Vulnerabilities > CVE-2017-18218 - Use After Free vulnerability in Linux Kernel

#
# (C) Tenable Network Security, Inc.`
#

# The descriptive text and package checks in this plugin were
# extracted from VMware Security Advisory PHSA-2018-2.0-0037-(a). The text
# itself is copyright (C) VMware, Inc.

include("compat.inc");

if (description)
{
  script_id(121933);
  script_version("1.5");
  script_cvs_date("Date: 2019/04/04 11:19:02");

  script_cve_id("CVE-2017-18218", "CVE-2018-8822", "CVE-2018-8897");

  script_name(english:"Photon OS 2.0: Linux PHSA-2018-2.0-0037-(a)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote PhotonOS host is missing multiple security updates.");
  script_set_attribute(attribute:"description", value:
"An update of the linux package has been released.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-2-37-a.md");
  script_set_attribute(attribute:"solution", value:
"Update the affected Linux packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-8822");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");


  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:linux");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:2.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"PhotonOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/PhotonOS/release");
if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
if (release !~ "^VMware Photon (?:Linux|OS) 2\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 2.0");

if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);

flag = 0;

if (rpm_check(release:"PhotonOS-2.0", reference:"linux-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-api-headers-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-debuginfo-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-devel-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-docs-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-drivers-gpu-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-oprofile-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-sound-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-aws-tools-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-debuginfo-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-devel-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-docs-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-drivers-gpu-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-esx-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-esx-debuginfo-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-esx-devel-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-esx-docs-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-oprofile-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-secure-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-secure-debuginfo-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-secure-devel-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-secure-docs-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-secure-lkcm-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-sound-4.9.94-1.ph2")) flag++;
if (rpm_check(release:"PhotonOS-2.0", reference:"linux-tools-4.9.94-1.ph2")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "linux");
}

#
# (C) Tenable Network Security, Inc.
#
# @DEPRECATED@
#
# Disabled on 2/7/2019
#

# The descriptive text and package checks in this plugin were
# extracted from VMware Security Advisory PHSA-2018-2.0-0037-(a). The text
# itself is copyright (C) VMware, Inc.

include("compat.inc");

if (description)
{
  script_id(111296);
  script_version("1.5");
  script_cvs_date("Date: 2019/04/05 23:25:07");

  script_cve_id("CVE-2017-18218", "CVE-2018-8822", "CVE-2018-8897");
  script_bugtraq_id(103277, 103476, 104071);

  script_name(english:"Photon OS 2.0 : linux-aws / linux-esx / linux-secure / linux (PhotonOS-PHSA-2018-2.0-0037-(a)) (deprecated)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"This plugin has been deprecated.");
  script_set_attribute(attribute:"description", value:
"An update of {'linux-aws','linux-esx', 'linux-secure', 'linux'}
packages of Photon OS has been released.");
  # https://github.com/vmware/photon/wiki/Security-Updates-2-37-a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5506e403");
  script_set_attribute(attribute:"solution", value:"n/a.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-18218");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Microsoft Windows POP/MOV SS Local Privilege Elevation Vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/07/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:linux");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:2.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"PhotonOS Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");

  exit(0);
}

exit(0, "This plugin has been deprecated.");

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/PhotonOS/release");
if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
if (release !~ "^VMware Photon (?:Linux|OS) 2\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 2.0");

if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);

flag = 0;

pkgs = [
  "linux-4.9.94-1.ph2",
  "linux-api-headers-4.9.94-1.ph2",
  "linux-aws-4.9.94-1.ph2",
  "linux-aws-4.9.94-1.ph2",
  "linux-aws-debuginfo-4.9.94-1.ph2",
  "linux-aws-debuginfo-4.9.94-1.ph2",
  "linux-aws-devel-4.9.94-1.ph2",
  "linux-aws-devel-4.9.94-1.ph2",
  "linux-aws-docs-4.9.94-1.ph2",
  "linux-aws-docs-4.9.94-1.ph2",
  "linux-aws-drivers-gpu-4.9.94-1.ph2",
  "linux-aws-drivers-gpu-4.9.94-1.ph2",
  "linux-aws-oprofile-4.9.94-1.ph2",
  "linux-aws-oprofile-4.9.94-1.ph2",
  "linux-aws-sound-4.9.94-1.ph2",
  "linux-aws-sound-4.9.94-1.ph2",
  "linux-aws-tools-4.9.94-1.ph2",
  "linux-aws-tools-4.9.94-1.ph2",
  "linux-debuginfo-4.9.94-1.ph2",
  "linux-devel-4.9.94-1.ph2",
  "linux-docs-4.9.94-1.ph2",
  "linux-drivers-gpu-4.9.94-1.ph2",
  "linux-esx-4.9.94-1.ph2",
  "linux-esx-4.9.94-1.ph2",
  "linux-esx-debuginfo-4.9.94-1.ph2",
  "linux-esx-debuginfo-4.9.94-1.ph2",
  "linux-esx-devel-4.9.94-1.ph2",
  "linux-esx-devel-4.9.94-1.ph2",
  "linux-esx-docs-4.9.94-1.ph2",
  "linux-esx-docs-4.9.94-1.ph2",
  "linux-oprofile-4.9.94-1.ph2",
  "linux-secure-4.9.94-1.ph2",
  "linux-secure-4.9.94-1.ph2",
  "linux-secure-debuginfo-4.9.94-1.ph2",
  "linux-secure-debuginfo-4.9.94-1.ph2",
  "linux-secure-devel-4.9.94-1.ph2",
  "linux-secure-devel-4.9.94-1.ph2",
  "linux-secure-docs-4.9.94-1.ph2",
  "linux-secure-docs-4.9.94-1.ph2",
  "linux-secure-lkcm-4.9.94-1.ph2",
  "linux-secure-lkcm-4.9.94-1.ph2",
  "linux-sound-4.9.94-1.ph2",
  "linux-tools-4.9.94-1.ph2"
];

foreach (pkg in pkgs)
  if (rpm_check(release:"PhotonOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "linux");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(124795);
  script_version("1.24");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/19");

  script_cve_id(
    "CVE-2013-2889",
    "CVE-2013-4345",
    "CVE-2013-7421",
    "CVE-2014-0155",
    "CVE-2014-3122",
    "CVE-2014-4014",
    "CVE-2015-3332",
    "CVE-2015-4176",
    "CVE-2016-2184",
    "CVE-2016-2545",
    "CVE-2016-2546",
    "CVE-2017-14340",
    "CVE-2017-16531",
    "CVE-2017-18218",
    "CVE-2017-18360",
    "CVE-2017-5669",
    "CVE-2018-10675",
    "CVE-2018-11232",
    "CVE-2018-18710",
    "CVE-2018-7480"
  );
  script_bugtraq_id(
    62042,
    62740,
    66688,
    67162,
    67988,
    72322,
    74232
  );

  script_name(english:"EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1471)");
  script_summary(english:"Checks the rpm output for the updated packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote EulerOS Virtualization for ARM 64 host is missing multiple security
updates.");
  script_set_attribute(attribute:"description", value:
"According to the versions of the kernel packages installed, the
EulerOS Virtualization for ARM 64 installation on the remote host is
affected by the following vulnerabilities :

  - drivers/hid/hid-zpff.c in the Human Interface Device
    (HID) subsystem in the Linux kernel through 3.11, when
    CONFIG_HID_ZEROPLUS is enabled, allows physically
    proximate attackers to cause a denial of service
    (heap-based out-of-bounds write) via a crafted
    device.(CVE-2013-2889i1/4%0

  - The capabilities implementation in the Linux kernel
    before 3.14.8 does not properly consider that
    namespaces are inapplicable to inodes, which allows
    local users to bypass intended chmod restrictions by
    first creating a user namespace, as demonstrated by
    setting the setgid bit on a file with group ownership
    of root.(CVE-2014-4014i1/4%0

  - The function drivers/usb/core/config.c in the Linux
    kernel, allows local users to cause a denial of service
    (out-of-bounds read and system crash) or possibly have
    unspecified other impact via a crafted USB device,
    related to the USB_DT_INTERFACE_ASSOCIATION
    descriptor.(CVE-2017-16531i1/4%0

  - The snd_timer_interrupt function in sound/core/timer.c
    in the Linux kernel before 4.4.1 does not properly
    maintain a certain linked list, which allows local
    users to cause a denial of service (race condition and
    system crash) via a crafted ioctl
    call.(CVE-2016-2545i1/4%0

  - A flaw was found in the Linux kernel where the deletion
    of a file or directory could trigger an unmount and
    reveal data under a mount point. This flaw was
    inadvertently introduced with the new feature of being
    able to lazily unmount a mount tree when using file
    system user namespaces.(CVE-2015-4176i1/4%0

  - The do_shmat function in ipc/shm.c in the Linux kernel,
    through 4.9.12, does not restrict the address
    calculated by a certain rounding operation. This allows
    privileged local users to map page zero and,
    consequently, bypass a protection mechanism that exists
    for the mmap system call. This is possible by making
    crafted shmget and shmat system calls in a privileged
    context.(CVE-2017-5669i1/4%0

  - In drivers/net/ethernet/hisilicon/hns/hns_enet.c in the
    Linux kernel, before 4.13, local users can cause a
    denial of service (use-after-free and BUG) or possibly
    have unspecified other impact by leveraging differences
    in skb handling between hns_nic_net_xmit_hw and
    hns_nic_net_xmit.(CVE-2017-18218i1/4%0

  - The ioapic_deliver function in virt/kvm/ioapic.c in the
    Linux kernel through 3.14.1 does not properly validate
    the kvm_irq_delivery_to_apic return value, which allows
    guest OS users to cause a denial of service (host OS
    crash) via a crafted entry in the redirection table of
    an I/O APIC. NOTE: the affected code was moved to the
    ioapic_service function before the vulnerability was
    announced.(CVE-2014-0155i1/4%0

  - A flaw was found in the way the Linux kernel's Crypto
    subsystem handled automatic loading of kernel modules.
    A local user could use this flaw to load any installed
    kernel module, and thus increase the attack surface of
    the running kernel.(CVE-2013-7421i1/4%0

  - Off-by-one error in the get_prng_bytes function in
    crypto/ansi_cprng.c in the Linux kernel through 3.11.4
    makes it easier for context-dependent attackers to
    defeat cryptographic protection mechanisms via multiple
    requests for small amounts of data, leading to improper
    management of the state of the consumed
    data.(CVE-2013-4345i1/4%0

  - sound/core/timer.c in the Linux kernel before 4.4.1
    uses an incorrect type of mutex, which allows local
    users to cause a denial of service (race condition,
    use-after-free, and system crash) via a crafted ioctl
    call.(CVE-2016-2546i1/4%0

  - The do_get_mempolicy function in mm/mempolicy.c in the
    Linux kernel before 4.12.9 allows local users to cause
    a denial of service (use-after-free) or possibly have
    unspecified other impact via crafted system
    calls.(CVE-2018-10675i1/4%0

  - A certain backport in the TCP Fast Open implementation
    for the Linux kernel before 3.18 does not properly
    maintain a count value, which allow local users to
    cause a denial of service (system crash) via the Fast
    Open feature, as demonstrated by visiting the
    chrome://flags/#enable-tcp-fast-open URL when using
    certain 3.10.x through 3.16.x kernel builds, including
    longterm-maintenance releases and ckt (aka Canonical
    Kernel Team) builds.(CVE-2015-3332i1/4%0

  - It was found that the try_to_unmap_cluster() function
    in the Linux kernel's Memory Managment subsystem did
    not properly handle page locking in certain cases,
    which could potentially trigger the BUG_ON() macro in
    the mlock_vma_page() function. A local, unprivileged
    user could use this flaw to crash the
    system.(CVE-2014-3122i1/4%0

  - The blkcg_init_queue function in block/blk-cgroup.c in
    the Linux kernel, before 4.11, allows local users to
    cause a denial of service (double free) or possibly
    have unspecified other impact by triggering a creation
    failure.(CVE-2018-7480i1/4%0

  - The create_fixed_stream_quirk function in
    sound/usb/quirks.c in the snd-usb-audio driver in the
    Linux kernel before 4.5.1 allows physically proximate
    attackers to cause a denial of service (NULL pointer
    dereference or double free, and system crash) via a
    crafted endpoints value in a USB device
    descriptor.(CVE-2016-2184i1/4%0

  - The etm_setup_aux function in
    drivers/hwtracing/coresight/coresight-etm-perf.c in the
    Linux kernel before 4.10.2 allows attackers to cause a
    denial of service (panic) because a parameter is
    incorrectly used as a local variable.(CVE-2018-11232i1/4%0

  - A division-by-zero in set_termios(), when debugging is
    enabled, was found in the Linux kernel. When the
    [io_ti] driver is loaded, a local unprivileged attacker
    can request incorrect high transfer speed in the
    change_port_settings() in the
    drivers/usb/serial/io_ti.c so that the divisor value
    becomes zero and causes a system crash resulting in a
    denial of service.(CVE-2017-18360i1/4%0

  - A flaw was found where the XFS filesystem code
    mishandles a user-settable inode flag in the Linux
    kernel prior to 4.14-rc1. This can cause a local denial
    of service via a kernel panic.(CVE-2017-14340i1/4%0

  - An issue was discovered in the Linux kernel through
    4.19. An information leak in cdrom_ioctl_select_disc in
    drivers/cdrom/cdrom.c could be used by local attackers
    to read kernel memory because a cast from unsigned long
    to int interferes with bounds
    checking.(CVE-2018-18710i1/4%0

Note that Tenable Network Security has extracted the preceding
description block directly from the EulerOS security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.");
  # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-1471
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d86ae156");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel packages.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");

  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/05/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-headers");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:kernel-tools-libs-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:perf");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:python-perf");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:uvp:3.0.1.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Huawei Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/uvp_version");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/EulerOS/release");
if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
uvp = get_kb_item("Host/EulerOS/uvp_version");
if (uvp != "3.0.1.0") audit(AUDIT_OS_NOT, "EulerOS Virtualization 3.0.1.0");
if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu);

flag = 0;

pkgs = ["kernel-4.19.28-1.2.117",
        "kernel-devel-4.19.28-1.2.117",
        "kernel-headers-4.19.28-1.2.117",
        "kernel-tools-4.19.28-1.2.117",
        "kernel-tools-libs-4.19.28-1.2.117",
        "kernel-tools-libs-devel-4.19.28-1.2.117",
        "perf-4.19.28-1.2.117",
        "python-perf-4.19.28-1.2.117"];

foreach (pkg in pkgs)
  if (rpm_check(release:"EulerOS-2.0", reference:pkg)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "kernel");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-4188. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(109518);
  script_version("1.10");
  script_cvs_date("Date: 2019/07/15 14:20:30");

  script_cve_id("CVE-2017-17975", "CVE-2017-18193", "CVE-2017-18216", "CVE-2017-18218", "CVE-2017-18222", "CVE-2017-18224", "CVE-2017-18241", "CVE-2017-18257", "CVE-2017-5715", "CVE-2017-5753", "CVE-2018-1000199", "CVE-2018-10323", "CVE-2018-1065", "CVE-2018-1066", "CVE-2018-1068", "CVE-2018-1092", "CVE-2018-1093", "CVE-2018-1108", "CVE-2018-5803", "CVE-2018-7480", "CVE-2018-7566", "CVE-2018-7740", "CVE-2018-7757", "CVE-2018-7995", "CVE-2018-8087", "CVE-2018-8781", "CVE-2018-8822");
  script_xref(name:"DSA", value:"4188");

  script_name(english:"Debian DSA-4188-1 : linux - security update (Spectre)");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

  - CVE-2017-5715
    Multiple researchers have discovered a vulnerability in
    various processors supporting speculative execution,
    enabling an attacker controlling an unprivileged process
    to read memory from arbitrary addresses, including from
    the kernel and all other processes running on the
    system.

  This specific attack has been named Spectre variant 2 (branch target
  injection) and is mitigated for the x86 architecture (amd64 and
  i386) by using the 'retpoline' compiler feature which allows
  indirect branches to be isolated from speculative execution.

  - CVE-2017-5753
    Multiple researchers have discovered a vulnerability in
    various processors supporting speculative execution,
    enabling an attacker controlling an unprivileged process
    to read memory from arbitrary addresses, including from
    the kernel and all other processes running on the
    system.

  This specific attack has been named Spectre variant 1 (bounds-check
  bypass) and is mitigated by identifying vulnerable code sections
  (array bounds checking followed by array access) and replacing the
  array access with the speculation-safe array_index_nospec()
  function.

  More use sites will be added over time.

  - CVE-2017-17975
    Tuba Yavuz reported a use-after-free flaw in the
    USBTV007 audio-video grabber driver. A local user could
    use this for denial of service by triggering failure of
    audio registration.

  - CVE-2017-18193
    Yunlei He reported that the f2fs implementation does not
    properly handle extent trees, allowing a local user to
    cause a denial of service via an application with
    multiple threads.

  - CVE-2017-18216
    Alex Chen reported that the OCFS2 filesystem failed to
    hold a necessary lock during nodemanager sysfs file
    operations, potentially leading to a NULL pointer
    dereference. A local user could use this for denial of
    service.

  - CVE-2017-18218
    Jun He reported a use-after-free flaw in the Hisilicon
    HNS ethernet driver. A local user could use this for
    denial of service.

  - CVE-2017-18222
    It was reported that the Hisilicon Network Subsystem
    (HNS) driver implementation does not properly handle
    ethtool private flags. A local user could use this for
    denial of service or possibly have other impact.

  - CVE-2017-18224
    Alex Chen reported that the OCFS2 filesystem omits the
    use of a semaphore and consequently has a race condition
    for access to the extent tree during read operations in
    DIRECT mode. A local user could use this for denial of
    service.

  - CVE-2017-18241
    Yunlei He reported that the f2fs implementation does not
    properly initialise its state if the 'noflush_merge'
    mount option is used. A local user with access to a
    filesystem mounted with this option could use this to
    cause a denial of service.

  - CVE-2017-18257
    It was reported that the f2fs implementation is prone to
    an infinite loop caused by an integer overflow in the
    __get_data_block() function. A local user can use this
    for denial of service via crafted use of the open and
    fallocate system calls with an FS_IOC_FIEMAP ioctl.

  - CVE-2018-1065
    The syzkaller tool found a NULL pointer dereference flaw
    in the netfilter subsystem when handling certain
    malformed iptables rulesets. A local user with the
    CAP_NET_RAW or CAP_NET_ADMIN capability (in any user
    namespace) could use this to cause a denial of service.
    Debian disables unprivileged user namespaces by default.

  - CVE-2018-1066
    Dan Aloni reported to Red Hat that the CIFS client
    implementation would dereference a NULL pointer if the
    server sent an invalid response during NTLMSSP setup
    negotiation. This could be used by a malicious server
    for denial of service.

  - CVE-2018-1068
    The syzkaller tool found that the 32-bit compatibility
    layer of ebtables did not sufficiently validate offset
    values. On a 64-bit kernel, a local user with the
    CAP_NET_ADMIN capability (in any user namespace) could
    use this to overwrite kernel memory, possibly leading to
    privilege escalation. Debian disables unprivileged user
    namespaces by default.

  - CVE-2018-1092
    Wen Xu reported that a crafted ext4 filesystem image
    would trigger a null dereference when mounted. A local
    user able to mount arbitrary filesystems could use this
    for denial of service.

  - CVE-2018-1093
    Wen Xu reported that a crafted ext4 filesystem image
    could trigger an out-of-bounds read in the
    ext4_valid_block_bitmap() function. A local user able to
    mount arbitrary filesystems could use this for denial of
    service.

  - CVE-2018-1108
    Jann Horn reported that crng_ready() does not properly
    handle the crng_init variable states and the RNG could
    be treated as cryptographically safe too early after
    system boot.

  - CVE-2018-5803
    Alexey Kodanev reported that the SCTP protocol did not
    range-check the length of chunks to be created. A local
    or remote user could use this to cause a denial of
    service.

  - CVE-2018-7480
    Hou Tao discovered a double-free flaw in the
    blkcg_init_queue() function in block/blk-cgroup.c. A
    local user could use this to cause a denial of service
    or have other impact.

  - CVE-2018-7566
    Fan LongFei reported a race condition in the ALSA
    (sound) sequencer core, between write and ioctl
    operations. This could lead to an out-of-bounds access
    or use-after-free. A local user with access to a
    sequencer device could use this for denial of service or
    possibly for privilege escalation.

  - CVE-2018-7740
    Nic Losby reported that the hugetlbfs filesystem's mmap
    operation did not properly range-check the file offset.
    A local user with access to files on a hugetlbfs
    filesystem could use this to cause a denial of service.

  - CVE-2018-7757
    Jason Yan reported a memory leak in the SAS
    (Serial-Attached SCSI) subsystem. A local user on a
    system with SAS devices could use this to cause a denial
    of service.

  - CVE-2018-7995
    Seunghun Han reported a race condition in the x86 MCE
    (Machine Check Exception) driver. This is unlikely to
    have any security impact.

  - CVE-2018-8087
    A memory leak flaw was found in the hwsim_new_radio_nl()
    function in the simulated radio testing tool driver for
    mac80211, allowing a local user to cause a denial of
    service.

  - CVE-2018-8781
    Eyal Itkin reported that the udl (DisplayLink) driver's
    mmap operation did not properly range-check the file
    offset. A local user with access to a udl framebuffer
    device could exploit this to overwrite kernel memory,
    leading to privilege escalation.

  - CVE-2018-8822
    Dr Silvio Cesare of InfoSect reported that the ncpfs
    client implementation did not validate reply lengths
    from the server. An ncpfs server could use this to cause
    a denial of service or remote code execution in the
    client.

  - CVE-2018-10323
    Wen Xu reported a NULL pointer dereference flaw in the
    xfs_bmapi_write() function triggered when mounting and
    operating a crafted xfs filesystem image. A local user
    able to mount arbitrary filesystems could use this for
    denial of service.

  - CVE-2018-1000199
    Andy Lutomirski discovered that the ptrace subsystem did
    not sufficiently validate hardware breakpoint settings.
    Local users can use this to cause a denial of service,
    or possibly for privilege escalation, on x86 (amd64 and
    i386) and possibly other architectures."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-5715"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-5753"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-17975"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18193"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18216"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18218"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18222"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18224"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18241"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2017-18257"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1065"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1066"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1068"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1092"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1093"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1108"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-5803"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-7480"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-7566"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-7740"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-7757"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-7995"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-8087"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-8781"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-8822"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-10323"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/CVE-2018-1000199"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security-tracker.debian.org/tracker/source-package/linux"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/stretch/linux"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2018/dsa-4188"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the linux packages.

For the stable distribution (stretch), these problems have been fixed
in version 4.9.88-1."
  );
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:linux");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/12/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/05/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/05/02");
  script_set_attribute(attribute:"in_the_news", value:"true");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"9.0", prefix:"hyperv-daemons", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"libcpupower-dev", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"libcpupower1", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"libusbip-dev", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-arm", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-s390", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-compiler-gcc-6-x86", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-cpupower", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-doc-4.9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-4kc-malta", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-5kc-malta", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-686", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-686-pae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-amd64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-arm64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-armel", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-armhf", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-i386", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mips", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mips64el", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-mipsel", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-ppc64el", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-all-s390x", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-amd64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-arm64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-armmp", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-armmp-lpae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-common", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-common-rt", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-loongson-3", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-marvell", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-octeon", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-powerpc64le", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-rt-686-pae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-rt-amd64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-headers-4.9.0-9-s390x", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-4kc-malta", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-4kc-malta-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-5kc-malta", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-5kc-malta-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-pae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-686-pae-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-amd64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-amd64-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-arm64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-arm64-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-lpae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-armmp-lpae-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-loongson-3", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-loongson-3-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-marvell", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-marvell-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-octeon", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-octeon-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-powerpc64le", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-powerpc64le-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-686-pae", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-686-pae-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-amd64", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-rt-amd64-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-s390x", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-image-4.9.0-9-s390x-dbg", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-kbuild-4.9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-libc-dev", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-manual-4.9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-perf-4.9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-source-4.9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"linux-support-4.9.0-9", reference:"4.9.88-1")) flag++;
if (deb_check(release:"9.0", prefix:"usbip", reference:"4.9.88-1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");