Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - 4.12.9 までの Linux カーネルの drivers/acpi/acpica/psobject.c の acpi_ps_complete_final_op() 関数が、node および node_ext キャッシュをフラッシュせず、カーネルスタックダンプを引き起こします。これにより、ローカルユーザーは、カーネルメモリおよび細工された ACPI テーブルを介して 4.9（までのカーネルの）KASLR 保護メカニズムをバイパスします。 （CVE-2017-13694）

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 之前的 Linux 核心中，drivers/acpi/acpica/psobject.c 的 acpi_ps_complete_final_op() 函式 4.12.9 未排清 node 和 node_ext 快取，並造成核心堆疊轉儲存，其允許本機使用者從核心記憶體取得敏感資訊，以及透過特製的 ACPI 表格繞過 KASLR 保護機制 (在 到 4.9之前的核心中)。 (CVE-2017-13694)

請注意，Nessus 依賴供應商報告的套件存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 4.12.9 及之前版本的 Linux 内核中 drivers/acpi/acpica/psobject.c 中的 acpi_ps_complete_final_op() 函数未刷新 node 和 node_ext 缓存，并导致内核堆栈转储，从而允许本地用户从内核内存和通过特制的 ACPI 表绕过 KASLR 保护机制（在内核到 4.9之前的版本）。 (CVE-2017-13694)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in the Linux kernel before     5.1.8. There is a double-free caused by a malicious USB     device in the drivers/usb/misc/rio500.c     driver.(CVE-2019-15212)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a use-after-free caused by a malicious     USB device in the     drivers/media/usb/dvb-usb/dvb-usb-init.c     driver.(CVE-2019-15213)

  - An issue was discovered in the Linux kernel before     5.2.6. There is a use-after-free caused by a malicious     USB device in the drivers/media/usb/cpia2/cpia2_usb.c     driver.(CVE-2019-15215)

  - An issue was discovered in the Linux kernel before     5.0.14. There is a NULL pointer dereference caused by a     malicious USB device in the drivers/usb/misc/yurex.c     driver.(CVE-2019-15216)

  - An issue was discovered in the Linux kernel before     5.2.3. There is a NULL pointer dereference caused by a     malicious USB device in the     drivers/media/usb/zr364xx/zr364xx.c     driver.(CVE-2019-15217)

  - An issue was discovered in drivers/scsi/qedi/qedi_dbg.c     in the Linux kernel before 5.1.12. In the qedi_dbg_*     family of functions, there is an out-of-bounds     read.(CVE-2019-15090)

  - An issue was discovered in the Linux kernel before     4.14.11. A double free may be caused by the function     allocate_trace_buffer in the file     kernel/trace/trace.c.(CVE-2017-18595)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - Heap-based buffer overflow in the     logi_dj_ll_raw_request function in     drivers/hid/hid-logitech-dj.c in the Linux kernel     before 3.16.2 allows physically proximate attackers to     cause a denial of service (system crash) or possibly     execute arbitrary code via a crafted device that     specifies a large report size for an LED     report.(CVE-2014-3183)

  - An issue was discovered in the Linux kernel before     5.0.5. There is a use-after-free issue when     hci_uart_register_dev() fails in hci_uart_set_proto()     in drivers/bluetooth/hci_ldisc.c.(CVE-2019-15917)

  - An issue was discovered in the Linux kernel before     5.0.10. There is a use-after-free in the sound     subsystem because card disconnection causes certain     data structures to be deleted too early. This is     related to sound/core/init.c and     sound/core/info.c.(CVE-2019-15214)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The acpi_ps_complete_final_op() function in drivers/acpi/acpica/psobject.c in the Linux kernel through     4.12.9 does not flush the node and node_ext caches and causes a kernel stack dump, which allows local     users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the     kernel through 4.9) via a crafted ACPI table. (CVE-2017-13694)

Note that Nessus relies on the presence of the package as reported by the vendor.

CVE-2017-13693、CVE-2017-13694、CVE-2017-13695のセキュリティ修正。

これは、ユーザー空間ACPICAツールのみの修正を提供します。カーネルの更新はすべて個別に処理されます。

この更新には、20190209バージョンのUpstreamソースへのアップグレードも含まれています。 

---------------------------------------- 2018年2月9日。バージョン20180209の変更のサマリー：

1）ACPICAカーネル常駐サブシステム：

パッケージオブジェクト処理およびモジュールレベルのAMLコードサポートに対する最近の変更の最終統合を完了しました。これにより、パッケージオブジェクトがモジュールレベルのコードブロック内から宣言されたときに、個々のパッケージ要素からの前方参照が可能になります。他のACPI実装との互換性を提供します。

AMLモジュールレベルのコードの新しいアーキテクチャが完成し、現在ACPICAコードのデフォルトになっています。この新しいアーキテクチャは、テーブルが完全にロードされるまでこのコードを保留していた以前のアーキテクチャの代わりに、ACPIテーブルがロード/解析されると、モジュールレベルのコードをインラインで実行します。これにより、一部のASLコード順序の問題が解決され、他のACPI実装との互換性が提供されます。現時点で、以前のアーキテクチャにフォールバックするオプションがありますが、このサポートは廃止予定であり、今年後半に完全に削除される予定です。

パッケージオブジェクト内の名前付き参照要素の解決中にAE_NOT_FOUND例外を無視するためのコンパイル時オプションを追加しました。
これは深刻な問題の可能性がありますが、ファームウェアが未使用のパッケージオブジェクトを大量に処理するプラットフォームでは、多くのノイズ/エラーが発生する可能性があります。これらのエラーを無効にするには、OS固有のヘッダーでACPI_IGNORE_PACKAGE_RESOLUTION_ERRORSを定義します。AcpiExecなどのACPICAアプリケーションでは、必ずすべてのエラーが報告されます。

明示的型変換AML演算子に関連する不具合を修正しました（ToXXXX）。この不具合は2017年の早い時期に導入されましたが、最近まで確認されていませんでした。これは、このような演算子が他のACPI実装で完全にサポートされておらず、ファームウェア開発者によって使用されることがほとんどなかったためです。演算子は、「暗黙的結果オブジェクト変換」を実装しないようにACPI仕様で定義されています。この不具合は、以下の明示的変換演算子に対して、このオブジェクト変換が不適切に導入されていました：

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2）iASLコンパイラ/逆アセンブラとツール：

iASL：ToXXXXの明示的変換演算子に関連したコンパイラ定数畳み込み機能に伴う問題を修正しました。これらの演算子は、定義によって「暗黙的結果オブジェクト変換」をサポートしません。
したがって、これらの演算子を使用するASL式を単純なStore演算子に畳み込むことはできません。これは、Store演算子は暗黙的変換を実装しているためです。この変更では、代わりにToXXXX演算子畳み込みにCopyObject演算子が使用されます。CopyObjectは、暗黙的結果変換を実装しないように定義されているため、ToXXXX演算子の畳み込みに適しています。

iASL：シンボルがローカルでと外部シンボルとしての両方で宣言されている場合は、エラー状態の深刻度を単純な警告に変更しました。これは、既存のASLコードに適合します。

AcpiExec：モジュールレベルのコードの新しいアーキテクチャを有効にするための-epオプションが削除されました。これは、逆の効果を持つ-dpオプションに置き換えられています：これは、新しいアーキテクチャ（デフォルト）を無効にし、レガシーアーキテクチャを有効にします。レガシーコードが今後削除された場合は、-dpオプションも削除されます。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

Security fix for CVE-2017-13693, CVE-2017-13694, CVE-2017-13695.

This provides fixes for the user space ACPICA tools only. Any kernel updates are handled separately.

This update also includes the upgrade to the 20190209 version of the upstream source. 

---------------------------------------- 09 February 2018. Summary of changes for version 20180209 :

1) ACPICA kernel-resident subsystem :

Completed the final integration of the recent changes to Package Object handling and the module-level AML code support. This allows forward references from individual package elements when the package object is declared from within module-level code blocks. Provides compatibility with other ACPI implementations.

The new architecture for the AML module-level code has been completed and is now the default for the ACPICA code. This new architecture executes the module-level code in-line as the ACPI table is loaded/parsed instead of the previous architecture which deferred this code until after the table was fully loaded. This solves some ASL code ordering issues and provides compatibility with other ACPI implementations. At this time, there is an option to fallback to the earlier architecture, but this support is deprecated and is planned to be completely removed later this year.

Added a compile-time option to ignore AE_NOT_FOUND exceptions during resolution of named reference elements within Package objects.
Although this is potentially a serious problem, it can generate a lot of noise/errors on platforms whose firmware carries around a bunch of unused Package objects. To disable these errors, define ACPI_IGNORE_PACKAGE_RESOLUTION_ERRORS in the OS-specific header. All errors are always reported for ACPICA applications such as AcpiExec.

Fixed a regression related to the explicit type-conversion AML operators (ToXXXX). The regression was introduced early in 2017 but was not seen until recently because these operators are not fully supported by other ACPI implementations and are thus rarely used by firmware developers. The operators are defined by the ACPI specification to not implement the 'implicit result object conversion'. The regression incorrectly introduced this object conversion for the following explicit conversion operators :

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2) iASL Compiler/Disassembler and Tools :

iASL: Fixed a problem with the compiler constant folding feature as related to the ToXXXX explicit conversion operators. These operators do not support the 'implicit result object conversion' by definition.
Thus, ASL expressions that use these operators cannot be folded to a simple Store operator because Store implements the implicit conversion. This change uses the CopyObject operator for the ToXXXX operator folding instead. CopyObject is defined to not implement implicit result conversions and is thus appropriate for folding the ToXXXX operators.

iASL: Changed the severity of an error condition to a simple warning for the case where a symbol is declared both locally and as an external symbol. This accommodates existing ASL code.

AcpiExec: The -ep option to enable the new architecture for module-level code has been removed. It is replaced by the -dp option which instead has the opposite effect: it disables the new architecture (the default) and enables the legacy architecture. When the legacy code is removed in the future, the -dp option will be removed also.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The iscsi_if_rx function in     drivers/scsi/scsi_transport_iscsi.c in the Linux kernel     through 4.13.2 allows local users to cause a denial of     service (panic) by leveraging incorrect length     validation.(CVE-2017-14489)

  - The move_pages system call in mm/migrate.c in the Linux     kernel before 4.12.9 doesn't check the effective uid of     the target process, enabling a local attacker to learn     the memory layout of a setuid executable despite     ASLR.(CVE-2017-14140)

  - The offset2lib patch as used in the Linux Kernel     contains a vulnerability that allows a PIE binary to be     execve()'ed with 1GB of arguments or environmental     strings then the stack occupies the address 0x80000000     and the PIE binary is mapped above 0x40000000     nullifying the protection of the offset2lib patch. This     affects Linux Kernel version 4.11.5 and earlier. This     is a different issue than CVE-2017-1000371. This issue     appears to be limited to i386 based     systems.(CVE-2017-1000370)

  - Race condition in fs/timerfd.c in the Linux kernel     before 4.10.15 allows local users to gain privileges or     cause a denial of service (list corruption or     use-after-free) via simultaneous file-descriptor     operations that leverage improper might_cancel     queueing.(CVE-2017-10661)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - The tcp_disconnect function in net/ipv4/tcp.c in the     Linux kernel before 4.12 allows local users to cause a     denial of service (__tcp_select_window divide-by-zero     error and system crash) by triggering a disconnect     within a certain tcp_recvmsg code path.(CVE-2017-14106)

  - The native Bluetooth stack in the Linux Kernel (BlueZ),     starting at the Linux kernel version 3.3-rc1 and up to     and including 4.13.1, are vulnerable to a stack     overflow vulnerability in the processing of L2CAP     configuration responses resulting in Remote code     execution in kernel space.(CVE-2017-1000251

  - )

  - The prepare_vmcs02 function in arch/x86/kvm/vmx.c in     the Linux kernel through 4.13.3 does not ensure that     the 'CR8-load exiting' and 'CR8-store exiting' L0     vmcs02 controls exist in cases where L1 omits the 'use     TPR shadow' vmcs12 control, which allows KVM L2 guest     OS users to obtain read and write access to the     hardware CR8 register.(CVE-2017-12154)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

4.12.11 stable カーネルの更新には、多岐にわたる重要なバグ修正が多く含まれています。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

CVE-2017-13693、CVE-2017-13694、CVE-2017-13695のセキュリティ修正。

これは、ユーザー空間ACPICAツールのみの修正を提供します。カーネルの更新はすべて個別に処理されます。

この更新には、20190209バージョンのUpstreamソースへのアップグレードも含まれています。 

---------------------------------------- 2018年2月9日。バージョン20180209の変更のサマリー：

1）ACPICAカーネル常駐サブシステム：

パッケージオブジェクト処理およびモジュールレベルのAMLコードサポートに対する最近の変更の最終統合を完了しました。これにより、パッケージオブジェクトがモジュールレベルのコードブロック内から宣言されたときに、個々のパッケージ要素からの前方参照が可能になります。他のACPI実装との互換性を提供します。

AMLモジュールレベルのコードの新しいアーキテクチャが完成し、現在ACPICAコードのデフォルトになっています。この新しいアーキテクチャは、テーブルが完全にロードされるまでこのコードを保留していた以前のアーキテクチャの代わりに、ACPIテーブルがロード/解析されると、モジュールレベルのコードをインラインで実行します。これにより、一部のASLコード順序の問題が解決され、他のACPI実装との互換性が提供されます。現時点で、以前のアーキテクチャにフォールバックするオプションがありますが、このサポートは廃止予定であり、今年後半に完全に削除される予定です。

パッケージオブジェクト内の名前付き参照要素の解決中にAE_NOT_FOUND例外を無視するためのコンパイル時オプションを追加しました。
これは深刻な問題の可能性がありますが、ファームウェアが未使用のパッケージオブジェクトを大量に処理するプラットフォームでは、多くのノイズ/エラーが発生する可能性があります。これらのエラーを無効にするには、OS固有のヘッダーでACPI_IGNORE_PACKAGE_RESOLUTION_ERRORSを定義します。AcpiExecなどのACPICAアプリケーションでは、必ずすべてのエラーが報告されます。

明示的型変換AML演算子に関連する不具合を修正しました（ToXXXX）。この不具合は2017年の早い時期に導入されましたが、最近まで確認されていませんでした。これは、このような演算子が他のACPI実装で完全にサポートされておらず、ファームウェア開発者によって使用されることがほとんどなかったためです。演算子は、「暗黙的結果オブジェクト変換」を実装しないようにACPI仕様で定義されています。この不具合では、以下の明示的変換演算子にこのオブジェクト変換が誤って導入されました：

  - ToInteger

  - ToString

  - ToBuffer

  - ToDecimalString

  - ToHexString

  - ToBCD

  - FromBCD

2）iASLコンパイラ/逆アセンブラとツール：

iASL：ToXXXXの明示的変換演算子に関連したコンパイラ定数畳み込み機能に伴う問題を修正しました。これらの演算子は、定義によって「暗黙的結果オブジェクト変換」をサポートしません。
したがって、これらの演算子を使用するASL式を単純なStore演算子に畳み込むことはできません。これは、Store演算子は暗黙的変換を実装しているためです。この変更では、代わりにToXXXX演算子畳み込みにCopyObject演算子が使用されます。CopyObjectは、暗黙的結果変換を実装しないように定義されているため、ToXXXX演算子の畳み込みに適しています。

iASL：シンボルがローカルでと外部シンボルとしての両方で宣言されている場合は、エラー状態の深刻度を単純な警告に変更しました。これは、既存のASLコードに適合します。

AcpiExec：モジュールレベルのコードの新しいアーキテクチャを有効にするための-epオプションが削除されました。これは、逆の効果を持つ-dpオプションに置き換えられています：これは、新しいアーキテクチャ（デフォルト）を無効にし、レガシーアーキテクチャを有効にします。レガシーコードが今後削除された場合は、-dpオプションも削除されます。

注意：Tenable Network Securityは、前述の記述ブロックをFedora更新システムのWebサイトから直接抽出しています。
Tenableでは、新たな問題を持ち込まずに、できる限り自動的に整理して書式設定するようにしています。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A memory corruption flaw was found in the way the USB     ConnectTech WhiteHEAT serial driver processed     completion commands sent via USB Request Blocks     buffers. An attacker with physical access to the system     could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-3185i1/4%0

  - Use-after-free vulnerability in the msm_set_crop     function in drivers/media/video/msm/msm_camera.c in the     MSM-Camera driver for the Linux kernel 3.x, as used in     Qualcomm Innovation Center (QuIC) Android contributions     for MSM devices and other products, allows attackers to     gain privileges or cause a denial of service (memory     corruption) via an application that makes a crafted     ioctl call.(CVE-2015-0568i1/4%0

  - The vivid_fb_ioctl function in     drivers/media/platform/vivid/vivid-osd.c in the Linux     kernel through 4.3.3 does not initialize a certain     structure member, which allows local users to obtain     sensitive information from kernel memory via a crafted     application.(CVE-2015-7884i1/4%0

  - The usb_get_bos_descriptor function in     drivers/usb/core/config.c in the Linux kernel can allow     a local users to cause a denial of service     (out-of-bounds read and system crash) or possibly have     unspecified other impact via a crafted USB     device.(CVE-2017-16535i1/4%0

  - The ACPI parsing functionality in the Linux kernel does     not flush the node and node_ext caches which causes a     kernel stack dump. This allows local users to obtain     sensitive information from kernel memory and use this     information to bypass the KASLR protection mechanism by     creating and applying crafted ACPI     table.(CVE-2017-13694i1/4%0

  - The is_ashmem_file function in     drivers/staging/android/ashmem.c in a certain Qualcomm     Innovation Center (QuIC) Android patch for the Linux     kernel 3.x mishandles pointer validation within the     KGSL Linux Graphics Module, which allows attackers to     bypass intended access restrictions by using the     /ashmem string as the dentry name.(CVE-2016-5340i1/4%0

  - It was found that the Linux kernel did not properly     account file descriptors passed over the unix socket     against the process limit. A local user could use this     flaw to exhaust all available memory on the     system.(CVE-2013-4312i1/4%0

  - Kernel memory corruption due to a buffer overflow was     found in brcmf_cfg80211_mgmt_tx() function in Linux     kernels from v3.9-rc1 to v4.13-rc1. The vulnerability     can be triggered by sending a crafted NL80211_CMD_FRAME     packet via netlink. This flaw is unlikely to be     triggered remotely as certain userspace code is needed     for this. An unprivileged local user could use this     flaw to induce kernel memory corruption on the system,     leading to a crash. Due to the nature of the flaw,     privilege escalation cannot be fully ruled out,     although it is unlikely.(CVE-2017-7541i1/4%0

  - A flaw in the netback module allowed frontends to     control mapping of requests to request queues. An     attacker can change this mapping by requesting invalid     mapping requests allowing the (usually privileged)     backend to access out-of-bounds memory access for     reading and writing.(CVE-2018-15471i1/4%0

  - A buffer overflow vulnerability due to a lack of input     filtering of incoming fragmented datagrams was found in     the IP-over-1394 driver firewire-net in a fragment     handling code in the Linux kernel. The vulnerability     exists since firewire supported IPv4, i.e. since     version 2.6.31 (year 2009) till version v4.9-rc4. A     maliciously formed fragment with a respectively large     datagram offset would cause a memcpy() past the     datagram buffer, which would cause a system panic or     possible arbitrary code execution.The flaw requires     firewire-net module to be loaded and is remotely     exploitable from connected firewire devices, but not     over a local network.(CVE-2016-8633i1/4%0

  - It was found that the Linux kernel can hit a BUG_ON()     statement in the __xfs_get_blocks() in the     fs/xfs/xfs_aops.c because of a race condition between     direct and memory-mapped I/O associated with a hole in     a file that is handled with BUG_ON() instead of an I/O     failure. This allows a local unprivileged attacker to     cause a system crash and a denial of     service.(CVE-2016-10741i1/4%0

  - A vulnerability was found in the Linux kernel. The     pointer to the netlink socket attribute is not checked,     which could cause a null pointer dereference when     parsing the nested attributes in function     tipc_nl_publ_dump(). This allows local users to cause a     DoS.(CVE-2016-4951i1/4%0

  - It was reported that with Linux kernel, earlier than     version v4.10-rc8, an application may trigger a BUG_ON     in sctp_wait_for_sndbuf if the socket tx buffer is     full, a thread is waiting on it to queue more data, and     meanwhile another thread peels off the association     being used by the first thread.(CVE-2017-5986i1/4%0

  - The kvm_vm_ioctl_check_extension function in     arch/powerpc/kvm/powerpc.c in the Linux kernel before     4.13.11 allows local users to cause a denial of service     (NULL pointer dereference and system crash) via a     KVM_CHECK_EXTENSION KVM_CAP_PPC_HTM ioctl call to     /dev/kvm.(CVE-2017-15306i1/4%0

  - A flaw was found in the way the Linux kernel's 32-bit     emulation implementation handled forking or closing of     a task with an 'int80' entry. A local user could     potentially use this flaw to escalate their privileges     on the system.(CVE-2015-2830i1/4%0

  - A flaw was found in the way the Linux kernel's SCTP     implementation validated INIT chunks when performing     Address Configuration Change (ASCONF). A remote     attacker could use this flaw to crash the system by     sending a specially crafted SCTP packet to trigger a     NULL pointer dereference on the     system.(CVE-2014-7841i1/4%0

  - A race condition issue leading to a use-after-free flaw     was found in the way the raw packet sockets are     implemented in the Linux kernel networking subsystem     handling synchronization. A local user able to open a     raw packet socket (requires the CAP_NET_RAW capability)     can use this issue to crash the     system.(CVE-2017-1000111)

  - A flaw was found in the way the Linux kernel performed     forking inside of a transaction. A local, unprivileged     user on a PowerPC system that supports transactional     memory could use this flaw to crash the     system.(CVE-2014-2673i1/4%0

  - The hashbin_delete function in net/irda/irqueue.c in     the Linux kernel improperly manages lock dropping,     which allows local users to cause a denial of service     (deadlock) via crafted operations on IrDA     devices.(CVE-2017-6348i1/4%0

  - An out-of-bounds flaw was found in the kernel, where     the length of the sockaddr parameter was not checked in     the pptp_bind() and pptp_connect() functions. As a     result, more kernel memory was copied out than     required, leaking information from the kernel stack     (including kernel addresses). A local system user could     exploit this flaw to bypass kernel ASLR or leak other     information.(CVE-2015-8569i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The 4.12.11 stable kernel update contains a number of important fixes across the tree.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Array index error in the tcm_vhost_make_tpg function in     drivers/vhost/scsi.c in the Linux kernel before 4.0     might allow guest OS users to cause a denial of service     (memory corruption) or possibly have unspecified other     impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl     call. NOTE: the affected function was renamed to     vhost_scsi_make_tpg before the vulnerability was     announced.(CVE-2015-4036)

  - The ecryptfs_privileged_open function in     fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3     allows local users to gain privileges or cause a denial     of service (stack memory consumption) via vectors     involving crafted mmap calls for /proc pathnames,     leading to recursive pagefault handling.(CVE-2016-1583)

  - It was found that SCSI driver in the Linux kernel can     improperly access userspace memory outside the provided     buffer. A local privileged attacker could potentially     use this flaw to expose information from the kernel     memory.(CVE-2017-13168)

  - The acpi_ds_create_operands() function in     drivers/acpi/acpica/dsutils.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13693)

  - The acpi_ps_complete_final_op() function in     drivers/acpi/acpica/psobject.c in the Linux kernel     through 4.12.9 does not flush the node and node_ext     caches and causes a kernel stack dump, which allows     local users to obtain sensitive information from kernel     memory and bypass the KASLR protection mechanism (in     the kernel through 4.9) via a crafted ACPI     table.(CVE-2017-13694)

  - The acpi_ns_evaluate() function in     drivers/acpi/acpica/nseval.c in the Linux kernel     through 4.12.9 does not flush the operand cache and     causes a kernel stack dump, which allows local users to     obtain sensitive information from kernel memory and     bypass the KASLR protection mechanism (in the kernel     through 4.9) via a crafted ACPI table.(CVE-2017-13695)

  - The XFS_IS_REALTIME_INODE macro in fs/xfs/xfs_linux.h     in the Linux kernel before 4.13.2 does not verify that     a filesystem has a realtime device, which allows local     users to cause a denial of service (NULL pointer     dereference and OOPS) via vectors related to setting an     RHINHERIT flag on a directory.(CVE-2017-14340)

  - The xfs_bmap_extents_to_btree function in     fs/xfs/libxfs/xfs_bmap.c in the Linux kernel through     4.16.3 allows local users to cause a denial of service     (xfs_bmapi_write NULL pointer dereference) via a     crafted xfs image.(CVE-2018-10323)

  - A flaw was found in Linux kernel in the ext4 filesystem     code. A use-after-free is possible in     ext4_ext_remove_space() function when mounting and     operating a crafted ext4 image.(CVE-2018-10876)

  - A flaw was found in the Linux kernel ext4 filesystem.
    An out-of-bound access is possible in the     ext4_ext_drop_refs() function when operating on a     crafted ext4 filesystem image.(CVE-2018-10877)

  - The pcpu_embed_first_chunk function in mm/percpu.c in     the Linux kernel through 4.14.14 allows local users to     obtain sensitive address information by reading dmesg     data from a(CVE-2018-5995)

  - Memory leak in the irda_bind function in     net/irda/af_irda.c and later in     drivers/staging/irda/net/af_irda.c in the Linux kernel     before 4.17 allows local users to cause a denial of     service (memory consumption) by repeatedly binding an     AF_IRDA socket.(CVE-2018-6554)

  - A NULL pointer dereference was found in the     net/rds/rdma.c __rds_rdma_map() function in the Linux     kernel before 4.14.7 allowing local attackers to cause     a system panic and a denial-of-service, related to     RDS_GET_MR and RDS_GET_MR_FOR_DEST.(CVE-2018-7492)

  - ** DISPUTED ** Race condition in the     store_int_with_restart() function in     arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel     through 4.15.7 allows local users to cause a denial of     service (panic) by leveraging root access to write to     the check_interval file in a     /sys/devices/system/machinecheck/machinecheck<cpu     number> directory. NOTE: a third party has indicated     that this report is not security     relevant.(CVE-2018-7995)

  - Non-optimized code for key handling of shared futexes     was found in the Linux kernel in the form of unbounded     contention time due to the page lock for real-time     users. Before the fix, the page lock was an     unnecessarily heavy lock for the futex path that     protected too much. After the fix, the page lock is     only required in a specific corner case.(CVE-2018-9422)

  - A memory leak in the ccp_run_sha_cmd() function in     drivers/crypto/ccp/ccp-ops.c in the Linux kernel     through 5.3.9 allows attackers to cause a denial of     service (memory consumption), aka     CID-128c66429247.(CVE-2019-18808)

  - In the Linux kernel before 5.1, there is a memory leak     in __feat_register_sp() in net/dccp/feat.c, which may     cause denial of service, aka     CID-1d3ff0950e2b.(CVE-2019-20096)

  - An issue was discovered in the Linux kernel before     5.4.7. The prb_calc_retire_blk_tmo() function in     net/packet/af_packet.c can result in a denial of     service (CPU consumption and soft lockup) in a certain     failure case involving TPACKET_V3, aka     CID-b43d1f9f7067.(CVE-2019-20812)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
220770	Linux Distros のパッチ未適用の脆弱性: CVE-2017-13694	Nessus	Misc.	2025/3/4	2025/9/14	medium
220770	Linux Distros 未修補弱點：CVE-2017-13694	Nessus	Misc.	2025/3/4	2025/9/14	medium
220770	Linux Distros 未修补的漏洞: CVE-2017-13694	Nessus	Misc.	2025/3/4	2025/9/14	medium
129129	EulerOS 2.0 SP5 : kernel (EulerOS-SA-2019-1972)	Nessus	Huawei Local Security Checks	2019/9/23	2024/4/24	high
220770	Linux Distros Unpatched Vulnerability : CVE-2017-13694	Nessus	Misc.	2025/3/4	2025/9/14	medium
120603	Fedora 28：acpica-tools（2018-8d90571cdf）	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	medium
120603	Fedora 28 : acpica-tools (2018-8d90571cdf)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	medium
104578	EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1245)	Nessus	Huawei Local Security Checks	2017/11/16	2021/1/6	high
103117	Fedora 26：kernel（2017-6764d16965）	Nessus	Fedora Local Security Checks	2017/9/12	2021/1/6	medium
103151	Fedora 25：kernel（2017-a3a8638a60）	Nessus	Fedora Local Security Checks	2017/9/13	2021/1/6	medium
108777	Fedora 27：acpica-tools（2018-7c2e0a998d）	Nessus	Fedora Local Security Checks	2018/4/2	2024/11/21	medium
132605	EulerOS 2.0 SP8 : kernel (EulerOS-SA-2020-1012)	Nessus	Huawei Local Security Checks	2020/1/2	2024/4/1	critical
124970	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1517)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high
103117	Fedora 26 : kernel (2017-6764d16965)	Nessus	Fedora Local Security Checks	2017/9/12	2021/1/6	medium
103151	Fedora 25 : kernel (2017-a3a8638a60)	Nessus	Fedora Local Security Checks	2017/9/13	2021/1/6	medium
108777	Fedora 27 : acpica-tools (2018-7c2e0a998d)	Nessus	Fedora Local Security Checks	2018/4/2	2024/11/21	medium
141697	EulerOS Virtualization 3.0.2.2 : kernel (EulerOS-SA-2020-2222)	Nessus	Huawei Local Security Checks	2020/10/21	2021/1/6	high

检测

插件搜索

medium

medium

medium

high

medium

medium

medium

high

medium

medium

medium

critical

high

medium

medium

medium

high