Vulnerabilities > CVE-2017-1000410 - Information Exposure vulnerability in Linux Kernel

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
linux
debian
redhat
CWE-200
nessus

Summary

The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. By manipulating the code flows that precede the handling of these configuration messages, an attacker can also gain some control over which data will be held in the uninitialized stack variables. This can allow him to bypass KASLR, and stack canaries protection - as both pointers and stack canaries may be leaked in this manner. Combining this vulnerability (for example) with the previously disclosed RCE vulnerability in L2CAP configuration parsing (CVE-2017-1000251) may allow an attacker to exploit the RCE against kernels which were built with the above mitigations. These are the specifics of this vulnerability: In the function l2cap_parse_conf_rsp and in the function l2cap_parse_conf_req the following variable is declared without initialization: struct l2cap_conf_efs efs; In addition, when parsing input configuration parameters in both of these functions, the switch case for handling EFS elements may skip the memcpy call that will write to the efs variable: ... case L2CAP_CONF_EFS: if (olen == sizeof(efs)) memcpy(&efs, (void *)val, olen); ... The olen in the above if is attacker controlled, and regardless of that if, in both of these functions the efs variable would eventually be added to the outgoing configuration request that is being built: l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), (unsigned long) &efs); So by sending a configuration request, or response, that contains an L2CAP_CONF_EFS element, but with an element length that is not sizeof(efs) - the memcpy to the uninitialized efs variable can be avoided, and the uninitialized variable would be returned to the attacker (16 bytes).

Vulnerable Configurations

Part Description Count
OS
Linux
1529
OS
Debian
2
OS
Redhat
11
Application
Redhat
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-1319.NASL
    descriptionFrom Red Hat Security Advisory 2018:1319 : An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, x86 32-bit) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017) * kernel: Stack information leak in the EFS element (CVE-2017-1000410) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431591
    last seen2020-06-01
    modified2020-06-02
    plugin id109629
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109629
    titleOracle Linux 6 : kernel (ELSA-2018-1319) (Meltdown)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2018:1319 and 
    # Oracle Linux Security Advisory ELSA-2018-1319 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109629);
      script_version("1.9");
      script_cvs_date("Date: 2019/09/27 13:00:38");
    
      script_cve_id("CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-18017", "CVE-2017-5754", "CVE-2017-7645", "CVE-2017-8824", "CVE-2018-8897");
      script_xref(name:"RHSA", value:"2018:1319");
    
      script_name(english:"Oracle Linux 6 : kernel (ELSA-2018-1319) (Meltdown)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2018:1319 :
    
    An update for kernel is now available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * hw: cpu: speculative execution permission faults handling
    (CVE-2017-5754, x86 32-bit)
    
    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)
    
    * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Google Project Zero for reporting
    CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski
    for reporting CVE-2018-8897; Mohamed Ghannam for reporting
    CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410.
    
    Bug Fix(es) :
    
    These updated kernel packages include also numerous bug fixes. Space
    precludes documenting all of these bug fixes in this advisory. See the
    bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/ articles/3431591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2018-May/007679.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-firmware");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-perf");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/09");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-18017", "CVE-2017-5754", "CVE-2017-7645", "CVE-2017-8824", "CVE-2018-8897");  
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for ELSA-2018-1319");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    kernel_major_minor = get_kb_item("Host/uname/major_minor");
    if (empty_or_null(kernel_major_minor)) exit(1, "Unable to determine kernel major-minor level.");
    expected_kernel_major_minor = "2.6";
    if (kernel_major_minor != expected_kernel_major_minor)
      audit(AUDIT_OS_NOT, "running kernel level " + expected_kernel_major_minor + ", it is running kernel level " + kernel_major_minor);
    
    flag = 0;
    if (rpm_exists(release:"EL6", rpm:"kernel-2.6.32") && rpm_check(release:"EL6", reference:"kernel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-abi-whitelists-2.6.32") && rpm_check(release:"EL6", reference:"kernel-abi-whitelists-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-debug-2.6.32") && rpm_check(release:"EL6", reference:"kernel-debug-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-debug-devel-2.6.32") && rpm_check(release:"EL6", reference:"kernel-debug-devel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-devel-2.6.32") && rpm_check(release:"EL6", reference:"kernel-devel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-doc-2.6.32") && rpm_check(release:"EL6", reference:"kernel-doc-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-firmware-2.6.32") && rpm_check(release:"EL6", reference:"kernel-firmware-2.6.32-696.28.1.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-headers-2.6.32") && rpm_check(release:"EL6", reference:"kernel-headers-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"EL6", reference:"perf-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"EL6", reference:"python-perf-2.6.32-696.28.1.el6")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "affected kernel");
    }
    
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0070_KERNEL.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression. (CVE-2015-8830) - A weakness was found in the Linux ASLR implementation. Any user able to running 32-bit applications in a x86 machine can disable ASLR by setting the RLIMIT_STACK resource to unlimited. (CVE-2016-3672) - The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2016-7913) - Use-after-free vulnerability in the snd_pcm_info() function in the ALSA subsystem in the Linux kernel allows attackers to induce a kernel memory corruption and possibly crash or lock up a system. Due to the nature of the flaw, a privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2017-0861) - A reachable assertion failure flaw was found in the Linux kernel built with KVM virtualisation(CONFIG_KVM) support with Virtual Function I/O feature (CONFIG_VFIO) enabled. This failure could occur if a malicious guest device sent a virtual interrupt (guest IRQ) with a larger (>1024) index value. (CVE-2017-1000252) - Linux kernel Virtualization Module (CONFIG_KVM) for the Intel processor family (CONFIG_KVM_INTEL) is vulnerable to a DoS issue. It could occur if a guest was to flood the I/O port 0x80 with write requests. A guest user could use this flaw to crash the host kernel resulting in DoS. (CVE-2017-1000407) - A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space. (CVE-2017-1000410) - A race condition was found in the Linux kernel before version 4.11-rc1 in
    last seen2020-06-01
    modified2020-06-02
    plugin id127272
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127272
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0070)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from ZTE advisory NS-SA-2019-0070. The text
    # itself is copyright (C) ZTE, Inc.
    
    include("compat.inc");
    
    if (description)
    {
      script_id(127272);
      script_version("1.2");
      script_cvs_date("Date: 2019/09/24 11:01:33");
    
      script_cve_id(
        "CVE-2015-8830",
        "CVE-2016-3672",
        "CVE-2016-7913",
        "CVE-2017-0861",
        "CVE-2017-9725",
        "CVE-2017-10661",
        "CVE-2017-12154",
        "CVE-2017-12190",
        "CVE-2017-13305",
        "CVE-2017-15129",
        "CVE-2017-15265",
        "CVE-2017-15274",
        "CVE-2017-17448",
        "CVE-2017-17449",
        "CVE-2017-17558",
        "CVE-2017-17805",
        "CVE-2017-18017",
        "CVE-2017-18203",
        "CVE-2017-18208",
        "CVE-2017-1000252",
        "CVE-2017-1000407",
        "CVE-2017-1000410",
        "CVE-2018-1120",
        "CVE-2018-1130",
        "CVE-2018-3646",
        "CVE-2018-5344",
        "CVE-2018-5750",
        "CVE-2018-5803",
        "CVE-2018-5848",
        "CVE-2018-7566",
        "CVE-2018-9568",
        "CVE-2018-17972",
        "CVE-2018-18397",
        "CVE-2018-18690",
        "CVE-2018-1000004",
        "CVE-2018-1000026"
      );
      script_bugtraq_id(102329);
    
      script_name(english:"NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0070)");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote machine is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by
    multiple vulnerabilities:
    
      - Integer overflow in the aio_setup_single_vector function
        in fs/aio.c in the Linux kernel 4.0 allows local users
        to cause a denial of service or possibly have
        unspecified other impact via a large AIO iovec. NOTE:
        this vulnerability exists because of a CVE-2012-6701
        regression. (CVE-2015-8830)
    
      - A weakness was found in the Linux ASLR implementation.
        Any user able to running 32-bit applications in a x86
        machine can disable ASLR by setting the RLIMIT_STACK
        resource to unlimited. (CVE-2016-3672)
    
      - The xc2028_set_config function in
        drivers/media/tuners/tuner-xc2028.c in the Linux kernel
        before 4.6 allows local users to gain privileges or
        cause a denial of service (use-after-free) via vectors
        involving omission of the firmware name from a certain
        data structure. Due to the nature of the flaw, privilege
        escalation cannot be fully ruled out, although we
        believe it is unlikely. (CVE-2016-7913)
    
      - Use-after-free vulnerability in the snd_pcm_info()
        function in the ALSA subsystem in the Linux kernel
        allows attackers to induce a kernel memory corruption
        and possibly crash or lock up a system. Due to the
        nature of the flaw, a privilege escalation cannot be
        fully ruled out, although we believe it is unlikely.
        (CVE-2017-0861)
    
      - A reachable assertion failure flaw was found in the
        Linux kernel built with KVM virtualisation(CONFIG_KVM)
        support with Virtual Function I/O feature (CONFIG_VFIO)
        enabled. This failure could occur if a malicious guest
        device sent a virtual interrupt (guest IRQ) with a
        larger (>1024) index value. (CVE-2017-1000252)
    
      - Linux kernel Virtualization Module (CONFIG_KVM) for the
        Intel processor family (CONFIG_KVM_INTEL) is vulnerable
        to a DoS issue. It could occur if a guest was to flood
        the I/O port 0x80 with write requests. A guest user
        could use this flaw to crash the host kernel resulting
        in DoS. (CVE-2017-1000407)
    
      - A flaw was found in the processing of incoming L2CAP
        bluetooth commands. Uninitialized stack variables can be
        sent to an attacker leaking data in kernel address
        space. (CVE-2017-1000410)
    
      - A race condition was found in the Linux kernel before
        version 4.11-rc1 in 'fs/timerfd.c' file which allows a
        local user to cause a kernel list corruption or use-
        after-free via simultaneous operations with a file
        descriptor which leverage improper 'might_cancel'
        queuing. An unprivileged local user could use this flaw
        to cause a denial of service of the system. Due to the
        nature of the flaw, privilege escalation cannot be fully
        ruled out, although we believe it is unlikely.
        (CVE-2017-10661)
    
      - Linux kernel built with the KVM visualization support
        (CONFIG_KVM), with nested visualization (nVMX) feature
        enabled (nested=1), is vulnerable to a crash due to
        disabled external interrupts. As L2 guest could access
        (r/w) hardware CR8 register of the host(L0). In a nested
        visualization setup, L2 guest user could use this flaw
        to potentially crash the host(L0) resulting in DoS.
        (CVE-2017-12154)
    
      - It was found that in the Linux kernel through v4.14-rc5,
        bio_map_user_iov() and bio_unmap_user() in 'block/bio.c'
        do unbalanced pages refcounting if IO vector has small
        consecutive buffers belonging to the same page.
        bio_add_pc_page() merges them into one, but the page
        reference is never dropped, causing a memory leak and
        possible system lockup due to out-of-memory condition.
        (CVE-2017-12190)
    
      - A flaw was found in the Linux kernel's implementation of
        valid_master_desc() in which a memory buffer would be
        compared to a userspace value with an incorrect size of
        comparison. By bruteforcing the comparison, an attacker
        could determine what was in memory after the description
        and possibly obtain sensitive information from kernel
        memory. (CVE-2017-13305)
    
      - A use-after-free vulnerability was found in a network
        namespaces code affecting the Linux kernel since
        v4.0-rc1 through v4.15-rc5. The function
        get_net_ns_by_id() does not check for the net::count
        value after it has found a peer network in netns_ids idr
        which could lead to double free and memory corruption.
        This vulnerability could allow an unprivileged local
        user to induce kernel memory corruption on the system,
        leading to a crash. Due to the nature of the flaw,
        privilege escalation cannot be fully ruled out, although
        it is thought to be unlikely. (CVE-2017-15129)
    
      - A use-after-free vulnerability was found when issuing an
        ioctl to a sound device. This could allow a user to
        exploit a race condition and create memory corruption or
        possibly privilege escalation. (CVE-2017-15265)
    
      - A flaw was found in the implementation of associative
        arrays where the add_key systemcall and KEYCTL_UPDATE
        operations allowed for a NULL payload with a nonzero
        length. When accessing the payload within this length
        parameters value, an unprivileged user could trivially
        cause a NULL pointer dereference (kernel oops).
        (CVE-2017-15274)
    
      - The net/netfilter/nfnetlink_cthelper.c function in the
        Linux kernel through 4.14.4 does not require the
        CAP_NET_ADMIN capability for new, get, and del
        operations. This allows local users to bypass intended
        access restrictions because the nfnl_cthelper_list data
        structure is shared across all net namespaces.
        (CVE-2017-17448)
    
      - The __netlink_deliver_tap_skb function in
        net/netlink/af_netlink.c in the Linux kernel, through
        4.14.4, does not restrict observations of Netlink
        messages to a single net namespace, when CONFIG_NLMON is
        enabled. This allows local users to obtain sensitive
        information by leveraging the CAP_NET_ADMIN capability
        to sniff an nlmon interface for all Netlink activity on
        the system. (CVE-2017-17449)
    
      - The usb_destroy_configuration() function, in
        'drivers/usb/core/config.c' in the USB core subsystem,
        in the Linux kernel through 4.14.5 does not consider the
        maximum number of configurations and interfaces before
        attempting to release resources. This allows local users
        to cause a denial of service, due to out-of-bounds write
        access, or possibly have unspecified other impact via a
        crafted USB device. Due to the nature of the flaw,
        privilege escalation cannot be fully ruled out, although
        we believe it is unlikely. (CVE-2017-17558)
    
      - The Salsa20 encryption algorithm in the Linux kernel,
        before 4.14.8, does not correctly handle zero-length
        inputs. This allows a local attacker the ability to use
        the AF_ALG-based skcipher interface to cause a denial of
        service (uninitialized-memory free and kernel crash) or
        have an unspecified other impact by executing a crafted
        sequence of system calls that use the blkcipher_walk
        API. Both the generic implementation
        (crypto/salsa20_generic.c) and x86 implementation
        (arch/x86/crypto/salsa20_glue.c) of Salsa20 are
        vulnerable. (CVE-2017-17805)
    
      - The tcpmss_mangle_packet function in
        net/netfilter/xt_TCPMSS.c in the Linux kernel before
        4.11, and 4.9.x before 4.9.36, allows remote attackers
        to cause a denial of service (use-after-free and memory
        corruption) or possibly have unspecified other impact by
        leveraging the presence of xt_TCPMSS in an iptables
        action. Due to the nature of the flaw, privilege
        escalation cannot be fully ruled out, although we
        believe it is unlikely. (CVE-2017-18017)
    
      - The Linux kernel, before version 4.14.3, is vulnerable
        to a denial of service in
        drivers/md/dm.c:dm_get_from_kobject() which can be
        caused by local users leveraging a race condition with
        __dm_destroy() during creation and removal of DM
        devices. Only privileged local users (with CAP_SYS_ADMIN
        capability) can directly perform the ioctl operations
        for dm device creation and removal and this would
        typically be outside the direct control of the
        unprivileged attacker. (CVE-2017-18203)
    
      - The madvise_willneed function in the Linux kernel allows
        local users to cause a denial of service (infinite loop)
        by triggering use of MADVISE_WILLNEED for a DAX mapping.
        (CVE-2017-18208)
    
      - A flaw was found where the kernel truncated the value
        used to indicate the size of a buffer which it would
        later become zero using an untruncated value. This can
        corrupt memory outside of the original allocation.
        (CVE-2017-9725)
    
      - In the Linux kernel versions 4.12, 3.10, 2.6, and
        possibly earlier, a race condition vulnerability exists
        in the sound system allowing for a potential deadlock
        and memory corruption due to use-after-free condition
        and thus denial of service. Due to the nature of the
        flaw, privilege escalation cannot be fully ruled out,
        although we believe it is unlikely. (CVE-2018-1000004)
    
      - Improper validation in the bnx2x network card driver of
        the Linux kernel version 4.15 can allow for denial of
        service (DoS) attacks via a packet with a gso_size
        larger than ~9700 bytes. Untrusted guest VMs can exploit
        this vulnerability in the host machine, causing a crash
        in the network card. (CVE-2018-1000026)
    
      - By mmap()ing a FUSE-backed file onto a process's memory
        containing command line arguments (or environment
        strings), an attacker can cause utilities from psutils
        or procps (such as ps, w) or any other program which
        makes a read() call to the /proc//cmdline (or
        /proc//environ) files to block indefinitely (denial
        of service) or for some controlled time (as a
        synchronization primitive for other attacks).
        (CVE-2018-1120)
    
      - A null pointer dereference in dccp_write_xmit() function
        in net/dccp/output.c in the Linux kernel allows a local
        user to cause a denial of service by a number of certain
        crafted system calls. (CVE-2018-1130)
    
      - An issue was discovered in the proc_pid_stack function
        in fs/proc/base.c in the Linux kernel. An attacker with
        a local account can trick the stack unwinder code to
        leak stack contents to userspace. The fix allows only
        root to inspect the kernel stack of an arbitrary task.
        (CVE-2018-17972)
    
      - A flaw was found in the Linux kernel with files on tmpfs
        and hugetlbfs. An attacker is able to bypass file
        permissions on filesystems mounted with tmpfs/hugetlbs
        to modify a file and possibly disrupt normal system
        behavior. At this time there is an understanding there
        is no crash or privilege escalation but the impact of
        modifications on these filesystems of files in
        production systems may have adverse affects.
        (CVE-2018-18397)
    
      - In the Linux kernel before 4.17, a local attacker able
        to set attributes on an xfs filesystem could make this
        filesystem non-operational until the next mount by
        triggering an unchecked error condition during an xfs
        attribute change, because xfs_attr_shortform_addname in
        fs/xfs/libxfs/xfs_attr.c mishandles ATTR_REPLACE
        operations with conversion of an attr from short to long
        form. (CVE-2018-18690)
    
      - Modern operating systems implement virtualization of
        physical memory to efficiently use available system
        resources and provide inter-domain protection through
        access control and isolation. The L1TF issue was found
        in the way the x86 microprocessor designs have
        implemented speculative execution of instructions (a
        commonly used performance optimization) in combination
        with handling of page-faults caused by terminated
        virtual to physical address resolving process. As a
        result, an unprivileged attacker could use this flaw to
        read privileged memory of the kernel or other processes
        and/or cross guest/host boundaries to read host memory
        by conducting targeted cache side-channel attacks.
        (CVE-2018-3646)
    
      - A flaw was found in the Linux kernel's handling of
        loopback devices. An attacker, who has permissions to
        setup loopback disks, may create a denial of service or
        other unspecified actions. (CVE-2018-5344)
    
      - The acpi_smbus_hc_add function in drivers/acpi/sbshc.c
        in the Linux kernel, through 4.14.15, allows local users
        to obtain sensitive address information by reading dmesg
        data from an SBS HC printk call. (CVE-2018-5750)
    
      - An error in the _sctp_make_chunk() function
        (net/sctp/sm_make_chunk.c) when handling SCTP, packet
        length can be exploited by a malicious local user to
        cause a kernel crash and a DoS. (CVE-2018-5803)
    
      - In the function wmi_set_ie() in the Linux kernel the
        length validation code does not handle unsigned integer
        overflow properly. As a result, a large value of the
        ie_len argument can cause a buffer overflow and thus a
        memory corruption leading to a system crash or other or
        unspecified impact. Due to the nature of the flaw,
        privilege escalation cannot be fully ruled out, although
        we believe it is unlikely. (CVE-2018-5848)
    
      - ALSA sequencer core initializes the event pool on demand
        by invoking snd_seq_pool_init() when the first write
        happens and the pool is empty. A user can reset the pool
        size manually via ioctl concurrently, and this may lead
        to UAF or out-of-bound access. (CVE-2018-7566)
    
      - A possible memory corruption due to a type confusion was
        found in the Linux kernel in the sk_clone_lock()
        function in the net/core/sock.c. The possibility of
        local escalation of privileges cannot be fully ruled out
        for a local unprivileged attacker. (CVE-2018-9568)
    
    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
    number.");
      script_set_attribute(attribute:"see_also", value:"http://security.gd-linux.com/notice/NS-SA-2019-0070");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the vulnerable CGSL kernel packages. Note that updated packages may not be available yet. Please contact ZTE for
    more information.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-18017");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/07/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/08/12");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"NewStart CGSL Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/ZTE-CGSL/release");
    if (isnull(release) || release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, "NewStart Carrier Grade Server Linux");
    
    if (release !~ "CGSL CORE 5.04" &&
        release !~ "CGSL MAIN 5.04")
      audit(AUDIT_OS_NOT, 'NewStart CGSL CORE 5.04 / NewStart CGSL MAIN 5.04');
    
    if (!get_kb_item("Host/ZTE-CGSL/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "NewStart Carrier Grade Server Linux", cpu);
    
    flag = 0;
    
    pkgs = {
      "CGSL CORE 5.04": [
        "kernel-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-abi-whitelists-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-core-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debug-core-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debug-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debug-devel-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debug-modules-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-debuginfo-common-x86_64-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-devel-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-doc-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-headers-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-modules-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-tools-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-tools-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-tools-libs-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "kernel-tools-libs-devel-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "perf-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "perf-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "python-perf-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite",
        "python-perf-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.322.gc3912fd.lite"
      ],
      "CGSL MAIN 5.04": [
        "kernel-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-abi-whitelists-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-debug-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-debug-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-debug-devel-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-debuginfo-common-x86_64-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-devel-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-doc-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-headers-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-tools-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-tools-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-tools-libs-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "kernel-tools-libs-devel-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "perf-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "perf-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "python-perf-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9",
        "python-perf-debuginfo-3.10.0-693.21.1.el7.cgslv5_4.12.319.g46331d9"
      ]
    };
    pkg_list = pkgs[release];
    
    foreach (pkg in pkg_list)
      if (rpm_check(release:"ZTE " + release, reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-3398-1.NASL
    descriptionThe SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000410: The Linux kernel was affected by an information lea that lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id105460
    published2017-12-26
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105460
    titleSUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3398-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2017:3398-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(105460);
      script_version("3.5");
      script_cvs_date("Date: 2019/09/11 11:22:17");
    
      script_cve_id("CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16528", "CVE-2017-16536", "CVE-2017-16537", "CVE-2017-16645", "CVE-2017-16646", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-7482", "CVE-2017-8824");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3398-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.103 to
    receive various security and bugfixes. The following security bugs
    were fixed :
    
      - CVE-2017-1000410: The Linux kernel was affected by an
        information lea that lies in the processing of incoming
        L2CAP commands - ConfigRequest, and ConfigResponse
        messages. (bnc#1070535).
    
      - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux
        kernel did not ensure that the dir value of
        xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which
        allowed local users to cause a denial of service
        (out-of-bounds access) or possibly have unspecified
        other impact via an XFRM_MSG_MIGRATE xfrm Netlink
        message (bnc#1050231).
    
      - CVE-2017-12193: The
        assoc_array_insert_into_terminal_node function in
        lib/assoc_array.c in the Linux kernel mishandled node
        splitting, which allowed local users to cause a denial
        of service (NULL pointer dereference and panic) via a
        crafted application, as demonstrated by the keyring key
        type, and key addition and link creation operations
        (bnc#1066192).
    
      - CVE-2017-15115: The sctp_do_peeloff function in
        net/sctp/socket.c in the Linux kernel did not check
        whether the intended netns is used in a peel-off action,
        which allowed local users to cause a denial of service
        (use-after-free and system crash) or possibly have
        unspecified other impact via crafted system calls
        (bnc#1068671).
    
      - CVE-2017-16528: sound/core/seq_device.c in the Linux
        kernel allowed local users to cause a denial of service
        (snd_rawmidi_dev_seq_free use-after-free and system
        crash) or possibly have unspecified other impact via a
        crafted USB device (bnc#1066629).
    
      - CVE-2017-16536: The cx231xx_usb_probe function in
        drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux
        kernel allowed local users to cause a denial of service
        (NULL pointer dereference and system crash) or possibly
        have unspecified other impact via a crafted USB device
        (bnc#1066606).
    
      - CVE-2017-16537: The imon_probe function in
        drivers/media/rc/imon.c in the Linux kernel allowed
        local users to cause a denial of service (NULL pointer
        dereference and system crash) or possibly have
        unspecified other impact via a crafted USB device
        (bnc#1066573).
    
      - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function
        in drivers/input/misc/ims-pcu.c in the Linux kernel
        allowed local users to cause a denial of service
        (ims_pcu_parse_cdc_data out-of-bounds read and system
        crash) or possibly have unspecified other impact via a
        crafted USB device (bnc#1067132).
    
      - CVE-2017-16646:
        drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux
        kernel allowed local users to cause a denial of service
        (BUG and system crash) or possibly have unspecified
        other impact via a crafted USB device (bnc#1067105).
    
      - CVE-2017-16994: The walk_hugetlb_range function in
        mm/pagewalk.c in the Linux kernel mishandled holes in
        hugetlb ranges, which allowed local users to obtain
        sensitive information from uninitialized kernel memory
        via crafted use of the mincore() system call
        (bnc#1069996).
    
      - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in
        the Linux kernel did not require the CAP_NET_ADMIN
        capability for new, get, and del operations, which
        allowed local users to bypass intended access
        restrictions because the nfnl_cthelper_list data
        structure is shared across all net namespaces
        (bnc#1071693).
    
      - CVE-2017-17449: The __netlink_deliver_tap_skb function
        in net/netlink/af_netlink.c in the Linux kernel did not
        restrict observations of Netlink messages to a single
        net namespace, which allowed local users to obtain
        sensitive information by leveraging the CAP_NET_ADMIN
        capability to sniff an nlmon interface for all Netlink
        activity on the system (bnc#1071694).
    
      - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux
        kernel did not require the CAP_NET_ADMIN capability for
        add_callback and remove_callback operations, which
        allowed local users to bypass intended access
        restrictions because the xt_osf_fingers data structure
        is shared across all net namespaces (bnc#1071695).
    
      - CVE-2017-7482: Fixed an overflow when decoding a krb5
        principal. (bnc#1046107).
    
      - CVE-2017-8824: The dccp_disconnect function in
        net/dccp/proto.c in the Linux kernel allowed local users
        to gain privileges or cause a denial of service
        (use-after-free) via an AF_UNSPEC connect system call
        during the DCCP_LISTEN state (bnc#1070771).
    
    The update package also includes non-security fixes. See advisory for
    details.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1010201"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1012382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1012523"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1015336"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1015337"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1015340"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1015342"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1015343"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1019675"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1020412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1020645"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1022595"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1022607"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1024346"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1024373"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1024376"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1024412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1031717"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1032150"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1036489"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1036800"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1037404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1037838"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1038299"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1039542"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1040073"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1041873"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1042268"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1042957"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1042977"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1042978"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1043017"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1045404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1046054"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1046107"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1047901"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1047989"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1048317"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1048327"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1048356"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1050060"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1050231"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1051406"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1051635"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1051987"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1052384"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1053309"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1053919"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1055272"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056003"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056365"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056427"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056587"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056596"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056652"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1056979"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1057079"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1057199"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1057820"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1058413"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1059639"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1060333"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1061756"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1062496"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1062835"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1062941"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1063026"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1063349"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1063516"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064206"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064320"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064597"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064606"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064701"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1064926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065101"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065180"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065600"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065639"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065692"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065717"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065866"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1065959"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066045"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066175"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066192"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066213"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066223"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066285"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066470"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066471"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066472"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066573"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066606"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066629"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066660"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066696"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066767"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066812"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1066974"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067105"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067132"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067225"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067494"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067734"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067735"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067888"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1067906"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1068671"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1068978"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1068980"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1068982"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069152"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069250"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069270"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069277"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069484"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069583"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069721"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069793"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069879"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069916"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069942"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1069996"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070001"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070006"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070145"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070169"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070404"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070535"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070767"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070771"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070805"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070825"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1070964"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1071693"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1071694"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1071695"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1071833"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1072589"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=744692"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=789311"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=964944"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=966170"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=966172"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=969470"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=979928"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=989261"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=996376"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-1000410/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-11600/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-12193/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-15115/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16528/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16536/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16537/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16645/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16646/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-16994/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-17448/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-17449/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-17450/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-7482/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2017-8824/"
      );
      # https://www.suse.com/support/update/announcement/2017/suse-su-20173398-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?02380b93"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Workstation Extension 12-SP3:zypper in -t patch
    SUSE-SLE-WE-12-SP3-2017-2129=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
    patch SUSE-SLE-SDK-12-SP3-2017-2129=1
    
    SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
    SUSE-SLE-SERVER-12-SP3-2017-2129=1
    
    SUSE Linux Enterprise Live Patching 12-SP3:zypper in -t patch
    SUSE-SLE-Live-Patching-12-SP3-2017-2129=1
    
    SUSE Linux Enterprise High Availability 12-SP3:zypper in -t patch
    SUSE-SLE-HA-12-SP3-2017-2129=1
    
    SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP3-2017-2129=1
    
    SUSE Container as a Service Platform ALL:zypper in -t patch
    SUSE-CAASP-ALL-2017-2129=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-extra");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-extra-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-default-man");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:kernel-syms");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/07/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/12/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP3", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(3)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"3", cpu:"s390x", reference:"kernel-default-man-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-base-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-base-debuginfo-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-debuginfo-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-debugsource-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-default-devel-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"kernel-syms-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-debuginfo-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-debugsource-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-devel-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-extra-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-default-extra-debuginfo-4.4.103-6.33.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"kernel-syms-4.4.103-6.33.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1390.NASL
    descriptionThe openSUSE Leap 42.2 kernel was updated to 4.4.102 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-1000410: The Linux kernel was affected by an information leak in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The following non-security bugs were fixed : - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717). - adv7604: Initialize drive strength to default when using DT (bnc#1012382). - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382). - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382). - alsa: hda: Add Raven PCI ID (bnc#1012382). - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE (bnc#1012382). - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717). - alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382). - alsa: hda - No loopback on ALC299 codec (git-fixes). - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717). - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382). - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382). - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717). - alsa: hda: Remove superfluous
    last seen2020-06-05
    modified2017-12-18
    plugin id105344
    published2017-12-18
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105344
    titleopenSUSE Security Update : the Linux Kernel (openSUSE-2017-1390) (Dirty COW)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2017-1390.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(105344);
      script_version("3.5");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2017-1000405", "CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-12193", "CVE-2017-15115", "CVE-2017-16528", "CVE-2017-16536", "CVE-2017-16537", "CVE-2017-16645", "CVE-2017-16646", "CVE-2017-16939", "CVE-2017-16994", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-7482", "CVE-2017-8824");
    
      script_name(english:"openSUSE Security Update : the Linux Kernel (openSUSE-2017-1390) (Dirty COW)");
      script_summary(english:"Check for the openSUSE-2017-1390 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The openSUSE Leap 42.2 kernel was updated to 4.4.102 to receive
    various security and bugfixes.
    
    The following security bugs were fixed :
    
      - CVE-2017-1000405: A bug in the THP CoW support could be
        used by local attackers to corrupt memory of other
        processes and cause them to crash (bnc#1069496).
    
      - CVE-2017-1000410: The Linux kernel was affected by an
        information leak in the processing of incoming L2CAP
        commands - ConfigRequest, and ConfigResponse messages.
        (bnc#1070535).
    
      - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux
        kernel did not ensure that the dir value of
        xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which
        allowed local users to cause a denial of service
        (out-of-bounds access) or possibly have unspecified
        other impact via an XFRM_MSG_MIGRATE xfrm Netlink
        message (bnc#1050231).
    
      - CVE-2017-12193: The
        assoc_array_insert_into_terminal_node function in
        lib/assoc_array.c in the Linux kernel mishandled node
        splitting, which allowed local users to cause a denial
        of service (NULL pointer dereference and panic) via a
        crafted application, as demonstrated by the keyring key
        type, and key addition and link creation operations
        (bnc#1066192).
    
      - CVE-2017-15115: The sctp_do_peeloff function in
        net/sctp/socket.c in the Linux kernel did not check
        whether the intended netns is used in a peel-off action,
        which allowed local users to cause a denial of service
        (use-after-free and system crash) or possibly have
        unspecified other impact via crafted system calls
        (bnc#1068671).
    
      - CVE-2017-16528: sound/core/seq_device.c in the Linux
        kernel allowed local users to cause a denial of service
        (snd_rawmidi_dev_seq_free use-after-free and system
        crash) or possibly have unspecified other impact via a
        crafted USB device (bnc#1066629).
    
      - CVE-2017-16536: The cx231xx_usb_probe function in
        drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux
        kernel allowed local users to cause a denial of service
        (NULL pointer dereference and system crash) or possibly
        have unspecified other impact via a crafted USB device
        (bnc#1066606).
    
      - CVE-2017-16537: The imon_probe function in
        drivers/media/rc/imon.c in the Linux kernel allowed
        local users to cause a denial of service (NULL pointer
        dereference and system crash) or possibly have
        unspecified other impact via a crafted USB device
        (bnc#1066573).
    
      - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function
        in drivers/input/misc/ims-pcu.c in the Linux kernel
        allowed local users to cause a denial of service
        (ims_pcu_parse_cdc_data out-of-bounds read and system
        crash) or possibly have unspecified other impact via a
        crafted USB device (bnc#1067132).
    
      - CVE-2017-16646:
        drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux
        kernel allowed local users to cause a denial of service
        (BUG and system crash) or possibly have unspecified
        other impact via a crafted USB device (bnc#1067105).
    
      - CVE-2017-16939: The XFRM dump policy implementation in
        net/xfrm/xfrm_user.c in the Linux kernel allowed local
        users to gain privileges or cause a denial of service
        (use-after-free) via a crafted SO_RCVBUF setsockopt
        system call in conjunction with XFRM_MSG_GETPOLICY
        Netlink messages (bnc#1069702).
    
      - CVE-2017-16994: The walk_hugetlb_range function in
        mm/pagewalk.c in the Linux kernel mishandled holes in
        hugetlb ranges, which allowed local users to obtain
        sensitive information from uninitialized kernel memory
        via crafted use of the mincore() system call
        (bnc#1069996).
    
      - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in
        the Linux kernel did not require the CAP_NET_ADMIN
        capability for new, get, and del operations, which
        allowed local users to bypass intended access
        restrictions because the nfnl_cthelper_list data
        structure is shared across all net namespaces
        (bnc#1071693).
    
      - CVE-2017-17449: The __netlink_deliver_tap_skb function
        in net/netlink/af_netlink.c in the Linux kernel did not
        restrict observations of Netlink messages to a single
        net namespace, which allowed local users to obtain
        sensitive information by leveraging the CAP_NET_ADMIN
        capability to sniff an nlmon interface for all Netlink
        activity on the system (bnc#1071694).
    
      - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux
        kernel did not require the CAP_NET_ADMIN capability for
        add_callback and remove_callback operations, which
        allowed local users to bypass intended access
        restrictions because the xt_osf_fingers data structure
        is shared across all net namespaces (bnc#1071695).
    
      - CVE-2017-7482: Fixed an overflow when decoding a krb5
        principal. (bnc#1046107).
    
      - CVE-2017-8824: The dccp_disconnect function in
        net/dccp/proto.c in the Linux kernel allowed local users
        to gain privileges or cause a denial of service
        (use-after-free) via an AF_UNSPEC connect system call
        during the DCCP_LISTEN state (bnc#1070771).
    
    The following non-security bugs were fixed :
    
      - adm80211: return an error if adm8211_alloc_rings() fails
        (bsc#1031717).
    
      - adv7604: Initialize drive strength to default when using
        DT (bnc#1012382).
    
      - af_netlink: ensure that NLMSG_DONE never fails in dumps
        (bnc#1012382).
    
      - alsa: caiaq: Fix stray URB at probe error path
        (bnc#1012382).
    
      - alsa: hda: Add Raven PCI ID (bnc#1012382).
    
      - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on
        HDA_FIXUP_ACT_PROBE (bnc#1012382).
    
      - alsa: hda/ca0132 - Fix memory leak at error path
        (bsc#1031717).
    
      - alsa: hda - fix headset mic problem for Dell machines
        with alc236 (bnc#1012382).
    
      - alsa: hda - No loopback on ALC299 codec (git-fixes).
    
      - alsa: hda/realtek: Add headset mic support for Intel NUC
        Skull Canyon (bsc#1031717).
    
      - alsa: hda/realtek - Add new codec ID ALC299
        (bnc#1012382).
    
      - alsa: hda/realtek - Add support for ALC236/ALC3204
        (bnc#1012382).
    
      - alsa: hda/realtek - Fix ALC700 family no sound issue
        (bsc#1031717).
    
      - alsa: hda: Remove superfluous '-' added by printk
        conversion (bnc#1012382).
    
      - alsa: line6: Fix leftover URB at error-path during probe
        (bnc#1012382).
    
      - alsa: pcm: update tstamp only if audio_tstamp changed
        (bsc#1031717).
    
      - alsa: seq: Avoid invalid lockdep class warning
        (bsc#1031717).
    
      - alsa: seq: Enable 'use' locking in all configurations
        (bnc#1012382).
    
      - alsa: seq: Fix copy_from_user() call inside lock
        (bnc#1012382).
    
      - alsa: seq: Fix nested rwsem annotation for lockdep splat
        (bnc#1012382).
    
      - alsa: seq: Fix OSS sysex delivery in OSS emulation
        (bnc#1012382).
    
      - alsa: timer: Add missing mutex lock for compat ioctls
        (bnc#1012382).
    
      - alsa: timer: Remove kernel warning at compat ioctl error
        paths (bsc#1031717).
    
      - alsa: usb-audio: Add native DSD support for Pro-Ject Pre
        Box S2 Digital (bnc#1012382).
    
      - alsa: usb-audio: Add sanity checks in v2 clock parsers
        (bsc#1031717).
    
      - alsa: usb-audio: Add sanity checks to FE parser
        (bsc#1031717).
    
      - alsa: usb-audio: Fix potential out-of-bound access at
        parsing SU (bsc#1031717).
    
      - alsa: usb-audio: Kill stray URB at exiting
        (bnc#1012382).
    
      - alsa: usb-audio: uac1: Invalidate ctl on interrupt
        (bsc#1031717).
    
      - alsa: vx: Do not try to update capture stream before
        running (bnc#1012382).
    
      - alsa: vx: Fix possible transfer overflow (bnc#1012382).
    
      - Apply generic ppc build fixes to vanilla (bsc#1070805)
    
      - arm64: dts: NS2: reserve memory for Nitro firmware
        (bnc#1012382).
    
      - arm64: ensure __dump_instr() checks addr_limit
        (bnc#1012382).
    
      - arm64: fix dump_instr when PAN and UAO are in use
        (bnc#1012382).
    
      - arm: 8715/1: add a private asm/unaligned.h
        (bnc#1012382).
    
      - arm: 8720/1: ensure dump_instr() checks addr_limit
        (bnc#1012382).
    
      - arm: 8721/1: mm: dump: check hardware RO bit for LPAE
        (bnc#1012382).
    
      - arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for
        LPAE (bnc#1012382).
    
      - arm: crypto: reduce priority of bit-sliced AES cipher
        (bnc#1012382).
    
      - arm: dts: Fix am335x and dm814x scm syscon to probe
        children (bnc#1012382).
    
      - arm: dts: Fix compatible for ti81xx uarts for 8250
        (bnc#1012382).
    
      - arm: dts: Fix omap3 off mode pull defines (bnc#1012382).
    
      - arm: dts: mvebu: pl310-cache disable double-linefill
        (bnc#1012382).
    
      - arm: OMAP2+: Fix init for multiple quirks for the same
        SoC (bnc#1012382).
    
      - arm: omap2plus_defconfig: Fix probe errors on UARTs 5
        and 6 (bnc#1012382).
    
      - arm: pxa: Do not rely on public mmc header to include
        leds.h (bnc#1012382).
    
      - asm/sections: add helpers to check for section data
        (bsc#1063026).
    
      - asoc: adau17x1: Workaround for noise bug in ADC
        (bnc#1012382).
    
      - asoc: cs42l56: Fix reset GPIO name in example DT binding
        (bsc#1031717).
    
      - asoc: davinci-mcasp: Fix an error handling path in
        'davinci_mcasp_probe()' (bsc#1031717).
    
      - asoc: rsnd: do not double free kctrl (bnc#1012382).
    
      - asoc: samsung: Fix possible double iounmap on s3c24xx
        driver probe failure (bsc#1031717).
    
      - asoc: wm_adsp: Do not overrun firmware file buffer when
        reading region data (bnc#1012382).
    
      - ata: ATA_BMDMA should depend on HAS_DMA (bnc#1012382).
    
      - ata: fixes kernel crash while tracing
        ata_eh_link_autopsy event (bnc#1012382).
    
      - ata: SATA_HIGHBANK should depend on HAS_DMA
        (bnc#1012382).
    
      - ata: SATA_MV should depend on HAS_DMA (bnc#1012382).
    
      - ath10k: convert warning about non-existent OTP board id
        to debug message (git-fixes).
    
      - ath10k: fix a warning during channel switch with
        multiple vaps (bsc#1031717).
    
      - ath10k: fix board data fetch error message
        (bsc#1031717).
    
      - ath10k: fix diag_read to collect data for larger memory
        (bsc#1031717).
    
      - ath10k: fix incorrect txpower set by P2P_DEVICE
        interface (bnc#1012382).
    
      - ath10k: fix potential memory leak in
        ath10k_wmi_tlv_op_pull_fw_stats() (bnc#1012382).
    
      - ath10k: free cached fw bin contents when get board id
        fails (bsc#1031717).
    
      - ath10k: ignore configuring the incorrect board_id
        (bnc#1012382).
    
      - ath10k: set CTS protection VDEV param only if VDEV is up
        (bnc#1012382).
    
      - ath9k_htc: check for underflow in ath9k_htc_rx_msg()
        (bsc#1031717).
    
      - ath9k: off by one in ath9k_hw_nvram_read_array()
        (bsc#1031717).
    
      - autofs: do not fail mount for transient error
        (bsc#1065180).
    
      - backlight: adp5520: Fix error handling in
        adp5520_bl_probe() (bnc#1012382).
    
      - backlight: lcd: Fix race condition during register
        (bnc#1012382).
    
      - bcache: check ca->alloc_thread initialized before wake
        up it (bnc#1012382).
    
      - blacklist 0278b34bf15f spi: spidev_test: Fix buffer
        overflow in unescape() This is a binary built from
        Documentation and the build logs do not show it built
    
      - blacklist.conf: 79b63f12abcbbd2caf7064b294af648a87de07ff
        # bsc#1061756 may break existing setups
    
      - blacklist.conf: Add ath10k, mmc and rtl8192u commits
        (bsc#1031717)
    
      - blacklist.conf: Add drm/i915 blacklist (bsc#1031717)
    
      - blacklist.conf: added misc commits (bsc#1031717)
    
      - blacklist.conf: Add misc entries (bsc#1031717)
    
      - blacklist.conf: Blacklist 33e465ce7cb3 ('percpu_ref:
        allow operation mode switching operations to be called
        concurrently'). The benefits are not worth the possible
        risks eventually introduced.
    
      - blacklist.conf: blacklisted 16af97dc5a89 (bnc#1053919)
    
      - blacklist.conf: blacklist not-applicable patch
        (bsc#1071231)
    
      - blacklist.conf: commit fe22cd9b7c980b8b948 ('printk:
        help pr_debug and pr_devel to optimize out arguments')
        is just a cosmetic change.
    
      - blacklist.conf: Update blacklist (bsc#1031717)
    
      - blacklist.conf: Update iwlwifi blacklist (bsc#1031717)
    
      - blacklist.conf: yet another serial entry (bsc#1031717)
    
      - block: Fix a race between blk_cleanup_queue() and
        timeout handling (FATE#319965, bsc#964944).
    
      - bluetooth: btusb: fix QCA Rome suspend/resume
        (bnc#1012382).
    
      - bnxt_en: Call firmware to approve the random VF MAC
        address (bsc#963575 FATE#320144).
    
      - bnxt_en: Do not setup MAC address in
        bnxt_hwrm_func_qcaps() (bsc#963575 FATE#320144).
    
      - bnxt_en: Fix possible corrupted NVRAM parameters from
        firmware response (bsc#963575 FATE#320144).
    
      - bnxt_en: Fix VF PCIe link speed and width logic
        (bsc#963575 FATE#320144).
    
      - bnxt_en: Re-arrange bnxt_hwrm_func_qcaps() (bsc#963575
        FATE#320144).
    
      - bnxt_en: use eth_hw_addr_random() (bsc#963575
        FATE#320144).
    
      - bonding: discard lowest hash bit for 802.3ad layer3+4
        (bnc#1012382).
    
      - bpf: one perf event close won't free bpf program
        attached by another perf event (bnc#1012382).
    
      - bpf/verifier: reject BPF_ALU64|BPF_END (bnc#1012382).
    
      - brcmfmac: add length check in
        brcmf_cfg80211_escan_handler() (bnc#1012382).
    
      - brcmfmac: remove setting IBSS mode when stopping AP
        (bnc#1012382).
    
      - brcmsmac: make some local variables 'static const' to
        reduce stack size (bnc#1012382).
    
      - bt8xx: fix memory leak (bnc#1012382).
    
      - btrfs: add a node counter to each of the rbtrees
        (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: add cond_resched() calls when resolving backrefs
        (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: allow backref search checks for shared extents
        (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: backref, add tracepoints for prelim_ref insertion
        and merging (bsc#974590 bsc#1030061 bsc#1022914
        bsc#1017461).
    
      - btrfs: backref, add unode_aux_to_inode_list helper
        (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: backref, cleanup __ namespace abuse (bsc#974590
        bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: backref, constify some arguments (bsc#974590
        bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: btrfs_check_shared should manage its own
        transaction (bsc#974590 bsc#1030061 bsc#1022914
        bsc#1017461).
    
      - btrfs: clean up extraneous computations in
        add_delayed_refs (bsc#974590 bsc#1030061 bsc#1022914
        bsc#1017461).
    
      - btrfs: constify tracepoint arguments (bsc#974590
        bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: convert prelimary reference tracking to use
        rbtrees (bsc#974590 bsc#1030061 bsc#1022914
        bsc#1017461).
    
      - btrfs: fix leak and use-after-free in
        resolve_indirect_refs (bsc#974590 bsc#1030061
        bsc#1022914 bsc#1017461).
    
      - btrfs: Fix typo in may_commit_transaction Rather than
        comparing the result of the percpu comparison I was
        comparing the value of the percpu counter against 0 or
        1.
    
      - btrfs: remove ref_tree implementation from backref.c
        (bsc#974590 bsc#1030061 bsc#1022914 bsc#1017461).
    
      - btrfs: return the actual error value from from
        btrfs_uuid_tree_iterate (bnc#1012382).
    
      - btrfs: struct-funcs, constify readers (bsc#974590
        bsc#1030061 bsc#1022914 bsc#1017461).
    
      - bus: mbus: fix window size calculation for 4GB windows
        (bnc#1012382).
    
      - can: c_can: do not indicate triple sampling support for
        D_CAN (bnc#1012382).
    
      - can: esd_usb2: Fix can_dlc value for received RTR,
        frames (bnc#1012382).
    
      - can: gs_usb: fix busy loop if no more TX context is
        available (bnc#1012382).
    
      - can: kvaser_usb: Correct return value in printout
        (bnc#1012382).
    
      - can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages
        (bnc#1012382).
    
      - can: sun4i: fix loopback mode (bnc#1012382).
    
      - can: sun4i: handle overrun in RX FIFO (bnc#1012382).
    
      - cdc_ncm: Set NTB format again after altsetting switch
        for Huawei devices (bnc#1012382).
    
      - ceph: clean up unsafe d_parent accesses in
        build_dentry_path (bnc#1012382).
    
      - ceph: unlock dangling spinlock in try_flush_caps()
        (bsc#1065639).
    
      - cgroup, net_cls: iterate the fds of only the tasks which
        are being migrated (bnc#1064926).
    
      - cifs: add build_path_from_dentry_optional_prefix()
        (fate#323482)
    
      - cifs: Add capability to decrypt big read responses
        (FATE#324404). Allow to decrypt transformed packets that
        are bigger than the big buffer size. In particular it is
        used for read responses that can only exceed the big
        buffer size.
    
      - cifs: Add capability to transform requests before
        sending (FATE#324404). This will allow us to do protocol
        specific tranformations of packets before sending to the
        server. For SMB3 it can be used to support encryption.
    
      - cifs: Add copy into pages callback for a read operation
        (FATE#324404). Since we have two different types of
        reads (pagecache and direct) we need to process such
        responses differently after decryption of a packet. The
        change allows to specify a callback that copies a read
        payload data into preallocated pages.
    
      - cifs: Add mid handle callback (FATE#324404). We need to
        process read responses differently because the data
        should go directly into preallocated pages. This can be
        done by specifying a mid handle callback.
    
      - cifs: Add soft dependencies (FATE#324404). List soft
        dependencies of cifs so that mkinitrd and dracut can
        include the required helper modules.
    
      - cifs: Add transform header handling callbacks
        (FATE#324404). We need to recognize and parse
        transformed packets in demultiplex thread to find a
        corresponsing mid and process it further.
    
      - cifs: add use_ipc flag to SMB2_ioctl() (fate#323482)
    
      - cifs: Allow to switch on encryption with seal mount
        option (FATE#324404). This allows users to inforce
        encryption for SMB3 shares if a server supports it.
    
      - cifs: check MaxPathNameComponentLength != 0 before using
        it (bnc#1012382).
    
      - cifs: Decrypt and process small encrypted packets
        (FATE#324404). Allow to decrypt transformed packets,
        find a corresponding mid and process as usual further.
    
      - cifs: do not bother with kmap on read_pages side
        (FATE#324404). just do ITER_BVEC recvmsg
    
      - cifs: Enable encryption during session setup phase
        (FATE#324404). In order to allow encryption on SMB
        connection we need to exchange a session key and
        generate encryption and decryption keys.
    
      - cifs: Encrypt SMB3 requests before sending
        (FATE#324404). This change allows to encrypt packets if
        it is required by a server for SMB sessions or tree
        connections.
    
      - cifs: fix circular locking dependency (bsc#1064701).
    
      - cifs: Fix some return values in case of error in
        'crypt_message' (fate#324404).
    
      - cifs: Fix sparse warnings (fate#323482)
    
      - cifs: implement get_dfs_refer for SMB2+ (fate#323482)
    
      - cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)
    
      - cifs: Make send_cancel take rqst as argument
        (FATE#324404).
    
      - cifs: Make SendReceive2() takes resp iov (FATE#324404).
        Now SendReceive2 frees the first iov and returns a
        response buffer in it that increases a code complexity.
        Simplify this by making a caller responsible for freeing
        request buffer itself and returning a response buffer in
        a separate iov.
    
      - cifs: move DFS response parsing out of SMB1 code
        (fate#323482)
    
      - cifs: no need to wank with copying and advancing iovec
        on recvmsg side either (FATE#324404).
    
      - cifs: Only select the required crypto modules
        (FATE#324404). The sha256 and cmac crypto modules are
        only needed for SMB2+, so move the select statements to
        config CIFS_SMB2. Also select CRYPTO_AES there as SMB2+
        needs it.
    
      - cifs: Prepare for encryption support (first part). Add
        decryption and encryption key generation. (FATE#324404).
    
      - cifs_readv_receive: use cifs_read_from_socket()
        (FATE#324404).
    
      - cifs: Reconnect expired SMB sessions (bnc#1012382).
    
      - cifs: remove any preceding delimiter from prefix_path
        (fate#323482)
    
      - cifs: Send RFC1001 length in a separate iov
        (FATE#324404). In order to simplify further encryption
        support we need to separate RFC1001 length and SMB2
        header when sending a request. Put the length field in
        iov[0] and the rest of the packet into following iovs.
    
      - cifs: Separate RFC1001 length processing for SMB2 read
        (FATE#324404). Allocate and initialize SMB2 read request
        without RFC1001 length field to directly call
        cifs_send_recv() rather than SendReceive2() in a read
        codepath.
    
      - cifs: Separate SMB2 header structure (FATE#324404). In
        order to support compounding and encryption we need to
        separate RFC1001 length field and SMB2 header structure
        because the protocol treats them differently. This
        change will allow to simplify parsing of such complex
        SMB2 packets further.
    
      - cifs: Separate SMB2 sync header processing
        (FATE#324404). Do not process RFC1001 length in
        smb2_hdr_assemble() because it is not a part of SMB2
        header. This allows to cleanup the code and adds a
        possibility combine several SMB2 packets into one for
        compounding.
    
      - cifs: set signing flag in SMB2+ TreeConnect if needed
        (fate#323482)
    
      - cifs: Simplify SMB2 and SMB311 dependencies
        (FATE#324404). * CIFS_SMB2 depends on CIFS, which
        depends on INET and selects NLS. So these dependencies
        do not need to be repeated for CIFS_SMB2. * CIFS_SMB311
        depends on CIFS_SMB2, which depends on INET. So this
        dependency does not need to be repeated for CIFS_SMB311.
    
      - cifs: use DFS pathnames in SMB2+ Create requests
        (fate#323482)
    
      - clk: ti: dra7-atl-clock: fix child-node lookups
        (bnc#1012382).
    
      - clk: ti: dra7-atl-clock: Fix of_node reference counting
        (bnc#1012382).
    
      - clockevents/drivers/cs5535: Improve resilience to
        spurious interrupts (bnc#1012382).
    
      - cma: fix calculation of aligned offset (VM
        Functionality, bsc#1050060).
    
      - coda: fix 'kernel memory exposure attempt' in fsync
        (bnc#1012382).
    
      - cpufreq: CPPC: add ACPI_PROCESSOR dependency
        (bnc#1012382).
    
      - crypto: shash - Fix zero-length shash ahash digest crash
        (bnc#1012382).
    
      - crypto: vmx - disable preemption to enable vsx in
        aes_ctr.c (bnc#1012382).
    
      - crypto: x86/sha1-mb - fix panic due to unaligned access
        (bnc#1012382).
    
      - crypto: xts - Add ECB dependency (bnc#1012382).
    
      - cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).
    
      - cxgb4: Fix error codes in c4iw_create_cq()
        (bsc#1021424).
    
      - cxl: Fix DAR check & use REGION_ID instead of opencoding
        (bsc#1066223).
    
      - cxl: Fix leaking pid refs in some error paths
        (bsc#1066223).
    
      - cxl: Force context lock during EEH flow (bsc#1066223).
    
      - cxl: Prevent adapter reset if an active context exists
        (bsc#1066223).
    
      - cxl: Route eeh events to all drivers in
        cxl_pci_error_detected() (bsc#1066223).
    
      - direct-io: Prevent NULL pointer access in
        submit_page_section (bnc#1012382).
    
      - Disable IPMI fix patches due to regression (bsc#1071833)
    
      - Disable
        patches.kernel.org/4.4.93-022-fix-unbalanced-page-refcou
        nting-in-bio_map_use.patch (bsc#1070767) Refresh
        patches.drivers/0004-bio-use-offset_in_page-macro.patch.
    
      - dmaengine: dmatest: warn user when dma test times out
        (bnc#1012382).
    
      - dmaengine: edma: Align the memcpy acnt array size with
        the transfer (bnc#1012382).
    
      - dmaengine: zx: set DMA_CYCLIC cap_mask bit
        (bnc#1012382).
    
      - dm bufio: fix integer overflow when limiting maximum
        cache size (bnc#1012382).
    
      - dm: fix race between dm_get_from_kobject() and
        __dm_destroy() (bnc#1012382).
    
      - drivers: dma-mapping: Do not leave an invalid
        area->pages pointer in dma_common_contiguous_remap()
        (Git-fixes, bsc#1065692).
    
      - drm/amdgpu: when dpm disabled, also need to stop/start
        vce (bnc#1012382).
    
      - drm/amdkfd: NULL dereference involving create_process()
        (bsc#1031717).
    
      - drm: Apply range restriction after color adjustment when
        allocation (bnc#1012382).
    
      - drm/armada: Fix compile fail (bnc#1012382).
    
      - drm: drm_minor_register(): Clean up debugfs on failure
        (bnc#1012382).
    
      - drm: gma500: fix logic error (bsc#1031717).
    
      - drm/i915/bxt: set min brightness from VBT (bsc#1031717).
    
      - drm/i915: Do not try indexed reads to alternate slave
        addresses (bsc#1031717).
    
      - drm/i915: fix backlight invert for non-zero minimum
        brightness (bsc#1031717).
    
      - drm/i915: Prevent zero length 'index' write
        (bsc#1031717).
    
      - drm/i915: Read timings from the correct transcoder in
        intel_crtc_mode_get() (bsc#1031717).
    
      - drm/msm: fix an integer overflow test (bnc#1012382).
    
      - drm/msm: Fix potential buffer overflow issue
        (bnc#1012382).
    
      - drm/nouveau/bsp/g92: disable by default (bnc#1012382).
    
      - drm/nouveau/gr: fallback to legacy paths during firmware
        lookup (bsc#1031717).
    
      - drm/nouveau/mmu: flush tlbs before deleting page tables
        (bnc#1012382).
    
      - drm/omap: Fix error handling path in 'omap_dmm_probe()'
        (bsc#1031717).
    
      - drm/panel: simple: Add missing panel_simple_unprepare()
        calls (bsc#1031717).
    
      - drm/sti: sti_vtg: Handle return NULL error from
        devm_ioremap_nocache (bnc#1012382).
    
      - drm/vc4: Fix leak of HDMI EDID (bsc#1031717).
    
      - drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue
        (bnc#1012382).
    
      - e1000e: Fix error path in link detection (bnc#1012382).
    
      - e1000e: Fix return value test (bnc#1012382).
    
      - e1000e: Separate signaling for link check/link up
        (bnc#1012382).
    
      - ecryptfs: fix dereference of NULL user_key_payload
        (bnc#1012382).
    
      - eCryptfs: use after free in ecryptfs_release_messaging()
        (bsc#1012829).
    
      - epoll: avoid calling ep_call_nested() from
        ep_poll_safewake() (bsc#1056427).
    
      - epoll: remove ep_call_nested() from ep_eventpoll_poll()
        (bsc#1056427).
    
      - ext4: cleanup goto next group (bsc#1066285).
    
      - ext4: do not use stripe_width if it is not set
        (bnc#1012382).
    
      - ext4: fix interaction between i_size, fallocate, and
        delalloc after a crash (bnc#1012382).
    
      - ext4: fix stripe-unaligned allocations (bnc#1012382).
    
      - ext4: in ext4_seek_(hole,data), return -ENXIO for
        negative offsets (bnc#1012382).
    
      - ext4: reduce lock contention in __ext4_new_inode
        (bsc#1066285).
    
      - extcon: palmas: Check the parent instance to prevent the
        NULL (bnc#1012382).
    
      - exynos4-is: fimc-is: Unmap region obtained by of_iomap()
        (bnc#1012382).
    
      - f2fs crypto: add missing locking for keyring_key access
        (bnc#1012382).
    
      - f2fs crypto: replace some BUG_ON()'s with error checks
        (bnc#1012382).
    
      - f2fs: do not wait for writeback in write_begin
        (bnc#1012382).
    
      - fealnx: Fix building error on MIPS (bnc#1012382).
    
      - fix a page leak in vhost_scsi_iov_to_sgl() error
        recovery (bnc#1012382).
    
      - Fix tracing sample code warning (bnc#1012382).
    
      - fix unbalanced page refcounting in bio_map_user_iov
        (bnc#1012382).
    
      - fm10k: request reset when mbx->state changes
        (bnc#1012382).
    
      - fm10k: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - fs/9p: Compare qid.path in v9fs_test_inode
        (bsc#1012829).
    
      - fs-cache: fix dereference of NULL user_key_payload
        (bnc#1012382).
    
      - fscrypt: fix dereference of NULL user_key_payload
        (bnc#1012382).
    
      - fscrypt: lock mutex before checking for bounce page pool
        (bnc#1012382).
    
      - fscrypto: require write access to mount to set
        encryption policy (bnc#1012382).
    
      - fuse: fix READDIRPLUS skipping an entry (bnc#1012382).
    
      - gpu: drm: mgag200: mgag200_main:- Handle error from
        pci_iomap (bnc#1012382).
    
      - hid: elo: clear BTN_LEFT mapping (bsc#1065866).
    
      - hid: usbhid: fix out-of-bounds bug (bnc#1012382).
    
      - hsi: ssi_protocol: double free in ssip_pn_xmit()
        (bsc#1031717).
    
      - i2c: at91: ensure state is restored after suspending
        (bnc#1012382).
    
      - i2c: cadance: fix ctrl/addr reg write order
        (bsc#1031717).
    
      - i2c: imx: Use correct function to write to register
        (bsc#1031717).
    
      - i2c: ismt: Separate I2C block read from SMBus block read
        (bnc#1012382).
    
      - i2c: riic: correctly finish transfers (bnc#1012382).
    
      - i2c: riic: fix restart condition (git-fixes).
    
      - i40e: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - i40evf: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - ib/core: Fix calculation of maximum RoCE MTU
        (bsc#1022595 FATE#322350).
    
      - ib/core: Namespace is mandatory input for address
        resolution (bsc#1022595 FATE#322350).
    
      - ib/ipoib: Change list_del to list_del_init in the tx
        object (bnc#1012382).
    
      - ib/ipoib: Clean error paths in add port (bsc#1022595
        FATE#322350).
    
      - ib/ipoib: Prevent setting negative values to
        max_nonsrq_conn_qp (bsc#1022595 FATE#322350).
    
      - ib/ipoib: Remove double pointer assigning (bsc#1022595
        FATE#322350).
    
      - ib/ipoib: Set IPOIB_NEIGH_TBL_FLUSH after flushed
        completion initialization (bsc#1022595 FATE#322350).
    
      - ib/mlx5: Fix RoCE Address Path fields (bsc#966170
        FATE#320225 bsc#966172 FATE#320226).
    
      - ibmvnic: Add netdev_dbg output for debugging
        (fate#323285).
    
      - ibmvnic: Add vnic client data to login buffer
        (bsc#1069942).
    
      - ibmvnic: Convert vnic server reported statistics to cpu
        endian (fate#323285).
    
      - ibmvnic: Enable scatter-gather support (bsc#1066382).
    
      - ibmvnic: Enable TSO support (bsc#1066382).
    
      - ibmvnic: Feature implementation of Vital Product Data
        (VPD) for the ibmvnic driver (bsc#1069942).
    
      - ibmvnic: Fix calculation of number of TX header
        descriptors (bsc#1066382).
    
      - ibmvnic: fix dma_mapping_error call (bsc#1069942).
    
      - ibmvnic: Fix failover error path for non-fatal resets
        (bsc#1066382).
    
      - ibmvnic: Implement .get_channels (fate#323285).
    
      - ibmvnic: Implement .get_ringparam (fate#323285).
    
      - ibmvnic: Implement per-queue statistics reporting
        (fate#323285).
    
      - ibmvnic: Let users change net device features
        (bsc#1066382).
    
      - ibmvnic: Update reset infrastructure to support tunable
        parameters (bsc#1066382).
    
      - ib/srp: Avoid that a cable pull can trigger a kernel
        crash (bsc#1022595 FATE#322350).
    
      - ib/srpt: Do not accept invalid initiator port names
        (bnc#1012382).
    
      - ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).
    
      - ib/uverbs: Fix NULL pointer dereference during device
        removal (bsc#1022595 FATE#322350).
    
      - igb: close/suspend race in netif_device_detach
        (bnc#1012382).
    
      - igb: Fix hw_dbg logging in igb_update_flash_i210
        (bnc#1012382).
    
      - igb: reset the PHY before reading the PHY ID
        (bnc#1012382).
    
      - igb: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - igbvf: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - iio: adc: xilinx: Fix error handling (bnc#1012382).
    
      - iio: dummy: events: Add missing break (bsc#1031717).
    
      - iio: light: fix improper return value (bnc#1012382).
    
      - iio: trigger: free trigger resource correctly
        (bnc#1012382).
    
      - ima: do not update security.ima if appraisal status is
        not INTEGRITY_PASS (bnc#1012382).
    
      - input: ar1021_i2c - fix too long name in driver's device
        table (bsc#1031717).
    
      - input: edt-ft5x06 - fix setting gain, offset, and
        threshold via device tree (bsc#1031717).
    
      - input: elan_i2c - add ELAN060C to the ACPI table
        (bnc#1012382).
    
      - input: elan_i2c - add ELAN0611 to the ACPI table
        (bnc#1012382).
    
      - input: gtco - fix potential out-of-bound access
        (bnc#1012382).
    
      - input: mpr121 - handle multiple bits change of status
        register (bnc#1012382).
    
      - input: mpr121 - set missing event capability
        (bnc#1012382).
    
      - input: ti_am335x_tsc - fix incorrect step config for 5
        wire touchscreen (bsc#1031717).
    
      - input: twl4030-pwrbutton - use correct device for irq
        request (bsc#1031717).
    
      - input: ucb1400_ts - fix suspend and resume handling
        (bsc#1031717).
    
      - input: uinput - avoid crash when sending FF request to
        device going away (bsc#1031717).
    
      - iommu/amd: Finish TLB flush in amd_iommu_unmap()
        (bnc#1012382).
    
      - iommu/arm-smmu-v3: Clear prior settings when updating
        STEs (bnc#1012382).
    
      - iommu/vt-d: Do not register bus-notifier under
        dmar_global_lock (bsc#1069793).
    
      - ip6_gre: only increase err_count for some certain type
        icmpv6 in ip6gre_err (bnc#1012382).
    
      - ip6_gre: skb_push ipv6hdr before packing the header in
        ip6gre_header (bnc#1012382).
    
      - ipip: only increase err_count for some certain type icmp
        in ipip_err (bnc#1012382).
    
      - ipmi: fix unsigned long underflow (bnc#1012382).
    
      - ipmi: Pick up slave address from SMBIOS on an ACPI
        device (bsc#1070006).
    
      - ipmi: Prefer ACPI system interfaces over SMBIOS ones
        (bsc#1070006).
    
      - ipmi_si: Clean up printks (bsc#1070006).
    
      - ipmi_si: fix memory leak on new_smi (bsc#1070006).
    
      - ipsec: do not ignore crypto err in ah4 input
        (bnc#1012382).
    
      - ipv6: flowlabel: do not leave opt->tot_len with garbage
        (bnc#1012382).
    
      - ipv6: only call ip6_route_dev_notify() once for
        NETDEV_UNREGISTER (bnc#1012382).
    
      - ipvs: make drop_entry protection effective for SIP-pe
        (bsc#1056365).
    
      - irqchip/crossbar: Fix incorrect type of local variables
        (bnc#1012382).
    
      - isa: Prevent NULL dereference in isa_bus driver
        callbacks (bsc#1031717).
    
      - iscsi-target: Fix non-immediate TMR reference leak
        (bnc#1012382).
    
      - isdn/i4l: fetch the ppp_write buffer in one shot
        (bnc#1012382).
    
      - isofs: fix timestamps beyond 2027 (bnc#1012382).
    
      - iwlwifi: mvm: fix the coex firmware API (bsc#1031717).
    
      - iwlwifi: mvm: return -ENODATA when reading the
        temperature with the FW down (bsc#1031717).
    
      - iwlwifi: mvm: set the RTS_MIMO_PROT bit in flag mask
        when sending sta to fw (bsc#1031717).
    
      - iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
        (bnc#1012382).
    
      - iwlwifi: split the regulatory rules when the bandwidth
        flags require it (bsc#1031717).
    
      - ixgbe: add mask for 64 RSS queues (bnc#1012382).
    
      - ixgbe: do not disable FEC from the driver (bnc#1012382).
    
      - ixgbe: fix AER error handling (bnc#1012382).
    
      - ixgbe: Fix skb list corruption on Power systems
        (bnc#1012382).
    
      - ixgbe: handle close/suspend race with
        netif_device_detach/present (bnc#1012382).
    
      - ixgbe: Reduce I2C retry count on X550 devices
        (bnc#1012382).
    
      - ixgbevf: Use smp_rmb rather than read_barrier_depends
        (bnc#1012382).
    
      - kABI fix for 4.4.99 net changes (stable-4.4.99).
    
      - kABI: protect struct l2tp_tunnel (kabi).
    
      - kABI: protect struct regulator_dev (kabi).
    
      - kABI: protect structs rt_rq+root_domain (kabi).
    
      - kABI: protect typedef rds_rdma_cookie_t (kabi).
    
      - kernel/sysctl.c: remove duplicate UINT_MAX check on
        do_proc_douintvec_conv() (bsc#1066470).
    
      - kernel/watchdog: Prevent false positives with turbo
        modes (bnc#1063516).
    
      - keys: do not let add_key() update an uninstantiated key
        (bnc#1012382).
    
      - keys: do not revoke uninstantiated key in
        request_key_auth_new() (bsc#1031717).
    
      - keys: encrypted: fix dereference of NULL
        user_key_payload (bnc#1012382).
    
      - keys: fix cred refcount leak in request_key_auth_new()
        (bsc#1031717).
    
      - keys: fix key refcount leak in keyctl_assume_authority()
        (bsc#1031717).
    
      - keys: fix key refcount leak in keyctl_read_key()
        (bsc#1031717).
    
      - keys: fix NULL pointer dereference during ASN.1 parsing
        [ver #2] (bnc#1012382).
    
      - keys: fix out-of-bounds read during ASN.1 parsing
        (bnc#1012382).
    
      - keys: Fix race between updating and finding a negative
        key (bnc#1012382).
    
      - keys: return full count in keyring_read() if buffer is
        too small (bnc#1012382).
    
      - keys: trusted: fix writing past end of buffer in
        trusted_read() (bnc#1012382).
    
      - keys: trusted: sanitize all key material (bnc#1012382).
    
      - KVM: nVMX: fix guest CR4 loading when emulating L2 to L1
        exit (bnc#1012382).
    
      - kvm: nVMX: set IDTR and GDTR limits when loading L1 host
        state (bnc#1012382).
    
      - KVM: PPC: Book 3S: XICS: correct the real mode ICP
        rejecting counter (bnc#1012382).
    
      - kvm: SVM: obey guest PAT (bnc#1012382).
    
      - l2tp: Avoid schedule while atomic in exit_net
        (bnc#1012382).
    
      - l2tp: check ps->sock before running
        pppol2tp_session_ioctl() (bnc#1012382).
    
      - l2tp: fix race condition in l2tp_tunnel_delete
        (bnc#1012382).
    
      - lib/digsig: fix dereference of NULL user_key_payload
        (bnc#1012382).
    
      - libertas: Fix lbs_prb_rsp_limit_set() (bsc#1031717).
    
      - lib/mpi: call cond_resched() from mpi_powm() loop
        (bnc#1012382).
    
      - libnvdimm, namespace: fix label initialization to use
        valid seq numbers (bnc#1012382).
    
      - libnvdimm, namespace: make 'resource' attribute only
        readable by root (bnc#1012382).
    
      - libnvdimm, pfn: make 'resource' attribute only readable
        by root (FATE#319858).
    
      - lib/ratelimit.c: use deferred printk() version
        (bsc#979928).
    
      - locking/lockdep: Add nest_lock integrity test
        (bnc#1012382).
    
      - mac80211: agg-tx: call drv_wake_tx_queue in proper
        context (bsc#1031717).
    
      - mac80211: do not compare TKIP TX MIC key in reinstall
        prevention (bsc#1066472).
    
      - mac80211: do not send SMPS action frame in AP mode when
        not needed (bsc#1031717).
    
      - mac80211: Fix addition of mesh configuration element
        (git-fixes).
    
      - mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).
    
      - mac80211: fix mgmt-tx abort cookie and leak
        (bsc#1031717).
    
      - mac80211: fix power saving clients handling in iwlwifi
        (bnc#1012382).
    
      - mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length
        (bnc#1012382).
    
      - mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
        (bsc#1031717).
    
      - mac80211: Remove invalid flag operations in mesh TSF
        synchronization (bnc#1012382).
    
      - mac80211: Remove unused 'beaconint_us' variable
        (bsc#1031717).
    
      - mac80211: Remove unused 'i' variable (bsc#1031717).
    
      - mac80211: Remove unused 'len' variable (bsc#1031717).
    
      - mac80211: Remove unused 'rates_idx' variable
        (bsc#1031717).
    
      - mac80211: Remove unused 'sband' and 'local' variables
        (bsc#1031717).
    
      - mac80211: Remove unused 'struct ieee80211_rx_status' ptr
        (bsc#1031717).
    
      - mac80211: Suppress NEW_PEER_CANDIDATE event if no room
        (bnc#1012382).
    
      - mac80211: TDLS: always downgrade invalid chandefs
        (bsc#1031717).
    
      - mac80211: TDLS: change BW calculation for WIDER_BW peers
        (bsc#1031717).
    
      - mac80211: use constant time comparison with keys
        (bsc#1066471).
    
      - md/linear: shutup lockdep warnning (bnc#1012382).
    
      - media: au0828: fix RC_CORE dependency (bsc#1031717).
    
      - media: Do not do DMA on stack for firmware upload in the
        AS102 driver (bnc#1012382).
    
      - media: em28xx: calculate left volume level correctly
        (bsc#1031717).
    
      - media: mceusb: fix memory leaks in error path
        (bsc#1031717).
    
      - media: rc: check for integer overflow (bnc#1012382).
    
      - media: v4l2-ctrl: Fix flags field on Control events
        (bnc#1012382).
    
      - megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to
        controllers which do not support it (bsc#1027301).
    
      - mei: return error on notification request to a
        disconnected client (bnc#1012382).
    
      - mfd: ab8500-sysctrl: Handle probe deferral
        (bnc#1012382).
    
      - mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being
        swapped (bnc#1012382).
    
      - mips: AR7: Defer registration of GPIO (bnc#1012382).
    
      - mips: AR7: Ensure that serial ports are properly set up
        (bnc#1012382).
    
      - mips: BCM47XX: Fix LED inversion for WRT54GSv1
        (bnc#1012382).
    
      - mips: End asm function prologue macros with .insn
        (bnc#1012382).
    
      - mips: Fix an n32 core file generation regset support
        regression (bnc#1012382).
    
      - mips: Fix CM region target definitions (bnc#1012382).
    
      - mips: Fix race on setting and getting cpu_online_mask
        (bnc#1012382).
    
      - mips: init: Ensure bootmem does not corrupt reserved
        memory (bnc#1012382).
    
      - mips: init: Ensure reserved memory regions are not added
        to bootmem (bnc#1012382).
    
      - mips: math-emu: Remove pr_err() calls from fpu_emu()
        (bnc#1012382).
    
      - mips: microMIPS: Fix incorrect mask in insn_table_MM
        (bnc#1012382).
    
      - mips: Netlogic: Exclude netlogic,xlp-pic code from XLR
        builds (bnc#1012382).
    
      - mips: ralink: Fix MT7628 pinmux (bnc#1012382).
    
      - mips: ralink: Fix typo in mt7628 pinmux function
        (bnc#1012382).
    
      - mips: SMP: Fix deadlock & online race (bnc#1012382).
    
      - mips: SMP: Use a completion event to signal CPU up
        (bnc#1012382).
    
      - misc: panel: properly restore atomic counter on error
        path (bnc#1012382).
    
      - mmc: block: return error on failed mmc_blk_get()
        (bsc#1031717).
    
      - mmc: core/mmci: restore pre/post_req behaviour
        (bsc#1031717).
    
      - mmc: dw_mmc: rockchip: Set the drive phase properly
        (bsc#1031717).
    
      - mm: check the return value of lookup_page_ext for all
        call sites (bnc#1068982).
    
      - mmc: host: omap_hsmmc: avoid possible overflow of
        timeout value (bsc#1031717).
    
      - mmc: host: omap_hsmmc: checking for NULL instead of
        IS_ERR() (bsc#1031717).
    
      - mmc: mediatek: Fixed size in dma_free_coherent
        (bsc#1031717).
    
      - mmc: s3cmci: include linux/interrupt.h for
        tasklet_struct (bnc#1012382).
    
      - mmc: sd: limit SD card power limit according to cards
        capabilities (bsc#1031717).
    
      - mm, hwpoison: fixup 'mm: check the return value of
        lookup_page_ext for all call sites' (bnc#1012382).
    
      - mm/madvise.c: fix madvise() infinite loop under special
        circumstances (bnc#1070964).
    
      - mm/page_alloc.c: broken deferred calculation
        (bnc#1068980).
    
      - mm, page_alloc: fix potential false positive in
        __zone_watermark_ok (Git-fixes, bsc#1068978).
    
      - mm/page_ext.c: check if page_ext is not prepared
        (bnc#1068982).
    
      - mm/page_owner: avoid NULL pointer dereference
        (bnc#1068982).
    
      - mm/pagewalk.c: report holes in hugetlb ranges
        (bnc#1012382).
    
      - net: 3com: typhoon: typhoon_init_one: fix incorrect
        return values (bnc#1012382).
    
      - net: 3com: typhoon: typhoon_init_one: make return values
        more specific (bnc#1012382).
    
      - net/9p: Switch to wait_event_killable() (bnc#1012382).
    
      - net: Allow IP_MULTICAST_IF to set index to L3 slave
        (bnc#1012382).
    
      - net: cdc_ether: fix divide by 0 on bad descriptors
        (bnc#1012382).
    
      - net: cdc_ncm: GetNtbFormat endian fix (git-fixes).
    
      - net: dsa: select NET_SWITCHDEV (bnc#1012382).
    
      - net: emac: Fix napi poll list corruption (bnc#1012382).
    
      - netfilter/ipvs: clear ipvs_property flag when SKB net
        namespace changed (bnc#1012382).
    
      - netfilter: nf_ct_expect: Change __nf_ct_expect_check()
        return value (bnc#1012382).
    
      - netfilter: nf_tables: fix oob access (bnc#1012382).
    
      - netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev
        family (bnc#1012382).
    
      - netfilter: nft_queue: use raw_smp_processor_id()
        (bnc#1012382).
    
      - net: ibm: ibmvnic: constify vio_device_id (fate#323285).
    
      - net/mlx4_core: Fix VF overwrite of module param which
        disables DMFS on new probed PFs (bnc#1012382).
    
      - net/mlx4_en: fix overflow in mlx4_en_init_timestamp()
        (bnc#1012382).
    
      - net: mvpp2: release reference to txq_cpu[] entry after
        unmapping (bnc#1012382).
    
      - net: qmi_wwan: fix divide by 0 on bad descriptors
        (bnc#1012382).
    
      - net/sctp: Always set scope_id in sctp_inet6_skb_msgname
        (bnc#1012382).
    
      - net: Set sk_prot_creator when cloning sockets to the
        right proto (bnc#1012382).
    
      - net/unix: do not show information about sockets from
        other namespaces (bnc#1012382).
    
      - nfc: fix device-allocation error return (bnc#1012382).
    
      - nfsd/callback: Cleanup callback cred on shutdown
        (bnc#1012382).
    
      - nfsd: deal with revoked delegations appropriately
        (bnc#1012382).
    
      - nfs: Do not disconnect open-owner on NFS4ERR_BAD_SEQID
        (bsc#989261).
    
      - nfs: Fix typo in nomigration mount option (bnc#1012382).
    
      - nfs: Fix ugly referral attributes (bnc#1012382).
    
      - nilfs2: fix race condition that causes file system
        corruption (bnc#1012382).
    
      - nl80211: Define policy for packet pattern attributes
        (bnc#1012382).
    
      - nvme: Fix memory order on async queue deletion
        (bnc#1012382).
    
      - ocfs2: fstrim: Fix start offset of first cluster group
        during fstrim (bnc#1012382).
    
      - ocfs2: should wait dio before inode lock in
        ocfs2_setattr() (bnc#1012382).
    
      - packet: avoid panic in packet_getsockopt()
        (bnc#1012382).
    
      - packet: only test po->has_vnet_hdr once in packet_snd
        (bnc#1012382).
    
      - parisc: Avoid trashing sr2 and sr3 in LWS code
        (bnc#1012382).
    
      - parisc: Fix double-word compare and exchange in LWS code
        on 32-bit kernels (bnc#1012382).
    
      - parisc: Fix validity check of pointer size argument in
        new CAS implementation (bnc#1012382).
    
      - pci: Apply _HPX settings only to relevant devices
        (bnc#1012382).
    
      - pci: mvebu: Handle changes to the bridge windows while
        enabled (bnc#1012382).
    
      - percpu: make this_cpu_generic_read() atomic w.r.t.
        interrupts (bnc#1012382).
    
      - perf tools: Fix build failure on perl script context
        (bnc#1012382).
    
      - perf tools: Only increase index if perf_evsel__new_idx()
        succeeds (bnc#1012382).
    
      - perf/x86/intel/bts: Fix exclusive event reference leak
        (git-fixes d2878d642a4ed).
    
      - phy: increase size of MII_BUS_ID_SIZE and bus_id
        (bnc#1012382).
    
      - pkcs#7: fix uninitialized boolean 'want' (bnc#1012382).
    
      - pkcs7: Prevent NULL pointer dereference, since sinfo is
        not always set (bnc#1012382).
    
      - platform/x86: acer-wmi: setup accelerometer when ACPI
        device was found (bsc#1031717).
    
      - platform/x86: hp-wmi: Do not shadow error values
        (bnc#1012382).
    
      - platform/x86: hp-wmi: Fix detection for dock and tablet
        mode (bnc#1012382).
    
      - platform/x86: hp-wmi: Fix error value for
        hp_wmi_tablet_state (bnc#1012382).
    
      - platform/x86: intel_mid_thermal: Fix module autoload
        (bnc#1012382).
    
      - platform/x86: sony-laptop: Fix error handling in
        sony_nc_setup_rfkill() (bsc#1031717).
    
      - pm / OPP: Add missing of_node_put(np) (bnc#1012382).
    
      - power: bq27xxx_battery: Fix bq27541 AveragePower
        register address (bsc#1031717).
    
      - power: bq27xxx: fix reading for bq27000 and bq27010
        (bsc#1031717).
    
      - powercap: Fix an error code in powercap_register_zone()
        (bsc#1031717).
    
      - power: ipaq-micro-battery: freeing the wrong variable
        (bsc#1031717).
    
      - powerpc/64: Fix race condition in setting lock bit in
        idle/wakeup code (bsc#1066223).
    
      - powerpc/bpf/jit: Disable classic BPF JIT on ppc64le
        (bsc#1066223).
    
      - powerpc/corenet: explicitly disable the SDHC controller
        on kmcoge4 (bnc#1012382).
    
      - powerpc: Correct instruction code for xxlor instruction
        (bsc#1066223).
    
      - powerpc: Fix VSX enabling/flushing to also test MSR_FP
        and MSR_VEC (bsc#1066223).
    
      - powerpc/mm: Fix check of multiple 16G pages from device
        tree (bsc#1066223).
    
      - powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
        (bsc#1066223).
    
      - powerpc/mm/hash64: Fix subpage protection with 4K HPTE
        config (bsc#1010201, bsc#1066223).
    
      - powerpc/mm/hash: Free the subpage_prot_table correctly
        (bsc#1066223).
    
      - powerpc/numa: Fix multiple bugs in memory_hotplug_max()
        (bsc#1066223).
    
      - powerpc/numa: Fix whitespace in
        hot_add_drconf_memory_max() (bsc#1066223).
    
      - powerpc/opal: Fix EBUSY bug in acquiring tokens
        (bsc#1066223).
    
      - powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8
        (bsc#1066223).
    
      - powerpc/powernv/ioda: Fix endianness when reading TCEs
        (bsc#1066223).
    
      - powerpc/powernv: Make opal_event_shutdown() callable
        from IRQ context (bsc#1066223).
    
      - powerpc/pseries/vio: Dispose of virq mapping on vdevice
        unregister (bsc#1067888).
    
      - powerpc/signal: Properly handle return value from
        uprobe_deny_signal() (bsc#1066223).
    
      - powerpc/sysrq: Fix oops whem ppmu is not registered
        (bsc#1066223).
    
      - power: supply: bq27xxx_battery: Fix register map for
        BQ27510 and BQ27520 ('bsc#1069270').
    
      - power: supply: isp1704: Fix unchecked return value of
        devm_kzalloc (bsc#1031717).
    
      - power: supply: lp8788: prevent out of bounds array
        access (bsc#1031717).
    
      - power_supply: tps65217-charger: Fix NULL deref during
        property export (bsc#1031717).
    
      - ppp: fix race in ppp device destruction (bnc#1012382).
    
      - printk/console: Always disable boot consoles that use
        init memory before it is freed (bsc#1063026).
    
      - printk/console: Enhance the check for consoles using
        init memory (bsc#1063026).
    
      - printk: include <asm/sections.h> instead of
        <asm-generic/sections.h> (bsc#1063026).
    
      - printk: only unregister boot consoles when necessary
        (bsc#1063026).
    
      - quota: Check for register_shrinker() failure
        (bsc#1012829).
    
      - r8169: Do not increment tx_dropped in TX ring cleaning
        (bsc#1031717).
    
      - rbd: use GFP_NOIO for parent stat and data requests
        (bnc#1012382).
    
      - rcu: Allow for page faults in NMI handlers
        (bnc#1012382).
    
      - rdma/uverbs: Prevent leak of reserved field (bsc#1022595
        FATE#322350).
    
      - rds: RDMA: return appropriate error on rdma map failures
        (bnc#1012382).
    
      - regulator: core: Limit propagation of parent voltage
        count and list (bsc#1070145).
    
      - regulator: fan53555: fix I2C device ids (bnc#1012382).
    
      - Revert 'bpf: one perf event close won't free bpf program
        attached by another perf event' (kabi).
    
      - Revert 'bsg-lib: do not free job in bsg_prepare_job'
        (bnc#1012382).
    
      - Revert 'crypto: xts - Add ECB dependency' (bnc#1012382).
    
      - Revert 'drm: bridge: add DT bindings for TI ths8135'
        (bnc#1012382).
    
      - Revert 'keys: Fix race between updating and finding a
        negative key' (kabi).
    
      - Revert 'phy: increase size of MII_BUS_ID_SIZE and
        bus_id' (kabi).
    
      - Revert 'sctp: do not peel off an assoc from one netns to
        another one' (bnc#1012382).
    
      - Revert 'tty: goldfish: Fix a parameter of a call to
        free_irq' (bnc#1012382).
    
      - Revert 'uapi: fix linux/rds.h userspace compilation
        errors' (bnc#1012382).
    
      - rpm/kernel-binary.spec.in: add the kernel-binary
        dependencies to kernel-binary-base (bsc#1060333).
    
      - rpm/kernel-binary.spec.in: Correct supplements for
        recent SLE products (bsc#1067494)
    
      - rpm/kernel-binary.spec.in: only rewrite modules.dep if
        non-zero in size (bsc#1056979).
    
      - rtc: ds1307: Fix relying on reset value for weekday
        (bsc#1031717).
    
      - rtc: ds1374: wdt: Fix issue with timeout scaling from
        secs to wdt ticks (bsc#1031717).
    
      - rtc: ds1374: wdt: Fix stop/start ioctl always returning
        -EINVAL (bsc#1031717).
    
      - rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).
    
      - rtc: sa1100: fix unbalanced
        clk_prepare_enable/clk_disable_unprepare (bsc#1031717).
    
      - rtlwifi: fix uninitialized rtlhal->last_suspend_sec time
        (bnc#1012382).
    
      - rtlwifi: rtl8192ee: Fix memory leak when loading
        firmware (bnc#1012382).
    
      - rtlwifi: rtl8821ae: Fix connection lost problem
        (bnc#1012382).
    
      - rtlwifi: rtl8821ae: Fix HW_VAR_NAV_UPPER operation
        (bsc#1031717).
    
      - s390/dasd: check for device error pointer within state
        change interrupts (bnc#1012382).
    
      - s390/disassembler: add missing end marker for e7 table
        (bnc#1012382).
    
      - s390/disassembler: correct disassembly lines alignment
        (bsc#1070825).
    
      - s390/disassembler: increase show_code buffer size
        (bnc#1012382).
    
      - s390: fix transactional execution control register
        handling (bnc#1012382).
    
      - s390/kbuild: enable modversions for symbols exported
        from asm (bnc#1012382).
    
      - s390/qeth: issue STARTLAN as first IPA command
        (bnc#1012382).
    
      - s390/runtime instrumention: fix possible memory
        corruption (bnc#1012382).
    
      - sched/autogroup: Fix autogroup_move_group() to never
        skip sched_move_task() (bnc#1012382).
    
      - sched: Make resched_cpu() unconditional (bnc#1012382).
    
      - sched/rt: Simplify the IPI based RT balancing logic
        (bnc#1012382).
    
      - scsi: aacraid: Process Error for response I/O
        (bnc#1012382).
    
      - scsi_devinfo: cleanly zero-pad devinfo strings
        (bsc#1062941).
    
      - scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).
    
      - scsi: ipr: Set no_report_opcodes for RAID arrays
        (bsc#1066213).
    
      - scsi: libiscsi: fix shifting of DID_REQUEUE host byte
        (bsc#1056003).
    
      - scsi: lpfc: Add missing memory barrier (bnc#1012382).
    
      - scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI
        ACC payload (bnc#1012382).
    
      - scsi: lpfc: Correct host name in symbolic_name field
        (bnc#1012382).
    
      - scsi: lpfc: Correct issue leading to oops during link
        reset (bnc#1012382).
    
      - scsi: lpfc: FCoE VPort enable-disable does not bring up
        the VPort (bnc#1012382).
    
      - scsi: reset wait for IO completion (bsc#996376).
    
      - scsi: scsi_devinfo: fixup string compare (bsc#1062941).
        updated
        patches.fixes/scsi_devinfo-fixup-string-compare.patch to
        the version merged upstream.
    
      - scsi: scsi_devinfo: handle non-terminated strings
        (bsc#1062941).
    
      - scsi: scsi_dh_emc: return success in
        clariion_std_inquiry() (bnc#1012382).
    
      - scsi: scsi_transport_fc: Also check for NOTPRESENT in
        fc_remote_port_add() (bsc#1037890).
    
      - scsi: scsi_transport_fc: set scsi_target_id upon rescan
        (bsc#1058135).
    
      - scsi: sg: Re-fix off by one in sg_fill_request_table()
        (bnc#1012382).
    
      - scsi: ufs: add capability to keep auto bkops always
        enabled (bnc#1012382).
    
      - scsi: ufs-qcom: Fix module autoload (bnc#1012382).
    
      - scsi: virtio_scsi: let host do exception handling
        (bsc#1060682).
    
      - scsi: zfcp: fix erp_action use-before-initialize in REC
        action trace (bnc#1012382).
    
      - sctp: add the missing sock_owned_by_user check in
        sctp_icmp_redirect (bnc#1012382).
    
      - sctp: do not peel off an assoc from one netns to another
        one (bnc#1012382).
    
      - sctp: potential read out of bounds in
        sctp_ulpevent_type_enabled() (bnc#1012382).
    
      - sctp: reset owner sk for data chunks on out queues when
        migrating a sock (bnc#1012382).
    
      - security/keys: add CONFIG_KEYS_COMPAT to Kconfig
        (bnc#1012382).
    
      - selftests: firmware: add empty string and async tests
        (bnc#1012382).
    
      - selftests: firmware: send expected errors to /dev/null
        (bnc#1012382).
    
      - serial: 8250_fintek: Fix rs485 disablement on invalid
        ioctl() (bsc#1031717).
    
      - serial: 8250_uniphier: fix serial port index in private
        data (bsc#1031717).
    
      - serial: Fix serial console on SNI RM400 machines
        (bsc#1031717).
    
      - serial: omap: Fix EFR write on RTS deassertion
        (bnc#1012382).
    
      - serial: Remove unused port type (bsc#1066045).
    
      - serial: sh-sci: Fix register offsets for the IRDA serial
        port (bnc#1012382).
    
      - slub: do not merge cache if slub_debug contains a
        never-merge flag (bnc#1012382).
    
      - smb3: parsing for new snapshot timestamp mount parm
        (FATE#324404). New mount option 'snapshot=<time>' to
        allow mounting an earlier version of the remote volume
        (if such a snapshot exists on the server). Note that
        eventually specifying a snapshot time of 1 will allow
        the user to mount the oldest snapshot. A subsequent
        patch add the processing for that and another for
        actually specifying the 'time warp' create context on
        SMB2/SMB3 open. Check to make sure SMB2 negotiated, and
        ensure that we use a different tcon if mount same share
        twice but with different snaphshot times
    
      - sparc64: Migrate hvcons irq to panicked cpu
        (bnc#1012382).
    
      - spi: SPI_FSL_DSPI should depend on HAS_DMA
        (bnc#1012382).
    
      - spi: uapi: spidev: add missing ioctl header
        (bnc#1012382).
    
      - staging: iio: cdc: fix improper return value
        (bnc#1012382).
    
      - staging: lustre: hsm: stack overrun in
        hai_dump_data_field (bnc#1012382).
    
      - staging: lustre: llite: do not invoke direct_IO for the
        EOF case (bnc#1012382).
    
      - staging: lustre: ptlrpc: skip lock if export failed
        (bnc#1012382).
    
      - staging: r8712u: Fix Sparse warning in rtl871x_xmit.c
        (bnc#1012382).
    
      - staging: rtl8188eu: fix incorrect ERROR tags from logs
        (bnc#1012382).
    
      - staging: rtl8712: fixed little endian problem
        (bnc#1012382).
    
      - staging: rtl8712u: Fix endian settings for structs
        describing network packets (bnc#1012382).
    
      - sunrpc: Fix tracepoint storage issues with svc_recv and
        svc_rqst_status (bnc#1012382).
    
      - target: fix ALUA state file path truncation
        (bsc#1071231).
    
      - target: Fix node_acl demo-mode + uncached dynamic
        shutdown regression (bnc#1012382).
    
      - target: fix PR state file path truncation (bsc#1071231).
    
      - target: Fix QUEUE_FULL + SCSI task attribute handling
        (bnc#1012382).
    
      - target/iscsi: Fix iSCSI task reassignment handling
        (bnc#1012382).
    
      - target/iscsi: Fix unsolicited data seq_end_offset
        calculation (bnc#1012382).
    
      - tcp/dccp: fix ireq->opt races (bnc#1012382).
    
      - tcp/dccp: fix lockdep splat in inet_csk_route_req()
        (bnc#1012382).
    
      - tcp/dccp: fix other lockdep splats accessing ireq_opt
        (bnc#1012382).
    
      - tcp: do not mangle skb->cb[] in tcp_make_synack()
        (bnc#1012382).
    
      - tcp: fix tcp_mtu_probe() vs highest_sack (bnc#1012382).
    
      - test: firmware_class: report errors properly on failure
        (bnc#1012382).
    
      - timer: Prevent timer value 0 for MWAITX (bsc#1065717).
    
      - tipc: fix link attribute propagation bug (bnc#1012382).
    
      - tipc: use only positive error codes in messages
        (bnc#1012382).
    
      - tools: firmware: check for distro fallback udev cancel
        rule (bnc#1012382).
    
      - tracing/samples: Fix creation and deletion of
        simple_thread_fn creation (bnc#1012382).
    
      - tun: allow positive return values on
        dev_get_valid_name() call (bnc#1012382).
    
      - tun: bail out from tun_get_user() if the skb is empty
        (bnc#1012382).
    
      - tun: call dev_get_valid_name() before
        register_netdevice() (bnc#1012382).
    
      - tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).
    
      - uapi: fix linux/mroute6.h userspace compilation errors
        (bnc#1012382).
    
      - uapi: fix linux/rds.h userspace compilation error
        (bnc#1012382).
    
      - uapi: fix linux/rds.h userspace compilation errors
        (bnc#1012382).
    
      - udpv6: Fix the checksum computation when HW checksum
        does not apply (bnc#1012382).
    
      - usb: Add delay-init quirk for Corsair K70 LUX keyboards
        (bnc#1012382).
    
      - usb: cdc_acm: Add quirk for Elatec TWN3 (bnc#1012382).
    
      - usb: core: fix out-of-bounds access bug in
        usb_get_bos_descriptor() (bnc#1012382).
    
      - usb: devio: Revert 'USB: devio: Do not corrupt user
        memory' (bnc#1012382).
    
      - usb: dummy-hcd: Fix deadlock caused by disconnect
        detection (bnc#1012382).
    
      - usb: gadget: composite: Fix use-after-free in
        usb_composite_overwrite_options (bnc#1012382).
    
      - usb: hcd: initialize hcd->flags to 0 when rm hcd
        (bnc#1012382).
    
      - usb: hub: Allow reset retry for USB2 devices on connect
        bounce (bnc#1012382).
    
      - usb: musb: Check for host-mode using is_host_active() on
        reset interrupt (bnc#1012382).
    
      - usb: musb: sunxi: Explicitly release USB PHY on exit
        (bnc#1012382).
    
      - usb: quirks: add quirk for WORLDE MINI MIDI keyboard
        (bnc#1012382).
    
      - usb: renesas_usbhs: Fix DMAC sequence for receiving
        zero-length packet (bnc#1012382).
    
      - usb: serial: console: fix use-after-free after failed
        setup (bnc#1012382).
    
      - usb: serial: cp210x: add support for ELV TFD500
        (bnc#1012382).
    
      - usb: serial: ftdi_sio: add id for Cypress WICED dev
        board (bnc#1012382).
    
      - usb: serial: garmin_gps: fix I/O after failed probe and
        remove (bnc#1012382).
    
      - usb: serial: garmin_gps: fix memory leak on probe errors
        (bnc#1012382).
    
      - usb: serial: metro-usb: add MS7820 device id
        (bnc#1012382).
    
      - usb: serial: option: add support for TP-Link LTE module
        (bnc#1012382).
    
      - usb: serial: qcserial: add Dell DW5818, DW5819
        (bnc#1012382).
    
      - usb: serial: qcserial: add pid/vid for Sierra Wireless
        EM7355 fw update (bnc#1012382).
    
      - usb: usbfs: compute urb->actual_length for isochronous
        (bnc#1012382).
    
      - usb: usbtest: fix NULL pointer dereference
        (bnc#1012382).
    
      - usb: xhci: Handle error condition in xhci_stop_device()
        (bnc#1012382).
    
      - vfs: expedite unmount (bsc#1024412).
    
      - video: fbdev: pmag-ba-fb: Remove bad `__init' annotation
        (bnc#1012382).
    
      - video: udlfb: Fix read EDID timeout (bsc#1031717).
    
      - vlan: fix a use-after-free in vlan_device_event()
        (bnc#1012382).
    
      - vsock: use new wait API for vsock_stream_sendmsg()
        (bnc#1012382).
    
      - vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
        (bnc#1012382).
    
      - watchdog: kempld: fix gcc-4.3 build (bnc#1012382).
    
      - workqueue: Fix NULL pointer dereference (bnc#1012382).
    
      - workqueue: replace pool->manager_arb mutex with a flag
        (bnc#1012382).
    
      - x86/alternatives: Fix alt_max_short macro to really be a
        max() (bnc#1012382).
    
      - x86/decoder: Add new TEST instruction pattern
        (bnc#1012382).
    
      - x86/MCE/AMD: Always give panic severity for UC errors in
        kernel context (git-fixes bf80bbd7dcf5).
    
      - x86/microcode/AMD: Add support for fam17h microcode
        loading (bsc#1068032).
    
      - x86/microcode/intel: Disable late loading on model 79
        (bnc#1012382).
    
      - x86/oprofile/ppro: Do not use __this_cpu*() in
        preemptible context (bnc#1012382).
    
      - x86/uaccess, sched/preempt: Verify access_ok() context
        (bnc#1012382).
    
      - xen: do not print error message in case of missing
        Xenstore entry (bnc#1012382).
    
      - xen/events: events_fifo: Do not use (get,put)_cpu() in
        xen_evtchn_fifo_init() (bnc#1065600).
    
      - xen: fix booting ballooned down hvm guest (bnc#1065600).
    
      - xen/gntdev: avoid out of bounds access in case of
        partial gntdev_mmap() (bnc#1012382).
    
      - xen/manage: correct return value check on xenbus_scanf()
        (bnc#1012382).
    
      - xen-netback: fix error handling output (bnc#1065600).
    
      - xen: x86: mark xen_find_pt_base as __init (bnc#1065600).
    
      - xen: xenbus driver must not accept invalid transaction
        ids (bnc#1012382).
    
      - zd1211rw: fix NULL-deref at probe (bsc#1031717)."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1010201"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1012382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1012829"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1017461"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1021424"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1022595"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1022914"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1024412"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1027301"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1030061"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1031717"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1037890"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1046107"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050060"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1050231"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1053919"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056003"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056365"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056427"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1056979"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1057199"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1058135"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1060333"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1060682"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1061756"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1062941"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1063026"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1063516"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1064701"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1064926"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065180"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065600"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065639"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065692"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065717"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1065866"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066045"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066192"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066213"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066223"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066285"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066382"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066470"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066471"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066472"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066573"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066606"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1066629"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1067105"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1067132"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1067494"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1067888"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068671"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068978"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068980"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1068982"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069270"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069496"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069702"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069793"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069942"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1069996"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070006"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070145"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070535"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070767"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070771"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070805"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070825"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1070964"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1071231"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1071693"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1071694"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1071695"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1071833"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=963575"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=964944"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966170"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=966172"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=974590"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=979928"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=989261"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=996376"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected the Linux Kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-debug-devel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-default-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-docs-html");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-docs-pdf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-macros");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-build");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-build-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-obs-qa");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-source-vanilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-syms");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-base-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:kernel-vanilla-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.2");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/07/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/12/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/18");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.2", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(x86_64)$") audit(AUDIT_ARCH_NOT, "x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-base-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-base-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-debugsource-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-devel-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-debug-devel-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-base-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-base-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-debugsource-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-default-devel-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-devel-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-docs-html-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-docs-pdf-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-macros-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-obs-build-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-obs-build-debugsource-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-obs-qa-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-source-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-source-vanilla-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-syms-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-base-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-base-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-debuginfo-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-debugsource-4.4.103-18.41.1") ) flag++;
    if ( rpm_check(release:"SUSE42.2", reference:"kernel-vanilla-devel-4.4.103-18.41.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-docs-html / kernel-docs-pdf / kernel-devel / kernel-macros / etc");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4073.NASL
    descriptionSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2017-8824 Mohamed Ghannam discovered that the DCCP implementation did not correctly manage resources when a socket is disconnected and reconnected, potentially leading to a use-after-free. A local user could use this for denial of service (crash or data corruption) or possibly for privilege escalation. On systems that do not already have the dccp module loaded, this can be mitigated by disabling it:echo >> /etc/modprobe.d/disable-dccp.conf install dccp false - CVE-2017-16538 Andrey Konovalov reported that the dvb-usb-lmedm04 media driver did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash). - CVE-2017-16644 Andrey Konovalov reported that the hdpvr media driver did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash). - CVE-2017-16995 Jann Horn discovered that the Extended BPF verifier did not correctly model the behaviour of 32-bit load instructions. A local user can use this for privilege escalation. - CVE-2017-17448 Kevin Cernekee discovered that the netfilter subsystem allowed users with the CAP_NET_ADMIN capability in any user namespace, not just the root namespace, to enable and disable connection tracking helpers. This could lead to denial of service, violation of network security policy, or have other impact. - CVE-2017-17449 Kevin Cernekee discovered that the netlink subsystem allowed users with the CAP_NET_ADMIN capability in any user namespace to monitor netlink traffic in all net namespaces, not just those owned by that user namespace. This could lead to exposure of sensitive information. - CVE-2017-17450 Kevin Cernekee discovered that the xt_osf module allowed users with the CAP_NET_ADMIN capability in any user namespace to modify the global OS fingerprint list. - CVE-2017-17558 Andrey Konovalov reported that that USB core did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash or memory corruption), or possibly for privilege escalation. - CVE-2017-17712 Mohamed Ghannam discovered a race condition in the IPv4 raw socket implementation. A local user could use this to obtain sensitive information from the kernel. - CVE-2017-17741 Dmitry Vyukov reported that the KVM implementation for x86 would over-read data from memory when emulating an MMIO write if the kvm_mmio tracepoint was enabled. A guest virtual machine might be able to use this to cause a denial of service (crash). - CVE-2017-17805 It was discovered that some implementations of the Salsa20 block cipher did not correctly handle zero-length input. A local user could use this to cause a denial of service (crash) or possibly have other security impact. - CVE-2017-17806 It was discovered that the HMAC implementation could be used with an underlying hash algorithm that requires a key, which was not intended. A local user could use this to cause a denial of service (crash or memory corruption), or possibly for privilege escalation. - CVE-2017-17807 Eric Biggers discovered that the KEYS subsystem lacked a check for write permission when adding keys to a process
    last seen2020-06-01
    modified2020-06-02
    plugin id105433
    published2017-12-26
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105433
    titleDebian DSA-4073-1 : linux - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-4073. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(105433);
      script_version("3.15");
      script_cvs_date("Date: 2019/08/23 10:01:45");
    
      script_cve_id("CVE-2017-1000407", "CVE-2017-1000410", "CVE-2017-16538", "CVE-2017-16644", "CVE-2017-16995", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17450", "CVE-2017-17558", "CVE-2017-17712", "CVE-2017-17741", "CVE-2017-17805", "CVE-2017-17806", "CVE-2017-17807", "CVE-2017-17862", "CVE-2017-17863", "CVE-2017-17864", "CVE-2017-8824");
      script_xref(name:"DSA", value:"4073");
    
      script_name(english:"Debian DSA-4073-1 : linux - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Several vulnerabilities have been discovered in the Linux kernel that
    may lead to a privilege escalation, denial of service or information
    leaks.
    
      - CVE-2017-8824
        Mohamed Ghannam discovered that the DCCP implementation
        did not correctly manage resources when a socket is
        disconnected and reconnected, potentially leading to a
        use-after-free. A local user could use this for denial
        of service (crash or data corruption) or possibly for
        privilege escalation. On systems that do not already
        have the dccp module loaded, this can be mitigated by
        disabling it:echo >> /etc/modprobe.d/disable-dccp.conf
        install dccp false
    
      - CVE-2017-16538
        Andrey Konovalov reported that the dvb-usb-lmedm04 media
        driver did not correctly handle some error conditions
        during initialisation. A physically present user with a
        specially designed USB device can use this to cause a
        denial of service (crash).
    
      - CVE-2017-16644
        Andrey Konovalov reported that the hdpvr media driver
        did not correctly handle some error conditions during
        initialisation. A physically present user with a
        specially designed USB device can use this to cause a
        denial of service (crash).
    
      - CVE-2017-16995
        Jann Horn discovered that the Extended BPF verifier did
        not correctly model the behaviour of 32-bit load
        instructions. A local user can use this for privilege
        escalation.
    
      - CVE-2017-17448
        Kevin Cernekee discovered that the netfilter subsystem
        allowed users with the CAP_NET_ADMIN capability in any
        user namespace, not just the root namespace, to enable
        and disable connection tracking helpers. This could lead
        to denial of service, violation of network security
        policy, or have other impact.
    
      - CVE-2017-17449
        Kevin Cernekee discovered that the netlink subsystem
        allowed users with the CAP_NET_ADMIN capability in any
        user namespace to monitor netlink traffic in all net
        namespaces, not just those owned by that user namespace.
        This could lead to exposure of sensitive information.
    
      - CVE-2017-17450
        Kevin Cernekee discovered that the xt_osf module allowed
        users with the CAP_NET_ADMIN capability in any user
        namespace to modify the global OS fingerprint list.
    
      - CVE-2017-17558
        Andrey Konovalov reported that that USB core did not
        correctly handle some error conditions during
        initialisation. A physically present user with a
        specially designed USB device can use this to cause a
        denial of service (crash or memory corruption), or
        possibly for privilege escalation.
    
      - CVE-2017-17712
        Mohamed Ghannam discovered a race condition in the IPv4
        raw socket implementation. A local user could use this
        to obtain sensitive information from the kernel.
    
      - CVE-2017-17741
        Dmitry Vyukov reported that the KVM implementation for
        x86 would over-read data from memory when emulating an
        MMIO write if the kvm_mmio tracepoint was enabled. A
        guest virtual machine might be able to use this to cause
        a denial of service (crash).
    
      - CVE-2017-17805
        It was discovered that some implementations of the
        Salsa20 block cipher did not correctly handle
        zero-length input. A local user could use this to cause
        a denial of service (crash) or possibly have other
        security impact.
    
      - CVE-2017-17806
        It was discovered that the HMAC implementation could be
        used with an underlying hash algorithm that requires a
        key, which was not intended. A local user could use this
        to cause a denial of service (crash or memory
        corruption), or possibly for privilege escalation.
    
      - CVE-2017-17807
        Eric Biggers discovered that the KEYS subsystem lacked a
        check for write permission when adding keys to a
        process's default keyring. A local user could use this
        to cause a denial of service or to obtain sensitive
        information.
    
      - CVE-2017-17862
        Alexei Starovoitov discovered that the Extended BPF
        verifier ignored unreachable code, even though it would
        still be processed by JIT compilers. This could possibly
        be used by local users for denial of service. It also
        increases the severity of bugs in determining
        unreachable code.
    
      - CVE-2017-17863
        Jann Horn discovered that the Extended BPF verifier did
        not correctly model pointer arithmetic on the stack
        frame pointer. A local user can use this for privilege
        escalation.
    
      - CVE-2017-17864
        Jann Horn discovered that the Extended BPF verifier
        could fail to detect pointer leaks from conditional
        code. A local user could use this to obtain sensitive
        information in order to exploit other vulnerabilities.
    
      - CVE-2017-1000407
        Andrew Honig reported that the KVM implementation for
        Intel processors allowed direct access to host I/O port
        0x80, which is not generally safe. On some systems this
        allows a guest VM to cause a denial of service (crash)
        of the host.
    
      - CVE-2017-1000410
        Ben Seri reported that the Bluetooth subsystem did not
        correctly handle short EFS information elements in L2CAP
        messages. An attacker able to communicate over Bluetooth
        could use this to obtain sensitive information from the
        kernel.
    
    The various problems in the Extended BPF verifier can be mitigated by
    disabling use of Extended BPF by unprivileged users:sysctl
    kernel.unprivileged_bpf_disabled=1
    
    Debian disables unprivileged user namespaces by default, but if they
    are enabled (via the kernel.unprivileged_userns_clone sysctl) then
    CVE-2017-17448 can be exploited by any local user."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-8824"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-16538"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-16644"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-16995"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17448"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17449"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17450"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17558"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17712"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17741"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17805"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17806"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17807"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17862"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17863"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17864"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-1000407"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-1000410"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/CVE-2017-17448"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security-tracker.debian.org/tracker/source-package/linux"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/linux"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2017/dsa-4073"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the linux packages.
    
    For the stable distribution (stretch), these problems have been fixed
    in version 4.9.65-3+deb9u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Linux BPF Sign Extension Local Privilege Escalation');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/04");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/12/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/26");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"9.0", prefix:"hyperv-daemons", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"libcpupower-dev", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"libcpupower1", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"libusbip-dev", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-arm", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-s390", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-x86", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-cpupower", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-doc-4.9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-4kc-malta", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-5kc-malta", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-686", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-686-pae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-amd64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-arm64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-armel", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-armhf", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-i386", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mips", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mips64el", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mipsel", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-ppc64el", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-s390x", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-amd64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-arm64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-armmp", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-armmp-lpae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-common", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-common-rt", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-loongson-3", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-marvell", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-octeon", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-powerpc64le", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-rt-686-pae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-rt-amd64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-s390x", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-4kc-malta", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-4kc-malta-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-5kc-malta", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-5kc-malta-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-pae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-pae-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-amd64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-amd64-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-arm64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-arm64-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-lpae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-lpae-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-loongson-3", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-loongson-3-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-marvell", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-marvell-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-octeon", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-octeon-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-powerpc64le", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-powerpc64le-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-686-pae", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-686-pae-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-amd64", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-amd64-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-s390x", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-s390x-dbg", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-kbuild-4.9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-libc-dev", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-manual-4.9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-perf-4.9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-source-4.9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"linux-support-4.9.0-9", reference:"4.9.65-3+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"usbip", reference:"4.9.65-3+deb9u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1319.NASL
    descriptionAn update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, x86 32-bit) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017) * kernel: Stack information leak in the EFS element (CVE-2017-1000410) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431591
    last seen2020-06-01
    modified2020-06-02
    plugin id109634
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109634
    titleRHEL 6 : kernel (RHSA-2018:1319) (Meltdown)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:1319. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109634);
      script_version("1.13");
      script_cvs_date("Date: 2019/10/24 15:35:44");
    
      script_cve_id("CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-18017", "CVE-2017-5754", "CVE-2017-7645", "CVE-2017-8824", "CVE-2018-8897");
      script_xref(name:"RHSA", value:"2018:1319");
    
      script_name(english:"RHEL 6 : kernel (RHSA-2018:1319) (Meltdown)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for kernel is now available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * hw: cpu: speculative execution permission faults handling
    (CVE-2017-5754, x86 32-bit)
    
    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)
    
    * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Google Project Zero for reporting
    CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski
    for reporting CVE-2018-8897; Mohamed Ghannam for reporting
    CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410.
    
    Bug Fix(es) :
    
    These updated kernel packages include also numerous bug fixes. Space
    precludes documenting all of these bug fixes in this advisory. See the
    bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/ articles/3431591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/vulnerabilities/pop_ss"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/articles/3431591"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-5754"
      );
      # https://access.redhat.com/security/vulnerabilities/speculativeexecution
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?892ef523"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2018:1319"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-7645"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-8824"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-13166"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-18017"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-1000410"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2018-8897"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-i686");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-s390x");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-x86_64");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-firmware");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/09");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 6.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-18017", "CVE-2017-5754", "CVE-2017-7645", "CVE-2017-8824", "CVE-2018-8897");
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2018:1319");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2018:1319";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"kernel-abi-whitelists-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-debug-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-debug-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-debug-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-debug-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-debug-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-debug-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-debug-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-debug-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-debug-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-debuginfo-common-i686-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-debuginfo-common-s390x-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"kernel-doc-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", reference:"kernel-firmware-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"kernel-headers-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-headers-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"kernel-headers-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-kdump-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-kdump-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"kernel-kdump-devel-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"python-perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"python-perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"python-perf-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"i686", reference:"python-perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"s390x", reference:"python-perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
      if (rpm_check(release:"RHEL6", cpu:"x86_64", reference:"python-perf-debuginfo-2.6.32-696.28.1.el6")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-abi-whitelists / kernel-debug / etc");
      }
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2018-1319.NASL
    descriptionAn update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, x86 32-bit) * Kernel: error in exception handling leads to DoS (CVE-2018-8897) * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017) * kernel: Stack information leak in the EFS element (CVE-2017-1000410) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Google Project Zero for reporting CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/ articles/3431591
    last seen2020-06-01
    modified2020-06-02
    plugin id109655
    published2018-05-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109655
    titleCentOS 6 : kernel (CESA-2018:1319) (Meltdown)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:1319 and 
    # CentOS Errata and Security Advisory 2018:1319 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109655);
      script_version("1.8");
      script_cvs_date("Date: 2019/12/31");
    
      script_cve_id("CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-18017", "CVE-2017-5754", "CVE-2017-7645", "CVE-2017-8824", "CVE-2018-8897");
      script_xref(name:"RHSA", value:"2018:1319");
    
      script_name(english:"CentOS 6 : kernel (CESA-2018:1319) (Meltdown)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for kernel is now available for Red Hat Enterprise Linux 6.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * hw: cpu: speculative execution permission faults handling
    (CVE-2017-5754, x86 32-bit)
    
    * Kernel: error in exception handling leads to DoS (CVE-2018-8897)
    
    * kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Google Project Zero for reporting
    CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski
    for reporting CVE-2018-8897; Mohamed Ghannam for reporting
    CVE-2017-8824; and Armis Labs for reporting CVE-2017-1000410.
    
    Bug Fix(es) :
    
    These updated kernel packages include also numerous bug fixes. Space
    precludes documenting all of these bug fixes in this advisory. See the
    bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/ articles/3431591"
      );
      # https://lists.centos.org/pipermail/centos-announce/2018-May/022827.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a9e9484b"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-18017");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-firmware");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:python-perf");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/04/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/05/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/10");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 6.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-6", reference:"kernel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-abi-whitelists-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-debug-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-debug-devel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-devel-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-doc-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-firmware-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"kernel-headers-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"perf-2.6.32-696.28.1.el6")) flag++;
    if (rpm_check(release:"CentOS-6", reference:"python-perf-2.6.32-696.28.1.el6")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-abi-whitelists / kernel-debug / kernel-debug-devel / etc");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-1062.NASL
    descriptionFrom Red Hat Security Advisory 2018:1062 : An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power) * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate) * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate) * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate) * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate) * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) * kernel: Kernel address information leak in drivers/acpi/ sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate) * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate) * kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low) Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat). For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id109113
    published2018-04-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109113
    titleOracle Linux 7 : kernel (ELSA-2018-1062)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2018:1062 and 
    # Oracle Linux Security Advisory ELSA-2018-1062 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109113);
      script_version("1.9");
      script_cvs_date("Date: 2019/09/27 13:00:38");
    
      script_cve_id("CVE-2016-3672", "CVE-2016-7913", "CVE-2016-8633", "CVE-2017-1000252", "CVE-2017-1000407", "CVE-2017-1000410", "CVE-2017-12154", "CVE-2017-12190", "CVE-2017-13166", "CVE-2017-13305", "CVE-2017-14140", "CVE-2017-15116", "CVE-2017-15121", "CVE-2017-15126", "CVE-2017-15127", "CVE-2017-15129", "CVE-2017-15265", "CVE-2017-15274", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17558", "CVE-2017-18017", "CVE-2017-18203", "CVE-2017-18270", "CVE-2017-7294", "CVE-2017-8824", "CVE-2017-9725", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-6927");
      script_xref(name:"RHSA", value:"2018:1062");
    
      script_name(english:"Oracle Linux 7 : kernel (ELSA-2018-1062)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2018:1062 :
    
    An update for kernel is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * hw: cpu: speculative execution permission faults handling
    (CVE-2017-5754, Important, KVM for Power)
    
    * kernel: Buffer overflow in firewire driver via crafted incoming
    packets (CVE-2016-8633, Important)
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824,
    Important)
    
    * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register
    (CVE-2017-12154, Important)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166, Important)
    
    * kernel: media: use-after-free in [tuner-xc2028] media driver
    (CVE-2016-7913, Moderate)
    
    * kernel: drm/vmwgfx: fix integer overflow in
    vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)
    
    * kernel: Incorrect type conversion for size during dma allocation
    (CVE-2017-9725, Moderate)
    
    * kernel: memory leak when merging buffers in SCSI IO vectors
    (CVE-2017-12190, Moderate)
    
    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client
    (CVE-2017-15121, Moderate)
    
    * kernel: Use-after-free in userfaultfd_event_wait_completion function
    in userfaultfd.c (CVE-2017-15126, Moderate)
    
    * kernel: net: double-free and memory corruption in get_net_ns_by_id()
    (CVE-2017-15129, Moderate)
    
    * kernel: Use-after-free in snd_seq_ioctl_create_port()
    (CVE-2017-15265, Moderate)
    
    * kernel: Missing capabilities check in
    net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to
    systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)
    
    * kernel: Missing namespace check in net/netlink/af_netlink.c allows
    for network monitors to observe systemwide activity (CVE-2017-17449,
    Moderate)
    
    * kernel: Unallocated memory access by malicious USB device via
    bNumInterfaces overflow (CVE-2017-17558, Moderate)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)
    
    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject()
    allows local users to cause a denial of service (CVE-2017-18203,
    Moderate)
    
    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ
    (CVE-2017-1000252, Moderate)
    
    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407,
    Moderate)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410,
    Moderate)
    
    * kernel: Kernel address information leak in drivers/acpi/
    sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass
    (CVE-2018-5750, Moderate)
    
    * kernel: Race condition in sound system can lead to denial of service
    (CVE-2018-1000004, Moderate)
    
    * kernel: multiple Low security impact security issues (CVE-2016-3672,
    CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low)
    
    Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633;
    Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for
    reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting
    CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea
    Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for
    reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting
    CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The
    CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and
    the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Additional Changes :
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 7.5 Release Notes linked from the References section."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2018-April/007619.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-tools-libs-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:python-perf");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 7", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2016-3672", "CVE-2016-7913", "CVE-2016-8633", "CVE-2017-1000252", "CVE-2017-1000407", "CVE-2017-1000410", "CVE-2017-12154", "CVE-2017-12190", "CVE-2017-13166", "CVE-2017-13305", "CVE-2017-14140", "CVE-2017-15116", "CVE-2017-15121", "CVE-2017-15126", "CVE-2017-15127", "CVE-2017-15129", "CVE-2017-15265", "CVE-2017-15274", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17558", "CVE-2017-18017", "CVE-2017-18203", "CVE-2017-18270", "CVE-2017-7294", "CVE-2017-8824", "CVE-2017-9725", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-6927");  
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for ELSA-2018-1062");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    kernel_major_minor = get_kb_item("Host/uname/major_minor");
    if (empty_or_null(kernel_major_minor)) exit(1, "Unable to determine kernel major-minor level.");
    expected_kernel_major_minor = "3.10";
    if (kernel_major_minor != expected_kernel_major_minor)
      audit(AUDIT_OS_NOT, "running kernel level " + expected_kernel_major_minor + ", it is running kernel level " + kernel_major_minor);
    
    flag = 0;
    if (rpm_exists(release:"EL7", rpm:"kernel-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-abi-whitelists-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-abi-whitelists-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-debug-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-debug-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-debug-devel-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-debug-devel-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-devel-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-devel-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-doc-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-doc-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-headers-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-headers-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-tools-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-tools-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-tools-libs-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-tools-libs-3.10.0-862.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-tools-libs-devel-3.10.0") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-tools-libs-devel-3.10.0-862.el7")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"perf-3.10.0-862.el7")) flag++;
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"python-perf-3.10.0-862.el7")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "affected kernel");
    }
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4164.NASL
    descriptionDescription of changes: kernel-uek kernel-uek [3.8.13-118.22.1.el7uek] - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao) {CVE-2017-18203} - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] {CVE-2018-8781} - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] {CVE-2018-10087} - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) {CVE-2018-10124} - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic) [Orabug: 28130293] {CVE-2015-8575} - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28220402] {CVE-2017-8824} {CVE-2018-1130} - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev) [Orabug: 28240075] {CVE-2018-5803} - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] {CVE-2017-7616} - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] {CVE-2017-11600} {CVE-2017-11600} - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id110998
    published2018-07-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110998
    titleOracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4164)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Oracle Linux Security Advisory ELSA-2018-4164.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(110998);
      script_version("1.8");
      script_cvs_date("Date: 2019/09/27 13:00:39");
    
      script_cve_id("CVE-2015-8575", "CVE-2016-2384", "CVE-2016-2543", "CVE-2016-2544", "CVE-2016-2545", "CVE-2016-2547", "CVE-2016-2548", "CVE-2016-2549", "CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-17741", "CVE-2017-18203", "CVE-2017-7616", "CVE-2017-8824", "CVE-2018-1000199", "CVE-2018-10087", "CVE-2018-10124", "CVE-2018-10323", "CVE-2018-1130", "CVE-2018-3665", "CVE-2018-5803", "CVE-2018-8781");
    
      script_name(english:"Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4164)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Description of changes:
    
    kernel-uek
    kernel-uek
    [3.8.13-118.22.1.el7uek]
    - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou 
    Tao)   {CVE-2017-18203}
    - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) 
      [Orabug: 27986407]  {CVE-2018-8781}
    - kernel/exit.c: avoid undefined behaviour when calling wait4() 
    wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined 
    behaviour in kernel/exit.c:1651:9 (mridula shastry)  [Orabug: 27875488] 
    {CVE-2018-10087}
    - kernel/signal.c: avoid undefined behaviour in kill_something_info When 
    running kill(72057458746458112, 0) in userspace I hit the following 
    issue. (mridula shastry)   {CVE-2018-10124}
    - bluetooth: Validate socket address length in sco_sock_bind(). 
    (mlevatic)  [Orabug: 28130293]  {CVE-2015-8575}
    - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) 
    [Orabug: 28220402]  {CVE-2017-8824} {CVE-2018-1130}
    - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey 
    Kodanev)  [Orabug: 28240075]  {CVE-2018-5803}
    - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris 
    Salls)  [Orabug: 28242478]  {CVE-2017-7616}
    - xfrm: policy: check policy direction value (Vladis Dronov)  [Orabug: 
    28264121]  {CVE-2017-11600} {CVE-2017-11600}
    - x86/fpu: Make eager FPU default (Mihai Carabas)  [Orabug: 28156176] 
    {CVE-2018-3665}
    - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 
    27951287]  {CVE-2017-17741} {CVE-2017-17741}
    - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric 
    Sandeen)  [Orabug: 27989498]  {CVE-2018-10323}
    - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) 
    [Orabug: 28030520]  {CVE-2017-1000410} {CVE-2017-1000410}
    - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 
    28058229]  {CVE-2016-2549}
    - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 
    28058229]  {CVE-2016-2547} {CVE-2016-2548}
    - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 
    28058229]  {CVE-2016-2545}
    - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi 
    Iwai)  [Orabug: 28058229]  {CVE-2016-2543}
    - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 
    28058229]  {CVE-2016-2544}
    - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) 
    [Orabug: 28058229]  {CVE-2016-2384}
    - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus 
    Torvalds)  [Orabug: 27947608]  {CVE-2018-1000199}
    - Revert 'perf/hwbp: Simplify the perf-hwbp code, fix documentation' 
    (Brian Maly)  [Orabug: 27947608]"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2018-July/007872.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2018-July/007873.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected unbreakable enterprise kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.22.1.el6uek");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:dtrace-modules-3.8.13-118.22.1.el7uek");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:kernel-uek-firmware");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/02/08");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/07/10");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/11");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(6|7)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6 / 7", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2015-8575", "CVE-2016-2384", "CVE-2016-2543", "CVE-2016-2544", "CVE-2016-2545", "CVE-2016-2547", "CVE-2016-2548", "CVE-2016-2549", "CVE-2017-1000410", "CVE-2017-11600", "CVE-2017-17741", "CVE-2017-18203", "CVE-2017-7616", "CVE-2017-8824", "CVE-2018-1000199", "CVE-2018-10087", "CVE-2018-10124", "CVE-2018-10323", "CVE-2018-1130", "CVE-2018-3665", "CVE-2018-5803", "CVE-2018-8781");  
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for ELSA-2018-4164");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    kernel_major_minor = get_kb_item("Host/uname/major_minor");
    if (empty_or_null(kernel_major_minor)) exit(1, "Unable to determine kernel major-minor level.");
    expected_kernel_major_minor = "3.8";
    if (kernel_major_minor != expected_kernel_major_minor)
      audit(AUDIT_OS_NOT, "running kernel level " + expected_kernel_major_minor + ", it is running kernel level " + kernel_major_minor);
    
    flag = 0;
    if (rpm_check(release:"EL6", cpu:"x86_64", reference:"dtrace-modules-3.8.13-118.22.1.el6uek-0.4.5-3.el6")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-3.8.13-118.22.1.el6uek")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-debug-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-debug-3.8.13-118.22.1.el6uek")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-debug-devel-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-debug-devel-3.8.13-118.22.1.el6uek")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-devel-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-devel-3.8.13-118.22.1.el6uek")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-doc-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-doc-3.8.13-118.22.1.el6uek")) flag++;
    if (rpm_exists(release:"EL6", rpm:"kernel-uek-firmware-3.8.13") && rpm_check(release:"EL6", cpu:"x86_64", reference:"kernel-uek-firmware-3.8.13-118.22.1.el6uek")) flag++;
    
    if (rpm_check(release:"EL7", cpu:"x86_64", reference:"dtrace-modules-3.8.13-118.22.1.el7uek-0.4.5-3.el7")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-3.8.13-118.22.1.el7uek")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-debug-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-debug-3.8.13-118.22.1.el7uek")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-debug-devel-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-debug-devel-3.8.13-118.22.1.el7uek")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-devel-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-devel-3.8.13-118.22.1.el7uek")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-doc-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-doc-3.8.13-118.22.1.el7uek")) flag++;
    if (rpm_exists(release:"EL7", rpm:"kernel-uek-firmware-3.8.13") && rpm_check(release:"EL7", cpu:"x86_64", reference:"kernel-uek-firmware-3.8.13-118.22.1.el7uek")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "affected kernel");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2018-1062.NASL
    descriptionAn update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power) * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate) * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate) * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate) * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate) * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) * kernel: Kernel address information leak in drivers/acpi/ sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate) * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate) * kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low) Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat). For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id109380
    published2018-04-27
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109380
    titleCentOS 7 : kernel (CESA-2018:1062)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:1062 and 
    # CentOS Errata and Security Advisory 2018:1062 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109380);
      script_version("1.8");
      script_cvs_date("Date: 2019/12/31");
    
      script_cve_id("CVE-2016-3672", "CVE-2016-7913", "CVE-2016-8633", "CVE-2017-1000252", "CVE-2017-1000407", "CVE-2017-1000410", "CVE-2017-12154", "CVE-2017-12190", "CVE-2017-13166", "CVE-2017-13305", "CVE-2017-14140", "CVE-2017-15116", "CVE-2017-15121", "CVE-2017-15126", "CVE-2017-15127", "CVE-2017-15129", "CVE-2017-15265", "CVE-2017-15274", "CVE-2017-17448", "CVE-2017-17449", "CVE-2017-17558", "CVE-2017-18017", "CVE-2017-18203", "CVE-2017-18270", "CVE-2017-7294", "CVE-2017-8824", "CVE-2017-9725", "CVE-2018-1000004", "CVE-2018-5750", "CVE-2018-6927");
      script_xref(name:"RHSA", value:"2018:1062");
    
      script_name(english:"CentOS 7 : kernel (CESA-2018:1062)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for kernel is now available for Red Hat Enterprise Linux 7.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * hw: cpu: speculative execution permission faults handling
    (CVE-2017-5754, Important, KVM for Power)
    
    * kernel: Buffer overflow in firewire driver via crafted incoming
    packets (CVE-2016-8633, Important)
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824,
    Important)
    
    * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register
    (CVE-2017-12154, Important)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166, Important)
    
    * kernel: media: use-after-free in [tuner-xc2028] media driver
    (CVE-2016-7913, Moderate)
    
    * kernel: drm/vmwgfx: fix integer overflow in
    vmw_surface_define_ioctl() (CVE-2017-7294, Moderate)
    
    * kernel: Incorrect type conversion for size during dma allocation
    (CVE-2017-9725, Moderate)
    
    * kernel: memory leak when merging buffers in SCSI IO vectors
    (CVE-2017-12190, Moderate)
    
    * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client
    (CVE-2017-15121, Moderate)
    
    * kernel: Use-after-free in userfaultfd_event_wait_completion function
    in userfaultfd.c (CVE-2017-15126, Moderate)
    
    * kernel: net: double-free and memory corruption in get_net_ns_by_id()
    (CVE-2017-15129, Moderate)
    
    * kernel: Use-after-free in snd_seq_ioctl_create_port()
    (CVE-2017-15265, Moderate)
    
    * kernel: Missing capabilities check in
    net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to
    systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate)
    
    * kernel: Missing namespace check in net/netlink/af_netlink.c allows
    for network monitors to observe systemwide activity (CVE-2017-17449,
    Moderate)
    
    * kernel: Unallocated memory access by malicious USB device via
    bNumInterfaces overflow (CVE-2017-17558, Moderate)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)
    
    * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject()
    allows local users to cause a denial of service (CVE-2017-18203,
    Moderate)
    
    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ
    (CVE-2017-1000252, Moderate)
    
    * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407,
    Moderate)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410,
    Moderate)
    
    * kernel: Kernel address information leak in drivers/acpi/
    sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass
    (CVE-2018-5750, Moderate)
    
    * kernel: Race condition in sound system can lead to denial of service
    (CVE-2018-1000004, Moderate)
    
    * kernel: multiple Low security impact security issues (CVE-2016-3672,
    CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low)
    
    Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633;
    Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for
    reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting
    CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea
    Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for
    reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting
    CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The
    CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and
    the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat).
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Additional Changes :
    
    For detailed information on changes in this release, see the Red Hat
    Enterprise Linux 7.5 Release Notes linked from the References section."
      );
      # https://lists.centos.org/pipermail/centos-cr-announce/2018-April/005226.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?14036024"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected kernel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-18017");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/04/27");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/27");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"kernel-abi-whitelists-3.10.0-862.el7")) flag++;
    if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"kernel-doc-3.10.0-862.el7")) flag++;
    
    
    if (flag)
    {
      cr_plugin_caveat = '\n' +
        'NOTE: The security advisory associated with this vulnerability has a\n' +
        'fixed package version that may only be available in the continuous\n' +
        'release (CR) repository for CentOS, until it is present in the next\n' +
        'point release of CentOS.\n\n' +
    
        'If an equal or higher package level does not exist in the baseline\n' +
        'repository for your major version of CentOS, then updates from the CR\n' +
        'repository will need to be applied in order to address the\n' +
        'vulnerability.\n';
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get() + cr_plugin_caveat
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel-abi-whitelists / kernel-doc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1130.NASL
    descriptionAn update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Mohamed Ghannam for reporting CVE-2017-8824; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. Bug Fix(es) : These updated kernel packages include also numerous bug fixes. Space precludes documenting all of these bug fixes in this advisory. See the bug fix descriptions in the related Knowledge Article: https://access.redhat.com/articles/3411331
    last seen2020-06-01
    modified2020-06-02
    plugin id109116
    published2018-04-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109116
    titleRHEL 7 : kernel (RHSA-2018:1130)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2018:1130. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(109116);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/24 15:35:44");
    
      script_cve_id("CVE-2017-1000252", "CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-15265", "CVE-2017-17449", "CVE-2017-18017", "CVE-2017-8824", "CVE-2017-9725");
      script_xref(name:"RHSA", value:"2018:1130");
    
      script_name(english:"RHEL 7 : kernel (RHSA-2018:1130)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "An update for kernel is now available for Red Hat Enterprise Linux 7.4
    Extended Update Support.
    
    Red Hat Product Security has rated this update as having a security
    impact of Important. A Common Vulnerability Scoring System (CVSS) base
    score, which gives a detailed severity rating, is available for each
    vulnerability from the CVE link(s) in the References section.
    
    The kernel packages contain the Linux kernel, the core of any Linux
    operating system.
    
    Security Fix(es) :
    
    * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824,
    Important)
    
    * kernel: v4l2: disabled memory access protection mechanism allowing
    privilege escalation (CVE-2017-13166, Important)
    
    * kernel: Incorrect type conversion for size during dma allocation
    (CVE-2017-9725, Moderate)
    
    * kernel: Use-after-free in snd_seq_ioctl_create_port()
    (CVE-2017-15265, Moderate)
    
    * kernel: Missing namespace check in net/netlink/af_netlink.c allows
    for network monitors to observe systemwide activity (CVE-2017-17449,
    Moderate)
    
    * kernel: netfilter: use-after-free in tcpmss_mangle_packet function
    in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate)
    
    * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ
    (CVE-2017-1000252, Moderate)
    
    * kernel: Stack information leak in the EFS element (CVE-2017-1000410,
    Moderate)
    
    For more details about the security issue(s), including the impact, a
    CVSS score, and other related information, refer to the CVE page(s)
    listed in the References section.
    
    Red Hat would like to thank Mohamed Ghannam for reporting
    CVE-2017-8824; Jan H. Schonherr (Amazon) for reporting
    CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410.
    
    Bug Fix(es) :
    
    These updated kernel packages include also numerous bug fixes. Space
    precludes documenting all of these bug fixes in this advisory. See the
    bug fix descriptions in the related Knowledge Article:
    https://access.redhat.com/articles/3411331"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/articles/3411331"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2018:1130"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-8824"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-9725"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-13166"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-15265"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-17449"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-18017"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-1000252"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2017-1000410"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-abi-whitelists");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debug-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-s390x");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-debuginfo-common-x86_64");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-doc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-headers");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-kdump-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-tools");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-tools-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:kernel-tools-libs-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:perf-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:python-perf-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7.4");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/09/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2018/04/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl", "linux_alt_patch_detect.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    include("ksplice.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7\.4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 7.4", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    if (get_one_kb_item("Host/ksplice/kernel-cves"))
    {
      rm_kb_item(name:"Host/uptrack-uname-r");
      cve_list = make_list("CVE-2017-1000252", "CVE-2017-1000410", "CVE-2017-13166", "CVE-2017-15265", "CVE-2017-17449", "CVE-2017-18017", "CVE-2017-8824", "CVE-2017-9725");
      if (ksplice_cves_check(cve_list))
      {
        audit(AUDIT_PATCH_INSTALLED, "KSplice hotfix for RHSA-2018:1130");
      }
      else
      {
        __rpm_report = ksplice_reporting_text();
      }
    }
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2018:1130";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", reference:"kernel-abi-whitelists-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-debug-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-debug-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-debug-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-debug-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-debug-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-debug-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-debuginfo-common-s390x-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-debuginfo-common-x86_64-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", reference:"kernel-doc-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-headers-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-headers-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-kdump-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-kdump-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"kernel-kdump-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-tools-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-tools-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-tools-libs-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"kernel-tools-libs-devel-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"perf-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"perf-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"perf-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"perf-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"python-perf-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"python-perf-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"s390x", reference:"python-perf-debuginfo-3.10.0-693.25.2.el7")) flag++;
      if (rpm_check(release:"RHEL7", sp:"4", cpu:"x86_64", reference:"python-perf-debuginfo-3.10.0-693.25.2.el7")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel / kernel-abi-whitelists / kernel-debug / etc");
      }
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-1391.NASL
    descriptionThe openSUSE Leap 42.3 kernel was updated to 4.4.103 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000405: A bug in the THP CoW support could be used by local attackers to corrupt memory of other processes and cause them to crash (bnc#1069496). - CVE-2017-1000410: The Linux kernel was affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. This info leak is a result of uninitialized stack variables that may be returned to an attacker in their uninitialized state. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The following non-security bugs were fixed : - acpi / apd: Add clock frequency for ThunderX2 I2C controller (bsc#1067225). - Add references (bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299) The scsi_devinfo patches are relevant for all bugs related to HITACHI OPEN-V. - adm80211: return an error if adm8211_alloc_rings() fails (bsc#1031717). - adv7604: Initialize drive strength to default when using DT (bnc#1012382). - af_netlink: ensure that NLMSG_DONE never fails in dumps (bnc#1012382). - alsa: caiaq: Fix stray URB at probe error path (bnc#1012382). - alsa: hda: Abort capability probe at invalid register read (bsc#1048356). - alsa: hda: Add Raven PCI ID (bnc#1012382). - alsa: hda - Apply ALC269_FIXUP_NO_SHUTUP on HDA_FIXUP_ACT_PROBE (bnc#1012382). - alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717). - alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382). - alsa: hda - No loopback on ALC299 codec (git-fixes). - alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717). - alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382). - alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382). - alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717). - alsa: hda: Remove superfluous
    last seen2020-06-05
    modified2017-12-19
    plugin id105364
    published2017-12-19
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105364
    titleopenSUSE Security Update : the Linux Kernel (openSUSE-2017-1391) (Dirty COW)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2018-0231.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id110581
    published2018-06-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110581
    titleOracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0231)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2018-0237.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dm_get_from_kobject and __dm_destroy (Hou Tao) (CVE-2017-18203) - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781) - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] (CVE-2018-10087) - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) (CVE-2018-10124) - bluetooth: Validate socket address length in sco_sock_bind. (mlevatic) [Orabug: 28130293] (CVE-2015-8575) - dccp: check sk for closed state in dccp_sendmsg (Alexey Kodanev) [Orabug: 28220402] (CVE-2017-8824) (CVE-2018-1130) - sctp: verify size of a new chunk in _sctp_make_chunk (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803) - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616) - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] (CVE-2017-11600) (CVE-2017-11600) - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id111022
    published2018-07-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111022
    titleOracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1498.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer overflow vulnerability was found in the ring_buffer_resize() calculations in which a privileged user can adjust the size of the ringbuffer message size. These calculations can create an issue where the kernel memory allocator will not allocate the correct count of pages yet expect them to be usable. This can lead to the ftrace() output to appear to corrupt kernel memory and possibly be used for privileged escalation or more likely kernel panic.(CVE-2016-9754) - A flaw was found in the Linux kernel
    last seen2020-06-12
    modified2019-05-13
    plugin id124821
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124821
    titleEulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1498)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20180410_KERNEL_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power) - kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important) - kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) - Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important) - kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) - kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate) - kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate) - kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) - kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate) - kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate) - kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate) - kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate) - kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) - kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate) - kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) - kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate) - kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) - kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate) - kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) - Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate) - kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) - kernel: Kernel address information leak in drivers/acpi/sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate) - kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate) - kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low) Additional Changes :
    last seen2020-03-18
    modified2018-05-01
    plugin id109449
    published2018-05-01
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109449
    titleScientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20180508_KERNEL_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - hw: cpu: speculative execution permission faults handling (CVE-2017-5754) - Kernel: error in exception handling leads to DoS (CVE-2018-8897) - kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645) - kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824) - kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166) - kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c (CVE-2017-18017) - kernel: Stack information leak in the EFS element (CVE-2017-1000410)
    last seen2020-03-18
    modified2018-05-09
    plugin id109643
    published2018-05-09
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109643
    titleScientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180508) (Meltdown)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1170.NASL
    descriptionAn update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Mohamed Ghannam for reporting CVE-2017-8824 and Armis Labs for reporting CVE-2017-1000410. Bug Fix(es) : * The kernel-rt packages have been upgraded to version 3.10.0-693.25.2.rt56.612, which provides a number of security and bug fixes over the previous version. (BZ#1549731) * Intel Core X-Series (Skylake) processors use a hard-coded Time Stamp Counter (TSC) frequency of 25 MHz. In some cases this can be imprecise and lead to timing-related problems such as time drift, timers being triggered early, or TSC clock instability. This update mitigates these problems by no longer using the
    last seen2020-06-01
    modified2020-06-02
    plugin id109335
    published2018-04-25
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109335
    titleRHEL 6 : MRG (RHSA-2018:1170)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1484.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In the Linux kernel, Hisilicon Network Subsystem (HNS) does not consider the ETH_SS_PRIV_FLAGS case when retrieving sset_count data. This allows local users to cause a denial of service (buffer overflow and memory corruption) or possibly have unspecified other impacts.(CVE-2017-18222i1/4%0 - A flaw was found in the way the Linux kernel
    last seen2020-03-19
    modified2019-05-13
    plugin id124808
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124808
    titleEulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1484)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-1062.NASL
    descriptionAn update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * hw: cpu: speculative execution permission faults handling (CVE-2017-5754, Important, KVM for Power) * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate) * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate) * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate) * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate) * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) * kernel: Kernel address information leak in drivers/acpi/ sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate) * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate) * kernel: multiple Low security impact security issues (CVE-2016-3672, CVE-2017-14140, CVE-2017-15116, CVE-2017-15127, CVE-2018-6927, Low) Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Google Project Zero for reporting CVE-2017-5754; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat). For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id108997
    published2018-04-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108997
    titleRHEL 7 : kernel (RHSA-2018:1062)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4114.NASL
    descriptionDescription of changes: [4.1.12-124.15.2.el7uek] - KVM: SVM: Move spec control call after restore of GS (Thomas Gleixner) {CVE-2018-3639} - x86/bugs: Fix the parameters alignment and missing void (Konrad Rzeszutek Wilk) {CVE-2018-3639} - x86/bugs: Make cpu_show_common() static (Jiri Kosina) {CVE-2018-3639} - x86/bugs: Fix __ssb_select_mitigation() return type (Jiri Kosina) {CVE-2018-3639} - Documentation/spec_ctrl: Do some minor cleanups (Borislav Petkov) {CVE-2018-3639} - proc: Use underscores for SSBD in
    last seen2020-06-01
    modified2020-06-02
    plugin id110071
    published2018-05-24
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110071
    titleOracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4114) (Spectre)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1319.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space.(CVE-2017-1000410) - The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.(CVE-2017-16650) - The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.(CVE-2017-16649) - The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.(CVE-2017-16645) - The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device.(CVE-2017-16644) - The parse_hid_report_descriptor function in drivers/input/tablet/gtco.c in the Linux kernel before 4.13.11 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.(CVE-2017-16643) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-12-07
    plugin id105047
    published2017-12-07
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105047
    titleEulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1319)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZA-2018-029.NASL
    descriptionAccording to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. NOTE: This update fixes the 32-bit compatibility layer on x86-64 processors, i.e. when 32-bit containers are executed on 64-bit processors. - A bug in the 32-bit compatibility layer of the ioctl handling code of the v4l2 video driver in the Linux kernel has been found. A memory protection mechanism ensuring that user-provided buffers always point to a userspace memory were disabled, allowing destination address to be in a kernel space. This flaw could be exploited by an attacker to overwrite a kernel memory from an unprivileged userspace process, leading to privilege escalation. - The KEYS subsystem in the Linux kernel omitted an access-control check when writing a key to the current task
    last seen2020-06-01
    modified2020-06-02
    plugin id109801
    published2018-05-15
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109801
    titleVirtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-029)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-3410-1.NASL
    descriptionThe SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.103 to receive various security and bugfixes. This update enables SMB encryption in the CIFS support in the Linux Kernel (fate#324404) The following security bugs were fixed : - CVE-2017-1000410: The Linux kernel was affected by an information leak in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535). - CVE-2017-11600: net/xfrm/xfrm_policy.c in the Linux kernel did not ensure that the dir value of xfrm_userpolicy_id is XFRM_POLICY_MAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRM_MSG_MIGRATE xfrm Netlink message (bnc#1050231). - CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192). - CVE-2017-15115: The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671). - CVE-2017-15265: Race condition in the ALSA subsystem in the Linux kernel allowed local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seq_clientmgr.c and sound/core/seq/seq_ports.c (bnc#1062520). - CVE-2017-16528: sound/core/seq_device.c in the Linux kernel allowed local users to cause a denial of service (snd_rawmidi_dev_seq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629). - CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606). - CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573). - CVE-2017-16645: The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132). - CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105). - CVE-2017-16994: The walk_hugetlb_range function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996). - CVE-2017-17448: net/netfilter/nfnetlink_cthelper.c in the Linux kernel did not require the CAP_NET_ADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces (bnc#1071693). - CVE-2017-17449: The __netlink_deliver_tap_skb function in net/netlink/af_netlink.c in the Linux kernel through 4.14.4, when CONFIG_NLMON is enabled, did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAP_NET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694). - CVE-2017-17450: net/netfilter/xt_osf.c in the Linux kernel did not require the CAP_NET_ADMIN capability for add_callback and remove_callback operations, which allowed local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces (bnc#1071695). - CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107). - CVE-2017-8824: The dccp_disconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AF_UNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id105461
    published2017-12-26
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105461
    titleSUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2017:3410-1)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2018-0223.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - KVM: SVM: Move spec control call after restore of GS (Thomas Gleixner) (CVE-2018-3639) - x86/bugs: Fix the parameters alignment and missing void (Konrad Rzeszutek Wilk) (CVE-2018-3639) - x86/bugs: Make cpu_show_common static (Jiri Kosina) (CVE-2018-3639) - x86/bugs: Fix __ssb_select_mitigation return type (Jiri Kosina) (CVE-2018-3639) - Documentation/spec_ctrl: Do some minor cleanups (Borislav Petkov) (CVE-2018-3639) - proc: Use underscores for SSBD in
    last seen2020-06-01
    modified2020-06-02
    plugin id110072
    published2018-05-24
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110072
    titleOracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0223) (Spectre)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-4134.NASL
    descriptionDescription of changes: kernel-uek [3.8.13-118.21.4.el7uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} [3.8.13-118.21.3.el7uek] - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} [3.8.13-118.21.2.el7uek] - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id110583
    published2018-06-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/110583
    titleOracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4134)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1318.NASL
    descriptionAccording to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space.(CVE-2017-1000410) - The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations.(CVE-2017-12193) - The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition.(CVE-2017-12190) - The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.(CVE-2017-15102) - The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peel-off action, which allows local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls.(CVE-2017-15115) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-12-07
    plugin id105046
    published2017-12-07
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105046
    titleEulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1318)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4082.NASL
    descriptionSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. - CVE-2017-5754 Multiple researchers have discovered a vulnerability in Intel processors, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Meltdown and is addressed in the Linux kernel for the Intel x86-64 architecture by a patch set named Kernel Page Table Isolation, enforcing a near complete separation of the kernel and userspace address maps and preventing the attack. This solution might have a performance impact, and can be disabled at boot time by passing pti=off to the kernel command line. - CVE-2017-8824 Mohamed Ghannam discovered that the DCCP implementation did not correctly manage resources when a socket is disconnected and reconnected, potentially leading to a use-after-free. A local user could use this for denial of service (crash or data corruption) or possibly for privilege escalation. On systems that do not already have the dccp module loaded, this can be mitigated by disabling it:echo >> /etc/modprobe.d/disable-dccp.conf install dccp false - CVE-2017-15868 Al Viro found that the Bluebooth Network Encapsulation Protocol (BNEP) implementation did not validate the type of the second socket passed to the BNEPCONNADD ioctl(), which could lead to memory corruption. A local user with the CAP_NET_ADMIN capability can use this for denial of service (crash or data corruption) or possibly for privilege escalation. - CVE-2017-16538 Andrey Konovalov reported that the dvb-usb-lmedm04 media driver did not correctly handle some error conditions during initialisation. A physically present user with a specially designed USB device can use this to cause a denial of service (crash). - CVE-2017-16939 Mohamed Ghannam reported (through Beyond Security
    last seen2020-06-01
    modified2020-06-02
    plugin id105704
    published2018-01-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105704
    titleDebian DSA-4082-1 : linux - security update (Meltdown)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-0654.NASL
    descriptionAn update for kernel-alt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-alt packages provide the Linux kernel version 4.x. The following packages have been upgraded to a later upstream version: kernel-alt (4.14.0). (BZ#1492717) Security Fix(es) : * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5715 triggers the speculative execution by utilizing branch target injection. It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory accesses may cause allocation into the microprocessor
    last seen2020-06-01
    modified2020-06-02
    plugin id108942
    published2018-04-10
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108942
    titleRHEL 7 : kernel-alt (RHSA-2018:0654)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-0676.NASL
    descriptionAn update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * kernel: Buffer overflow in firewire driver via crafted incoming packets (CVE-2016-8633, Important) * kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824, Important) * Kernel: kvm: nVMX: L2 guest could access hardware(L0) CR8 register (CVE-2017-12154, Important) * kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation (CVE-2017-13166, Important) * kernel: media: use-after-free in [tuner-xc2028] media driver (CVE-2016-7913, Moderate) * kernel: drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() (CVE-2017-7294, Moderate) * kernel: Incorrect type conversion for size during dma allocation (CVE-2017-9725, Moderate) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190, Moderate) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121, Moderate) * kernel: Use-after-free in userfaultfd_event_wait_completion function in userfaultfd.c (CVE-2017-15126, Moderate) * kernel: net: double-free and memory corruption in get_net_ns_by_id() (CVE-2017-15129, Moderate) * kernel: Use-after-free in snd_seq_ioctl_create_port() (CVE-2017-15265, Moderate) * kernel: Incorrect handling in arch/x86/include/asm/ mmu_context.h:init_new_context function allowing use-after-free (CVE-2017-17053, Moderate) * kernel: Missing capabilities check in net/netfilter/nfnetlink_cthelper.c allows for unprivileged access to systemwide nfnl_cthelper_list structure (CVE-2017-17448, Moderate) * kernel: Missing namespace check in net/netlink/af_netlink.c allows for network monitors to observe systemwide activity (CVE-2017-17449, Moderate) * kernel: Unallocated memory access by malicious USB device via bNumInterfaces overflow (CVE-2017-17558, Moderate) * kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/ netfilter/xt_TCPMSS.c (CVE-2017-18017, Moderate) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203, Moderate) * kernel: kvm: Reachable BUG() on out-of-bounds guest IRQ (CVE-2017-1000252, Moderate) * Kernel: KVM: DoS via write flood to I/O port 0x80 (CVE-2017-1000407, Moderate) * kernel: Stack information leak in the EFS element (CVE-2017-1000410, Moderate) * kernel: Kernel address information leak in drivers/acpi/ sbshc.c:acpi_smbus_hc_add() function potentially allowing KASLR bypass (CVE-2018-5750, Moderate) * kernel: Race condition in sound system can lead to denial of service (CVE-2018-1000004, Moderate) * kernel: unlimiting the stack disables ASLR (CVE-2016-3672, Low) * kernel: Missing permission check in move_pages system call (CVE-2017-14140, Low) * kernel: NULL pointer dereference in rngapi_reset function (CVE-2017-15116, Low) * kernel: Improper error handling of VM_SHARED hugetlbfs mapping in mm/ hugetlb.c (CVE-2017-15127, Low) * kernel: Integer overflow in futex.c:futux_requeue can lead to denial of service or unspecified impact (CVE-2018-6927, Low) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Eyal Itkin for reporting CVE-2016-8633; Mohamed Ghannam for reporting CVE-2017-8824; Jim Mattson (Google.com) for reporting CVE-2017-12154; Vitaly Mayatskih for reporting CVE-2017-12190; Andrea Arcangeli (Engineering) for reporting CVE-2017-15126; Kirill Tkhai for reporting CVE-2017-15129; Jan H. Schonherr (Amazon) for reporting CVE-2017-1000252; and Armis Labs for reporting CVE-2017-1000410. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat) and the CVE-2017-15116 issue was discovered by ChunYu Wang (Red Hat). Additional Changes : See the Red Hat Enterprise Linux 7.5 Release Notes linked from References.
    last seen2020-06-01
    modified2020-06-02
    plugin id108984
    published2018-04-11
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108984
    titleRHEL 7 : kernel-rt (RHSA-2018:0676)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3933-1.NASL
    descriptionIt was discovered that an information leak vulnerability existed in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could possibly expose sensitive information (kernel memory). (CVE-2017-1000410) It was discovered that the USB serial device driver in the Linux kernel did not properly validate baud rate settings when debugging is enabled. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18360) Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824) Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). (CVE-2019-3459, CVE-2019-3460) Jann Horn discovered that the KVM implementation in the Linux kernel contained a use-after-free vulnerability. An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974) Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222) Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id123682
    published2019-04-03
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123682
    titleUbuntu 14.04 LTS : linux vulnerabilities (USN-3933-1)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0074_KERNEL-RT.NASL
    descriptionThe remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - Integer overflow in the aio_setup_single_vector function in fs/aio.c in the Linux kernel 4.0 allows local users to cause a denial of service or possibly have unspecified other impact via a large AIO iovec. NOTE: this vulnerability exists because of a CVE-2012-6701 regression. (CVE-2015-8830) - A weakness was found in the Linux ASLR implementation. Any user able to running 32-bit applications in a x86 machine can disable ASLR by setting the RLIMIT_STACK resource to unlimited. (CVE-2016-3672) - The xc2028_set_config function in drivers/media/tuners/tuner-xc2028.c in the Linux kernel before 4.6 allows local users to gain privileges or cause a denial of service (use-after-free) via vectors involving omission of the firmware name from a certain data structure. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2016-7913) - Use-after-free vulnerability in the snd_pcm_info() function in the ALSA subsystem in the Linux kernel allows attackers to induce a kernel memory corruption and possibly crash or lock up a system. Due to the nature of the flaw, a privilege escalation cannot be fully ruled out, although we believe it is unlikely. (CVE-2017-0861) - A reachable assertion failure flaw was found in the Linux kernel built with KVM virtualisation(CONFIG_KVM) support with Virtual Function I/O feature (CONFIG_VFIO) enabled. This failure could occur if a malicious guest device sent a virtual interrupt (guest IRQ) with a larger (>1024) index value. (CVE-2017-1000252) - Linux kernel Virtualization Module (CONFIG_KVM) for the Intel processor family (CONFIG_KVM_INTEL) is vulnerable to a DoS issue. It could occur if a guest was to flood the I/O port 0x80 with write requests. A guest user could use this flaw to crash the host kernel resulting in DoS. (CVE-2017-1000407) - A flaw was found in the processing of incoming L2CAP bluetooth commands. Uninitialized stack variables can be sent to an attacker leaking data in kernel address space. (CVE-2017-1000410) - A race condition was found in the Linux kernel before version 4.11-rc1 in
    last seen2020-06-01
    modified2020-06-02
    plugin id127281
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127281
    titleNewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0074)

Redhat

advisories
  • rhsa
    idRHSA-2018:0654
  • rhsa
    idRHSA-2018:0676
  • rhsa
    idRHSA-2018:1062
  • rhsa
    idRHSA-2018:1130
  • rhsa
    idRHSA-2018:1170
  • rhsa
    idRHSA-2018:1319
rpms
  • kernel-0:4.14.0-49.el7a
  • kernel-abi-whitelists-0:4.14.0-49.el7a
  • kernel-bootwrapper-0:4.14.0-49.el7a
  • kernel-debug-0:4.14.0-49.el7a
  • kernel-debug-debuginfo-0:4.14.0-49.el7a
  • kernel-debug-devel-0:4.14.0-49.el7a
  • kernel-debuginfo-0:4.14.0-49.el7a
  • kernel-debuginfo-common-aarch64-0:4.14.0-49.el7a
  • kernel-debuginfo-common-ppc64le-0:4.14.0-49.el7a
  • kernel-debuginfo-common-s390x-0:4.14.0-49.el7a
  • kernel-debuginfo-common-x86_64-0:4.14.0-49.el7a
  • kernel-devel-0:4.14.0-49.el7a
  • kernel-doc-0:4.14.0-49.el7a
  • kernel-headers-0:4.14.0-49.el7a
  • kernel-kdump-0:4.14.0-49.el7a
  • kernel-kdump-debuginfo-0:4.14.0-49.el7a
  • kernel-kdump-devel-0:4.14.0-49.el7a
  • kernel-tools-0:4.14.0-49.el7a
  • kernel-tools-debuginfo-0:4.14.0-49.el7a
  • kernel-tools-libs-0:4.14.0-49.el7a
  • kernel-tools-libs-devel-0:4.14.0-49.el7a
  • perf-0:4.14.0-49.el7a
  • perf-debuginfo-0:4.14.0-49.el7a
  • python-perf-0:4.14.0-49.el7a
  • python-perf-debuginfo-0:4.14.0-49.el7a
  • kernel-rt-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debug-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debug-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debug-devel-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debug-kvm-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debug-kvm-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-rt-debuginfo-common-x86_64-0:3.10.0-862.rt56.804.el7
  • kernel-rt-devel-0:3.10.0-862.rt56.804.el7
  • kernel-rt-doc-0:3.10.0-862.rt56.804.el7
  • kernel-rt-kvm-0:3.10.0-862.rt56.804.el7
  • kernel-rt-kvm-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-rt-trace-0:3.10.0-862.rt56.804.el7
  • kernel-rt-trace-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-rt-trace-devel-0:3.10.0-862.rt56.804.el7
  • kernel-rt-trace-kvm-0:3.10.0-862.rt56.804.el7
  • kernel-rt-trace-kvm-debuginfo-0:3.10.0-862.rt56.804.el7
  • kernel-0:3.10.0-862.el7
  • kernel-abi-whitelists-0:3.10.0-862.el7
  • kernel-bootwrapper-0:3.10.0-862.el7
  • kernel-debug-0:3.10.0-862.el7
  • kernel-debug-debuginfo-0:3.10.0-862.el7
  • kernel-debug-devel-0:3.10.0-862.el7
  • kernel-debuginfo-0:3.10.0-862.el7
  • kernel-debuginfo-common-ppc64-0:3.10.0-862.el7
  • kernel-debuginfo-common-ppc64le-0:3.10.0-862.el7
  • kernel-debuginfo-common-s390x-0:3.10.0-862.el7
  • kernel-debuginfo-common-x86_64-0:3.10.0-862.el7
  • kernel-devel-0:3.10.0-862.el7
  • kernel-doc-0:3.10.0-862.el7
  • kernel-headers-0:3.10.0-862.el7
  • kernel-kdump-0:3.10.0-862.el7
  • kernel-kdump-debuginfo-0:3.10.0-862.el7
  • kernel-kdump-devel-0:3.10.0-862.el7
  • kernel-tools-0:3.10.0-862.el7
  • kernel-tools-debuginfo-0:3.10.0-862.el7
  • kernel-tools-libs-0:3.10.0-862.el7
  • kernel-tools-libs-devel-0:3.10.0-862.el7
  • perf-0:3.10.0-862.el7
  • perf-debuginfo-0:3.10.0-862.el7
  • python-perf-0:3.10.0-862.el7
  • python-perf-debuginfo-0:3.10.0-862.el7
  • kernel-0:3.10.0-693.25.2.el7
  • kernel-abi-whitelists-0:3.10.0-693.25.2.el7
  • kernel-bootwrapper-0:3.10.0-693.25.2.el7
  • kernel-debug-0:3.10.0-693.25.2.el7
  • kernel-debug-debuginfo-0:3.10.0-693.25.2.el7
  • kernel-debug-devel-0:3.10.0-693.25.2.el7
  • kernel-debuginfo-0:3.10.0-693.25.2.el7
  • kernel-debuginfo-common-ppc64-0:3.10.0-693.25.2.el7
  • kernel-debuginfo-common-ppc64le-0:3.10.0-693.25.2.el7
  • kernel-debuginfo-common-s390x-0:3.10.0-693.25.2.el7
  • kernel-debuginfo-common-x86_64-0:3.10.0-693.25.2.el7
  • kernel-devel-0:3.10.0-693.25.2.el7
  • kernel-doc-0:3.10.0-693.25.2.el7
  • kernel-headers-0:3.10.0-693.25.2.el7
  • kernel-kdump-0:3.10.0-693.25.2.el7
  • kernel-kdump-debuginfo-0:3.10.0-693.25.2.el7
  • kernel-kdump-devel-0:3.10.0-693.25.2.el7
  • kernel-tools-0:3.10.0-693.25.2.el7
  • kernel-tools-debuginfo-0:3.10.0-693.25.2.el7
  • kernel-tools-libs-0:3.10.0-693.25.2.el7
  • kernel-tools-libs-devel-0:3.10.0-693.25.2.el7
  • perf-0:3.10.0-693.25.2.el7
  • perf-debuginfo-0:3.10.0-693.25.2.el7
  • python-perf-0:3.10.0-693.25.2.el7
  • python-perf-debuginfo-0:3.10.0-693.25.2.el7
  • kernel-rt-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-debug-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-debug-debuginfo-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-debug-devel-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-debuginfo-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-debuginfo-common-x86_64-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-devel-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-doc-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-firmware-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-trace-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-trace-debuginfo-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-trace-devel-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-vanilla-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-vanilla-debuginfo-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-rt-vanilla-devel-1:3.10.0-693.25.2.rt56.612.el6rt
  • kernel-0:2.6.32-696.28.1.el6
  • kernel-abi-whitelists-0:2.6.32-696.28.1.el6
  • kernel-bootwrapper-0:2.6.32-696.28.1.el6
  • kernel-debug-0:2.6.32-696.28.1.el6
  • kernel-debug-debuginfo-0:2.6.32-696.28.1.el6
  • kernel-debug-devel-0:2.6.32-696.28.1.el6
  • kernel-debuginfo-0:2.6.32-696.28.1.el6
  • kernel-debuginfo-common-i686-0:2.6.32-696.28.1.el6
  • kernel-debuginfo-common-ppc64-0:2.6.32-696.28.1.el6
  • kernel-debuginfo-common-s390x-0:2.6.32-696.28.1.el6
  • kernel-debuginfo-common-x86_64-0:2.6.32-696.28.1.el6
  • kernel-devel-0:2.6.32-696.28.1.el6
  • kernel-doc-0:2.6.32-696.28.1.el6
  • kernel-firmware-0:2.6.32-696.28.1.el6
  • kernel-headers-0:2.6.32-696.28.1.el6
  • kernel-kdump-0:2.6.32-696.28.1.el6
  • kernel-kdump-debuginfo-0:2.6.32-696.28.1.el6
  • kernel-kdump-devel-0:2.6.32-696.28.1.el6
  • perf-0:2.6.32-696.28.1.el6
  • perf-debuginfo-0:2.6.32-696.28.1.el6
  • python-perf-0:2.6.32-696.28.1.el6
  • python-perf-debuginfo-0:2.6.32-696.28.1.el6