triggering     failure of a certain bitmap operation.

  - The mm subsystem in the Linux kernel through 4.10.10     does not properly enforce the CONFIG_STRICT_DEVMEM     protection mechanism, which allows local users to read     or write to kernel memory locations in the first     megabyte (and bypass slab-allocation access     restrictions) via an application that opens the     /dev/mem file, related to arch/x86/mm/init.c and     drivers/char/mem.c.

  - It was found that in the Linux kernel through     v4.14-rc5, bio_map_user_iov() and bio_unmap_user() in     'block/bio.c' do unbalanced pages refcounting if IO     vector has small consecutive buffers belonging to the     same page. bio_add_pc_page() merges them into one, but     the page reference is never dropped, causing a memory     leak and possible system lockup due to out-of-memory     condition.

  - The Linux kernel, before version 4.14.3, is vulnerable     to a denial of service in     drivers/md/dm.c:dm_get_from_kobject() which can be     caused by local users leveraging a race condition with
    __dm_destroy() during creation and removal of DM     devices. Only privileged local users (with     CAP_SYS_ADMIN capability) can directly perform the     ioctl operations for dm device creation and removal and     this would typically be outside the direct control of     the unprivileged attacker.

  - An error in the '_sctp_make_chunk()' function     (net/sctp/sm_make_chunk.c) when handling SCTP, packet     length can be exploited by a malicious local user to     cause a kernel crash and a DoS.

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.

Note that Tenable Network Security has extracted the preceding description block directly from the Virtuozzo security advisory.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - A flaw named FragmentSmack was found in the way the     Linux kernel handled reassembly of fragmented IPv4 and     IPv6 packets. A remote attacker could use this flaw to     trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted     packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

  - kernel: out-of-bounds access in the show_timer function     in kernel/time /posix-timers.c (CVE-2017-18344)

  - kernel: Integer overflow in udl_fb_mmap() can allow     attackers to execute code in kernel space     (CVE-2018-8781)

  - kernel: MIDI driver race condition leads to a     double-free (CVE-2018-10902)

  - kernel: Missing check in inode_init_owner() does not     clear SGID bit on non-directories for non-members     (CVE-2018-13405)

  - kernel: AIO write triggers integer overflow in some     protocols (CVE-2015-8830)

  - kernel: Use-after-free in snd_pcm_info function in ALSA     subsystem potentially leads to privilege escalation     (CVE-2017-0861)

  - kernel: Handling of might_cancel queueing is not     properly pretected against race (CVE-2017-10661)

  - kernel: Salsa20 encryption algorithm does not correctly     handle zero- length inputs allowing local attackers to     cause denial of service (CVE-2017-17805)

  - kernel: Inifinite loop vulnerability in     madvise_willneed() function allows local denial of     service (CVE-2017-18208)

  - kernel: fuse-backed file mmap-ed onto process cmdline     arguments causes denial of service (CVE-2018-1120)

  - kernel: a NULL pointer dereference in dccp_write_xmit()     leads to a system crash (CVE-2018-1130)

  - kernel: drivers/block/loop.c mishandles lo_release     serialization allowing denial of service (CVE-2018-5344)

  - kernel: Missing length check of payload in
    _sctp_make_chunk() function allows denial of service     (CVE-2018-5803)

  - kernel: buffer overflow in     drivers/net/wireless/ath/wil6210/wmi.c:wmi_set_ie() may     lead to memory corruption (CVE-2018-5848)

  - kernel: out-of-bound write in ext4_init_block_bitmap     function with a crafted ext4 image (CVE-2018-10878)

  - kernel: Improper validation in bnx2x network card driver     can allow for denial of service attacks via crafted     packet (CVE-2018-1000026)

  - kernel: Information leak when handling NM entries     containing NUL (CVE-2016-4913)

  - kernel: Mishandling mutex within libsas allowing local     Denial of Service (CVE-2017-18232)

  - kernel: NULL pointer dereference in     ext4_process_freed_data() when mounting crafted ext4     image (CVE-2018-1092)

  - kernel: NULL pointer dereference in     ext4_xattr_inode_hash() causes crash with crafted ext4     image (CVE-2018-1094)

  - kernel: vhost: Information disclosure in     vhost/vhost.c:vhost_new_msg() (CVE-2018-1118)

  - kernel: Denial of service in resv_map_release function     in mm/hugetlb.c (CVE-2018-7740)

  - kernel: Memory leak in the sas_smp_get_phy_events     function in drivers/scsi/libsas/sas_expander.c     (CVE-2018-7757)

  - kernel: Invalid pointer dereference in     xfs_ilock_attr_map_shared() when mounting crafted xfs     image allowing denial of service (CVE-2018-10322)

  - kernel: use-after-free detected in ext4_xattr_set_entry     with a crafted file (CVE-2018-10879)

  - kernel: out-of-bound access in ext4_get_group_info()     when mounting and operating a crafted ext4 image     (CVE-2018-10881)

  - kernel: stack-out-of-bounds write in     jbd2_journal_dirty_metadata function (CVE-2018-10883)

  - kernel: incorrect memory bounds check in     drivers/cdrom/cdrom.c (CVE-2018-10940)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux     kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read     accesses to files in the /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file. (CVE-2018-7757)

Note that Nessus relies on the presence of the package as reported by the vendor.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003513 advisory.

    Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux     kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read     accesses to files in the /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001535 advisory.

    Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux     kernel through 4.15.7 allows local users to cause a denial of service (memory consumption) via many read     accesses to files in the /sys/class/sas_phy directory, as demonstrated by the     /sys/class/sas_phy/phy-1:0:12/invalid_dword_count file.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2948 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

    * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and calculation expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within     ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system.
    Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open     port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/3658021

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for     reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200; and Wen Xu for reporting     CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer     (Red Hat) and Ondrej Mosnacek (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the Linux kernel's perf     subsystem retrieved userlevel stack traces on PowerPC     systems. A local, unprivileged user could use this flaw     to cause a denial of service on the system by creating     a special stack layout that would force the     perf_callchain_user_64() function into an infinite     loop.(CVE-2015-6526i1/4%0

  - A vulnerability was found in the Linux kernel. Payloads     of NM entries are not supposed to contain NUL. When     such entry is processed, only the part prior to the     first NUL goes into the concatenation (i.e. the     directory entry name being encoded by a bunch of NM     entries). The process stops when the amount collected     so far + the claimed amount in the current NM entry     exceed 254. However, the value returned as the total     length is the sum of *claimed* sizes, not the actual     amount collected. And that's what will be passed to     readdir() callback as the name length - 8Kb
    __copy_to_user() from a buffer allocated by
    __get_free_page().(CVE-2016-4913i1/4%0

  - The perf_trace_event_perm function in     kernel/trace/trace_event_perf.c in the Linux kernel     before 3.12.2 does not properly restrict access to the     perf subsystem, which allows local users to enable     function tracing via a crafted     application.(CVE-2013-2930i1/4%0

  - The mincore() implementation in mm/mincore.c in the     Linux kernel through 4.19.13 allowed local attackers to     observe page cache access patterns of other processes     on the same system, potentially allowing sniffing of     secret information. (Fixing this affects the output of     the fincore program.) Limited remote exploitation may     be possible, as demonstrated by latency differences in     accessing public files from an Apache HTTP     Server.(CVE-2019-5489i1/4%0

  - It was found that the espfix functionality could be     bypassed by installing a 16-bit RW data segment into     GDT instead of LDT (which espfix checks), and using     that segment on the stack. A local, unprivileged user     could potentially use this flaw to leak kernel stack     addresses.(CVE-2014-8133i1/4%0

  - An issue was discovered in the btrfs filesystem code in     the Linux kernel. An out-of-bounds access is possible     in write_extent_buffer() when mounting and operating a     crafted btrfs image due to a lack of verification at     mount time within the btrfs_read_block_groups() in     fs/btrfs/extent-tree.c function. This could lead to a     system crash and a denial of service.(CVE-2018-14610i1/4%0

  - kernel/bpf/verifier.c in the Linux kernel through     4.14.8 mishandles states_equal comparisons between the     pointer data type and the UNKNOWN_VALUE data type,     which allows local users to obtain potentially     sensitive address information, aka a 'pointer     leak.'(CVE-2017-17864i1/4%0

  - drivers/hid/hid-lenovo-tpkbd.c in the Human Interface     Device (HID) subsystem in the Linux kernel through     3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows     physically proximate attackers to cause a denial of     service (heap-based out-of-bounds write) via a crafted     device.(CVE-2013-2894i1/4%0

  - Memory leak in the sas_smp_get_phy_events function in     drivers/scsi/libsas/sas_expander.c in the Linux kernel     allows local users to cause a denial of service (kernel     memory exhaustion) via multiple read accesses to files     in the /sys/class/sas_phy directory.(CVE-2018-7757i1/4%0

  - It was found that the original fix for CVE-2016-6786     was incomplete. There exist a race between two     concurrent sys_perf_event_open() calls when both try     and move the same pre-existing software group into a     hardware context.(CVE-2017-6001i1/4%0

  - In the Linux kernel before 4.20.12,     net/ipv4/netfilter/nf_nat_snmp_basic_main.c in the SNMP     NAT module has insufficient ASN.1 length checks (aka an     array index error), making out-of-bounds read and write     operations possible, leading to an OOPS or local     privilege escalation. This affects snmp_version and     snmp_helper.(CVE-2019-9162i1/4%0

  - An information leak flaw was found in the way the Linux     kernel's Advanced Linux Sound Architecture (ALSA)     implementation handled access of the user control's     state. A local, privileged user could use this flaw to     leak kernel memory to user space.(CVE-2014-4652i1/4%0

  - A flaw was found that the vfs_rename() function did not     detect hard links on overlayfs. A local, unprivileged     user could use the rename syscall on overlayfs on top     of xfs to crash the system.(CVE-2016-6198i1/4%0

  - It was found that when file permissions were modified     via chmod and the user modifying them was not in the     owning group or capable of CAP_FSETID, the setgid bit     would be cleared. Setting a POSIX ACL via setxattr sets     the file permissions as well as the new ACL, but     doesn't clear the setgid bit in a similar way. This     could allow a local user to gain group privileges via     certain setgid applications.(CVE-2016-7097i1/4%0

  - A flaw was found in the way the Linux kernel's Crypto     subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed     kernel module, and thus increase the attack surface of     the running kernel.(CVE-2014-9644i1/4%0

  - An arbitrary memory r/w access issue was found in the     Linux kernel compiled with the eBPF bpf(2) system call     (CONFIG_BPF_SYSCALL) support. The issue could occur due     to calculation errors in the eBPF verifier module,     triggered by user supplied malicious BPF program. An     unprivileged user could use this flaw to escalate their     privileges on a system. Setting parameter     'kernel.unprivileged_bpf_disabled=1' prevents such     privilege escalation by restricting access to bpf(2)     call.(CVE-2017-16995i1/4%0

  - A flaw was found in the implementation of associative     arrays where the add_key systemcall and KEYCTL_UPDATE     operations allowed for a NULL payload with a nonzero     length. When accessing the payload within this length     parameters value, an unprivileged user could trivially     cause a NULL pointer dereference (kernel     oops).(CVE-2017-15274i1/4%0

  - A flaw was found in the Linux kernel's keyring handling     code: the key_reject_and_link() function could be     forced to free an arbitrary memory block. An attacker     could use this flaw to trigger a use-after-free     condition on the system, potentially allowing for     privilege escalation.(CVE-2016-4470i1/4%0

  - A flaw was found in the way certain interfaces of the     Linux kernel's Infiniband subsystem used write() as     bi-directional ioctl() replacement, which could lead to     insufficient memory security checks when being invoked     using the splice() system call. A local unprivileged     user on a system with either Infiniband hardware     present or RDMA Userspace Connection Manager Access     module explicitly loaded, could use this flaw to     escalate their privileges on the     system.(CVE-2016-4565i1/4%0

  - It was found that the Linux kernel's IPv6 network stack     did not properly validate the value of the MTU variable     when it was set. A remote attacker could potentially     use this flaw to disrupt a target system's networking     (packet loss) by setting an invalid MTU value, for     example, via a NetworkManager daemon that is processing     router advertisement packets running on the target     system.(CVE-2015-8215i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117569	EulerOS Virtualization 2.5.0 : kernel (EulerOS-SA-2018-1260)	Nessus	Huawei Local Security Checks	2018/9/18	2024/8/6	high
288488	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003609)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
109517	Debian DSA-4187-1 : linux - security update (Spectre)	Nessus	Debian Local Security Checks	2018/5/2	2024/10/15	critical
109518	Debian DSA-4188-1 : linux - security update (Spectre)	Nessus	Debian Local Security Checks	2018/5/2	2024/10/15	high
110049	Ubuntu 14.04 LTS : Linux kernel (Xenial HWE) vulnerabilities (USN-3654-2)	Nessus	Ubuntu Local Security Checks	2018/5/23	2026/1/12	high
110051	Ubuntu 16.04 LTS : Linux kernel (Raspberry Pi 2, Snapdragon) vulnerabilities (USN-3656-1)	Nessus	Ubuntu Local Security Checks	2018/5/23	2024/8/27	high
109646	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1172-1)	Nessus	SuSE Local Security Checks	2018/5/9	2024/10/11	high
110899	Ubuntu 16.04 LTS : Linux kernel (OEM) vulnerabilities (USN-3697-2)	Nessus	Ubuntu Local Security Checks	2018/7/3	2024/8/27	high
117933	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:3003-1)	Nessus	SuSE Local Security Checks	2018/10/5	2024/8/1	high
110694	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-041)	Nessus	Virtuozzo Local Security Checks	2018/6/26	2024/9/16	high
119187	Scientific Linux Security Update : kernel on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	2018/11/27	2024/7/18	high
221809	Linux Distros Unpatched Vulnerability : CVE-2018-7757	Nessus	Misc.	2025/3/4	2026/7/17	medium
286355	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003513)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	medium
291140	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001535)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	medium
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	2018/10/31	2026/1/9	high
124985	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1532)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	high

检测

插件搜索

high

medium

critical

high

high

high

high

high

high

high

high

medium

medium

medium

high

high