遠端 Redhat Enterprise Linux 7 主機已安裝受到多個弱點影響的套件，如 RHSA-2018:2948 公告中所提及。

    kernel-alt 套件提供 Linux 核心版本 4.x。

    安全性修正：

    * 許多現代微處理器設計已採用「載入和儲存」指令的推測執行 (常用的效能最佳化)，在這個方法中發現業界普遍存在的問題。它依賴權限程式碼中精確定義的指令序列的存在，並依賴以下事實：從最近發生記憶體寫入的位址讀取記憶體可能會看到較舊的值，因此造成微處理器資料外取的更新，即使從未實際認可 (淘汰) 推測執行的指令。因此，非特權攻擊者可利用此缺陷透過進行目標式快取旁路攻擊來讀取有權限的記憶體。(CVE-2018-3639，aarch64)

    * 在 Linux 核心處理特製 TCP 封包的方式中，發現名為 SegmentSmack 的缺陷。遠端攻擊者可利用此缺陷，透過傳送進行中 TCP 工作階段內特別修改過的封包，來觸發佔用大量時間和計算資源的 tcp_collapse_ofo_queue() 和 tcp_prune_ofo_queue() 函式呼叫，進而導致 CPU 飽和，因此造成系統拒絕服務。
    若要維持拒絕服務情形，需要在可連線的開放連接埠中具有持續的雙向 TCP 工作階段，這樣就無法利用偽造的 IP 位址來發動攻擊。(CVE-2018-5390)

    * 在 Linux 核心處理片段化 IPv4 和 IPv6 封包重組的方式中，發現名為 FragmentSmack 的缺陷。遠端攻擊者可利用此缺陷，透過傳送特製封包來觸發佔用大量時間和計算資源的分割重組演算法，進而導致 CPU 飽和，因此造成系統拒絕服務。(CVE-2018-5391)

    因空間所限，無法在此公告中記錄所有安全性修正。如需其餘安全性修正的說明，請參閱相關知識庫文章：

    https://access.redhat.com/articles/3658021

    如需安全性問題的詳細資料，包括影響、CVSS 分數及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

    Red Hat 感謝 Ken Johnson (Microsoft Security Response Center) 和 Jann Horn (Google Project Zero) 報告 CVE-2018-3639；Juha-Matti Tilli (阿爾托大學通訊網路系和 Nokia Bell Labs) 報告 CVE-2018-5390 和 CVE-2018-5391；Qualys Research Labs 報告 CVE-2018-1120；David Rientjes (Google) 報告 CVE-2018-1000200 以及 Wen Xu 報告 CVE-2018-1092、CVE-2018-1094 和 CVE-2018-1095。CVE-2018-14619 問題是由 Florian Weimer (Red Hat) 和 Ondrej Mosnacek (Red Hat) 所發現。

    其他變更：

    如需有關此發行版本的詳細變更資訊，請參閱可從「參照」一節連結的 Red Hat Enterprise Linux 7.6 版本資訊。

Tenable 已直接從 Red Hat Enterprise Linux 安全公告擷取前置描述區塊。

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 7 主机上安装的程序包受到 RHSA-2018:2948 公告中提及的多个漏洞的影响。

    kernel-alt 程序包提供 Linux 内核 4.x 版本。

    安全修复：

    * 在许多现代微处理器设计的装载与存储指令推测执行（一种常用的性能优化）实施方式中发现一个行业性问题。它依赖如下事实：特权代码中存在精确定义的指令序列，以及从最近发生内存写入的地址读取的内存会遇到一个旧值，导致微处理器数据缓存的更新，甚至包括为从未实际提交（取消）的推测执行指令进行更新。因此，非特权攻击者可利用此缺陷，通过执行目标缓存边信道攻击来读取特权内存。(CVE-2018-3639, aarch64)

    * 在 Linux 内核处理特制 TCP 数据包的方式中，发现名为 SegmentSmack 的缺陷。远程攻击者可利用此缺陷，通过在进行中的 TCP 会话中发送特别修改过的数据包来触发占用大量时间和计算资源的 tcp_collapse_ofo_queue() 和 tcp_prune_ofo_queue() 函数调用，导致 CPU 饱和，从而造成该系统拒绝服务。
    若要维持拒绝服务的条件，需要可访问开放端口的持续双向 TCP 会话，因此无法使用伪造的 IP 地址执行攻击。(CVE-2018-5390)

    * 在 Linux 内核处理碎片化 IPv4 和 IPv6 数据包重组的方式中，发现名为 FragmentSmack 的缺陷。远程攻击者可利用此缺陷，通过发送特别构建的数据包来触发占用大量时间和计算资源的碎片重组算法，可导致 CPU 饱和，从而造成系统拒绝服务。(CVE-2018-5391)

    因篇幅所限，无法在此公告中记载所有安全修复。请查看相关的知识文章以获取其余安全修复的说明：

    https://access.redhat.com/articles/3658021

    有关此安全问题的详细信息，包括其影响、CVSS 分数和其他相关信息，请参阅列于“参考”部分的 CVE 页面。

    Red Hat 在此感谢 Ken Johnson (Microsoft Security Response Center) 和 Jann Horn (Google Project Zero) 报告 CVE-2018-3639，Juha-Matti Tilli（阿尔托大学通信与网络系及 Nokia Bell Labs）报告 CVE-2018-5390 和 CVE-2018-5391，Qualys Research Labs 报告 CVE-2018-1120，David Rientjes (Google) 报告 CVE-2018-1000200 以及 Wen Xu 报告 CVE-2018-1092、CVE-2018-1094 和 CVE-2018-1095。CVE-2018-14619 问题由 Florian Weimer (Red Hat) 和 Ondrej Mosnacek (Red Hat) 发现。

    其他变更：

    如需有关此发行版本的详细变更信息，请参阅可从“参考”部分链接的 Red Hat Enterprise Linux 7.6 版本说明。

Tenable 已直接从 Red Hat Enterprise Linux 安全公告中提取上述描述块。

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

リモート Redhat Enterprise Linux 7 ホストに、RHSA-2018:2948 アドバイザリに記載されている複数の脆弱性の影響を受けるパッケージがインストールされています。

    kernel-alt パッケージは、Linux カーネルバージョン 4.x を提供します。

    セキュリティ修正プログラム:

    * 最新のマイクロプロセッサー設計の多くで、ロード/ストア命令 (広く使用されているパフォーマンスの最適化) の投機的実行の実装方法に、業界レベルの問題が発見されました。これは、権限コードに存在する正確に定義された命令シーケンスに加えて、最近のメモリ書き込みが発生したアドレスからのメモリ読み取りが古い値を参照し、続いて実際にはコミットしない (破棄される) 投機的実行の命令に対してもマイクロプロセッサーのデータキャッシュへの更新が行われる可能性があるという事実に基づきます。その結果、特権のない攻撃者がこの欠陥を悪用して、標的にキャッシュサイドチャネル攻撃を実行し権限メモリを読み取る可能性があります。(CVE-2018-3639、aarch64)

    * Linux カーネルが特別に細工された TCP パケットを処理する方法に、SegmentSmack という名前の欠陥が見つかりました。リモートの攻撃者がこの欠陥を悪用して、TCP セッション中に特別に細工されたパケットを送信することで、tcp_collapse_ofo_queue() と tcp_prune_ofo_queue() 関数に対して時間と計算の負荷がかかる呼び出しをトリガーし、CPU 飽和とそれによるシステムのサービス拒否を引き起こす可能性があります。
    サービス拒否状態を維持するには、到達可能なオープンポートへの継続的な双方向 TCP セッションが必要であるため、偽装された IP アドレスを使用して攻撃を実行することはできません。(CVE-2018-5390)

    * Linux カーネルが断片化した IPv4 と IPv6 パケットの再アセンブリを処理する方法に、FragmentSmack という名前の欠陥が見つかりました。リモートの攻撃者はこの欠陥を悪用して、特別に細工されたパケットを送信することによって、時間と計算の負荷がかかる断片化再アセンブリアルゴリズムをトリガーし、CPU 飽和とそれによるシステムのサービス拒否を引き起こす可能性があります。(CVE-2018-5391)

    スペースの関係上、このアドバイザリのセキュリティ修正がすべて文書化されているわけではありません。残りのセキュリティ修正の説明は関連するナレッジ記事を参照してください:

    https://access.redhat.com/articles/3658021

    影響、CVSS スコア、その他の関連情報を含むセキュリティの問題の詳細については、「参照」セクションに記載されている CVE のページを参照してください。

    Red Hat は、CVE-2018-3639 を報告してくれた Ken Johnson 氏 (Microsoft Security Response Center) と Jann Horn 氏 (Google Project Zero)、CVE-2018-5390 と CVE-2018-5391 を報告してくれた Juha-Matti Tilli 氏 (Aalto University Department of Communications and Networking、Nokia Bell Labs)、CVE-2018-1120 を報告してくれた Qualys Research Labs、CVE-2018-1000200 を報告してくれた David Rientjes 氏 (Google)、CVE-2018-1092、CVE-2018-1094、CVE-2018-1095 を報告してくれた Wen Xu 氏に感謝の意を表します。CVE-2018-14619 の問題は、Florian Weimer 氏 (Red Hat) と Ondrej Mosnacek 氏 (Red Hat) により発見されました。

    追加の変更:

    このリリースの変更に関する詳細については、「参照」セクションからリンクされている Red Hat Enterprise Linux 7.6リリースノートを参照してください。

Tenable は、前述の記述ブロックを Red Hat Enterprise Linux セキュリティアドバイザリから直接抽出しています。

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The atalk_recvmsg function in net/appletalk/ddp.c in     the Linux kernel before 3.12.4 updates a certain length     value without ensuring that an associated data     structure has been initialized, which allows local     users to obtain sensitive information from kernel     memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg     system call.(CVE-2013-7267i1/4%0

  - fs/f2fs/segment.c in the Linux kernel allows local     users to cause a denial of service (NULL pointer     dereference and panic) by using a noflush_merge option     that triggers a NULL value for a flush_cmd_control data     structure.(CVE-2017-18241i1/4%0

  - fs/pnode.c in the Linux kernel before 4.5.4 does not     properly traverse a mount propagation tree in a certain     case involving a slave mount, which allows local users     to cause a denial of service (NULL pointer dereference     and OOPS) via a crafted series of mount system     calls.(CVE-2016-4581i1/4%0

  - drivers/vhost/net.c in the Linux kernel before 3.13.10,     when mergeable buffers are disabled, does not properly     validate packet lengths, which allows guest OS users to     cause a denial of service (memory corruption and host     OS crash) or possibly gain privileges on the host OS     via crafted packets, related to the handle_rx and     get_rx_bufs functions.(CVE-2014-0077i1/4%0

  - It was found that the fix for CVE-2016-9576 was     incomplete: the Linux kernel's sg implementation did     not properly restrict write operations in situations     where the KERNEL_DS option is set. A local attacker to     read or write to arbitrary kernel memory locations or     cause a denial of service (use-after-free) by     leveraging write access to a /dev/sg     device.(CVE-2016-10088i1/4%0

  - ** DISPUTED ** An issue was discovered in the Linux     kernel through 4.17.2. Since the page allocator does     not yield CPU resources to the owner of the oom_lock     mutex, a local unprivileged user can trivially lock up     the system forever by wasting CPU resources from the     page allocator (e.g., via concurrent page fault events)     when the global OOM killer is invoked. NOTE: the     software maintainer has not accepted certain proposed     patches, in part because of a viewpoint that 'the     underlying problem is non-trivial to     handle.'(CVE-2016-10723i1/4%0

  - A flaw was found in the way the Linux kernel's ASN.1     DER decoder processed certain certificate files with     tags of indefinite length. A local, unprivileged user     could use a specially crafted X.509 certificate DER     file to crash the system or, potentially, escalate     their privileges on the system.(CVE-2016-0758i1/4%0

  - A flaw was found in the way the Linux kernel's Stream     Control Transmission Protocol (SCTP) implementation     handled the association's output queue. A remote     attacker could send specially crafted packets that     would cause the system to use an excessive amount of     memory, leading to a denial of     service.(CVE-2014-3688i1/4%0

  - A use-after-free flaw was found in the way the     ping_init_sock() function of the Linux kernel handled     the group_info reference counter. A local, unprivileged     user could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2014-2851i1/4%0

  - The compat_get_timex function in kernel/compat.c in the     Linux kernel before 4.16.9 allows local users to obtain     sensitive information from kernel memory via     adjtimex.(CVE-2018-11508i1/4%0

  - The cdc_parse_cdc_header() function in     'drivers/usb/core/message.c' in the Linux kernel,     before 4.13.6, allows local users to cause a denial of     service (out-of-bounds read and system crash) or     possibly have unspecified other impact via a crafted     USB device. Due to the nature of the flaw, privilege     escalation cannot be fully ruled out, although we     believe it is unlikely.(CVE-2017-16534i1/4%0

  - A flaw was found in the crypto subsystem of the Linux     kernel before version kernel-4.15-rc4. The 'null     skcipher' was being dropped when each af_alg_ctx was     freed instead of when the aead_tfm was freed. This can     cause the null skcipher to be freed while it is still     in use leading to a local user being able to crash the     system or possibly escalate     privileges.(CVE-2018-14619i1/4%0

  - The crypto_skcipher_init_tfm function in     crypto/skcipher.c in the Linux kernel through 4.11.2     relies on a setkey function that lacks a key-size     check, which allows local users to cause a denial of     service (NULL pointer dereference) via a crafted     application.(CVE-2017-9211i1/4%0

  - kernel/events/core.c in the performance subsystem in     the Linux kernel before 4.0 mismanages locks during     certain migrations, which allows local users to gain     privileges via a crafted application, aka Android     internal bug 30955111.(CVE-2016-6786i1/4%0

  - The KEYS subsystem in the Linux kernel omitted an     access-control check when writing a key to the current     task's default keyring, allowing a local user to bypass     security checks to the keyring. This compromises the     validity of the keyring for those who rely on     it.(CVE-2017-17807i1/4%0

  - A use-after-free flaw was found in the way the Linux     kernel's SCTP implementation handled authentication key     reference counting during INIT collisions. A remote     attacker could use this flaw to crash the system or,     potentially, escalate their privileges on the     system.(CVE-2015-1421i1/4%0

  - The waitid implementation in kernel/exit.c in the Linux     kernel through 4.13.4 accesses rusage data structures     in unintended cases. This can allow local users to     obtain sensitive information and bypass the KASLR     protection mechanism via a crafted system     call.(CVE-2017-14954i1/4%0

  - It was found that the Linux kernel's keyring     implementation would leak memory when adding a key to a     keyring via the add_key() function. A local attacker     could use this flaw to exhaust all available memory on     the system.(CVE-2015-1333i1/4%0

  - The msm_ipc_router_close function in     net/ipc_router/ipc_router_socket.c in the ipc_router     component for the Linux kernel 3.x, as used in Qualcomm     Innovation Center (QuIC) Android contributions for MSM     devices and other products, allow attackers to cause a     denial of service (NULL pointer dereference) or     possibly have unspecified other impact by triggering     failure of an accept system call for an AF_MSM_IPC     socket.(CVE-2016-5870i1/4%0

  - A reachable assertion failure flaw was found in the     Linux kernel built with KVM virtualisation(CONFIG_KVM)     support with Virtual Function I/O feature (CONFIG_VFIO)     enabled. This failure could occur if a malicious guest     device sent a virtual interrupt (guest IRQ) with a     larger (i1/4z1024) index value.(CVE-2017-1000252i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002815 advisory.

    A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The null     skcipher was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This     can cause the null skcipher to be freed while it is still in use leading to a local user being able to     crash the system or possibly escalate privileges.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003262 advisory.

    A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The null     skcipher was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This     can cause the null skcipher to be freed while it is still in use leading to a local user being able to     crash the system or possibly escalate privileges.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001642 advisory.

    A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The null     skcipher was being dropped when each af_alg_ctx was freed instead of when the aead_tfm was freed. This     can cause the null skcipher to be freed while it is still in use leading to a local user being able to     crash the system or possibly escalate privileges.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2948 advisory.

    The kernel-alt packages provide the Linux kernel version 4.x.

    Security Fix(es):

    * An industry-wide issue was found in the way many modern microprocessor designs have implemented     speculative execution of Load & Store instructions (a commonly used performance optimization). It relies     on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact     that memory read from address to which a recent memory write has occurred may see an older value and     subsequently cause an update into the microprocessor's data cache even for speculatively executed     instructions that never actually commit (retire). As a result, an unprivileged attacker could use this     flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, aarch64)

    * A flaw named SegmentSmack was found in the way the Linux kernel handled specially crafted TCP packets. A     remote attacker could use this flaw to trigger time and calculation expensive calls to     tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions by sending specially modified packets within     ongoing TCP sessions which could lead to a CPU saturation and hence a denial of service on the system.
    Maintaining the denial of service condition requires continuous two-way TCP sessions to a reachable open     port, thus the attacks cannot be performed using spoofed IP addresses. (CVE-2018-5390)

    * A flaw named FragmentSmack was found in the way the Linux kernel handled reassembly of fragmented IPv4     and IPv6 packets. A remote attacker could use this flaw to trigger time and calculation expensive fragment     reassembly algorithm by sending specially crafted packets which could lead to a CPU saturation and hence a     denial of service on the system. (CVE-2018-5391)

    Space precludes documenting all of the security fixes in this advisory. See the descriptions of the     remaining security fixes in the related Knowledge Article:

    https://access.redhat.com/articles/3658021

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project     Zero) for reporting CVE-2018-3639; Juha-Matti Tilli (Aalto University - Department of Communications and     Networking and Nokia Bell Labs) for reporting CVE-2018-5390 and CVE-2018-5391; Qualys Research Labs for     reporting CVE-2018-1120; David Rientjes (Google) for reporting CVE-2018-1000200; and Wen Xu for reporting     CVE-2018-1092, CVE-2018-1094, and CVE-2018-1095. The CVE-2018-14619 issue was discovered by Florian Weimer     (Red Hat) and Ondrej Mosnacek (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118513	RHEL 7：kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	2018/10/31	2026/1/9	high
118513	RHEL 7：kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	2018/10/31	2026/1/9	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	2018/10/31	2026/1/9	high
124987	EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1534)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high
287392	Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-002815)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
287526	Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003262)	Nessus	Unity Linux Local Security Checks	2026/1/15	2026/1/16	high
290683	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001642)	Nessus	Unity Linux Local Security Checks	2026/1/16	2026/1/16	high
118513	RHEL 7 : kernel-alt (RHSA-2018:2948)	Nessus	Red Hat Local Security Checks	2018/10/31	2026/1/9	high

检测

插件搜索

high

high

high

high

high

high

high

high