Vulnerabilities > CVE-2018-3665 - Information Exposure vulnerability in multiple products

System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel.

Vulnerable Configurations

Part	Description	Count
Hardware	Intel Intel Core I3 4330 Intel Core I3 4330T Intel Core I3 4330Te Intel Core I3 4340 Intel Core I3 4340Te Intel Core I3 4350 Intel Core I3 4350T Intel Core I3 4360 Intel Core I3 4360T Intel Core I3 4370 Intel Core I3 4370T Intel Core I3 4100E Intel Core I3 4100M Intel Core I3 4100U Intel Core I3 4102E Intel Core I3 4110E Intel Core I3 4110M Intel Core I3 4112E Intel Core I3 4120U Intel Core I3 4158U Intel Core I3 4170T Intel Core I3 4170 Intel Core I3 4160T Intel Core I3 4160 Intel Core I3 4150T Intel Core I3 4150 Intel Core I3 4130T Intel Core I3 4130 Intel Core I3 4000M Intel Core I3 4005U Intel Core I3 4010U Intel Core I3 4010Y Intel Core I3 4012Y Intel Core I3 4020Y Intel Core I3 4025U Intel Core I3 4030U Intel Core I3 4030Y Intel Core I3 8100 Intel Core I3 8350K Intel Core I3 6300 Intel Core I3 6300T Intel Core I3 6320 Intel Core I3 6100E Intel Core I3 6100H Intel Core I3 6100U Intel Core I3 6102E Intel Core I3 6157U Intel Core I3 6167U Intel Core I3 6100 Intel Core I3 6100T Intel Core I3 6100Te Intel Core I3 6006U Intel Core I3 6098P Intel Core I3 5157U Intel Core I3 5020U Intel Core I3 5015U Intel Core I3 5010U Intel Core I3 5005U Intel Core I3 3250T Intel Core I3 3250 Intel Core I3 3245 Intel Core I3 3240T Intel Core I3 3240 Intel Core I3 3229Y Intel Core I3 3227U Intel Core I3 3225 Intel Core I3 3220T Intel Core I3 3220 Intel Core I3 3217Ue Intel Core I3 3217U Intel Core I3 3210 Intel Core I3 3130M Intel Core I3 3120Me Intel Core I3 3120M Intel Core I3 3115C Intel Core I3 3110M Intel Core I3 2377M Intel Core I3 2375M Intel Core I3 2370M Intel Core I3 2367M Intel Core I3 2365M Intel Core I3 2357M Intel Core I3 2350M Intel Core I3 2348M Intel Core I3 2340Ue Intel Core I3 2330M Intel Core I3 2330E Intel Core I3 2328M Intel Core I3 2312M Intel Core I3 2310M Intel Core I3 2310E Intel Core I3 2130 Intel Core I3 2125 Intel Core I3 2120T Intel Core I3 2120 Intel Core I3 2115C Intel Core I3 2105 Intel Core I3 2102 Intel Core I3 2100T Intel Core I3 2100 Intel Core I3 560 Intel Core I3 390M Intel Core I3 550 Intel Core I3 540 Intel Core I3 530 Intel Core I3 380Um Intel Core I3 380M Intel Core I3 370M Intel Core I3 350M Intel Core I3 330Um Intel Core I3 330M Intel Core I3 330E Intel Core I5 4670 Intel Core I5 4670K Intel Core I5 4670R Intel Core I5 4670S Intel Core I5 4670T Intel Core I5 4690 Intel Core I5 4690K Intel Core I5 4690S Intel Core I5 4690T Intel Core I5 4570 Intel Core I5 4570R Intel Core I5 4570S Intel Core I5 4570T Intel Core I5 4570Te Intel Core I5 4590 Intel Core I5 4590S Intel Core I5 4590T Intel Core I5 4422E Intel Core I5 4410E Intel Core I5 4402Ec Intel Core I5 4402E Intel Core I5 4400E Intel Core I5 4460T Intel Core I5 4460S Intel Core I5 4460 Intel Core I5 4440S Intel Core I5 4440 Intel Core I5 4430S Intel Core I5 4430 Intel Core I5 4300M Intel Core I5 4300U Intel Core I5 4300Y Intel Core I5 4302Y Intel Core I5 4308U Intel Core I5 4310M Intel Core I5 4310U Intel Core I5 4330M Intel Core I5 4340M Intel Core I5 4350U Intel Core I5 4360U Intel Core I5 4200H Intel Core I5 4200M Intel Core I5 4200U Intel Core I5 4200Y Intel Core I5 4202Y Intel Core I5 4210H Intel Core I5 4210M Intel Core I5 4210U Intel Core I5 4210Y Intel Core I5 4220Y Intel Core I5 4250U Intel Core I5 4258U Intel Core I5 4260U Intel Core I5 4278U Intel Core I5 4288U Intel Core I5 8350U Intel Core I5 8250U Intel Core I5 8400 Intel Core I5 8600K Intel Core I5 6600 Intel Core I5 6685R Intel Core I5 6600K Intel Core I5 6600T Intel Core I5 6585R Intel Core I5 6500 Intel Core I5 6500T Intel Core I5 6500Te Intel Core I5 6402P Intel Core I5 6400 Intel Core I5 6400T Intel Core I5 6440Eq Intel Core I5 6440Hq Intel Core I5 6442Eq Intel Core I5 6360U Intel Core I5 6350Hq Intel Core I5 6300Hq Intel Core I5 6300U Intel Core I5 6200U Intel Core I5 6260U Intel Core I5 6267U Intel Core I5 6287U Intel Core I5 5675R Intel Core I5 5675C Intel Core I5 5575R Intel Core I5 5350U Intel Core I5 5350H Intel Core I5 5300U Intel Core I5 5287U Intel Core I5 5257U Intel Core I5 5250U Intel Core I5 5200U Intel Core I5 3610Me Intel Core I5 3570S Intel Core I5 3570T Intel Core I5 3570K Intel Core I5 3570 Intel Core I5 3550S Intel Core I5 3550 Intel Core I5 3475S Intel Core I5 3470T Intel Core I5 3470S Intel Core I5 3470 Intel Core I5 3450S Intel Core I5 3450 Intel Core I5 3439Y Intel Core I5 3437U Intel Core I5 3427U Intel Core I5 3380M Intel Core I5 3360M Intel Core I5 3350P Intel Core I5 3340S Intel Core I5 3340M Intel Core I5 3340 Intel Core I5 3339Y Intel Core I5 3337U Intel Core I5 3330S Intel Core I5 3330 Intel Core I5 3320M Intel Core I5 3210M Intel Core I5 3317U Intel Core I5 3230M Intel Core I5 2557M Intel Core I5 2550K Intel Core I5 2540M Intel Core I5 2537M Intel Core I5 2520M Intel Core I5 2515E Intel Core I5 2510E Intel Core I5 2500T Intel Core I5 2500S Intel Core I5 2500K Intel Core I5 2500 Intel Core I5 2467M Intel Core I5 2450P Intel Core I5 2450M Intel Core I5 2435M Intel Core I5 2430M Intel Core I5 2410M Intel Core I5 2405S Intel Core I5 2400S Intel Core I5 2400 Intel Core I5 2390T Intel Core I5 2380P Intel Core I5 2320 Intel Core I5 2310 Intel Core I5 2300 Intel Core I5 680 Intel Core I5 480M Intel Core I5 760 Intel Core I5 750S Intel Core I5 750 Intel Core I5 670 Intel Core I5 661 Intel Core I5 660 Intel Core I5 655K Intel Core I5 650 Intel Core I5 580M Intel Core I5 560Um Intel Core I5 560M Intel Core I5 540Um Intel Core I5 540M Intel Core I5 520Um Intel Core I5 520M Intel Core I5 520E Intel Core I5 470Um Intel Core I5 460M Intel Core I5 450M Intel Core I5 430Um Intel Core I5 430M Intel Core I7 4900Mq Intel Core I7 4910Mq Intel Core I7 4950Hq Intel Core I7 4960Hq Intel Core I7 4980Hq Intel Core I7 4800Mq Intel Core I7 4810Mq Intel Core I7 4850Hq Intel Core I7 4860Hq Intel Core I7 4870Hq Intel Core I7 4700Ec Intel Core I7 4700Eq Intel Core I7 4700Hq Intel Core I7 4700Mq Intel Core I7 4702Ec Intel Core I7 4702Hq Intel Core I7 4702Mq Intel Core I7 4710Hq Intel Core I7 4710Mq Intel Core I7 4712Hq Intel Core I7 4712Mq Intel Core I7 4720Hq Intel Core I7 4722Hq Intel Core I7 4750Hq Intel Core I7 4760Hq Intel Core I7 4770Hq Intel Core I7 4790K Intel Core I7 4770K Intel Core I7 4765T Intel Core I7 4770 Intel Core I7 4770R Intel Core I7 4770S Intel Core I7 4770T Intel Core I7 4770Te Intel Core I7 4771 Intel Core I7 4785T Intel Core I7 4790 Intel Core I7 4790S Intel Core I7 4790T Intel Core I7 4600M Intel Core I7 4600U Intel Core I7 4610M Intel Core I7 4610Y Intel Core I7 4650U Intel Core I7 4500U Intel Core I7 4510U Intel Core I7 4550U Intel Core I7 4558U Intel Core I7 4578U Intel Core I7 8550U Intel Core I7 8650U Intel Core I7 8700 Intel Core I7 8700K Intel Core I7 7920Hq Intel Core I7 7820Hq Intel Core I7 7820Hk Intel Core I7 7820Eq Intel Core I7 7700Hq Intel Core I7 7700 Intel Core I7 7700K Intel Core I7 7700T Intel Core I7 7660U Intel Core I7 7600U Intel Core I7 7567U Intel Core I7 7560U Intel Core I7 7500U Intel Core I7 7Y75 Intel Core I7 5950Hq Intel Core I7 5850Hq Intel Core I7 5850Eq Intel Core I7 5750Hq Intel Core I7 5700Eq Intel Core I7 5700Hq Intel Core I7 5775R Intel Core I7 5775C Intel Core I7 5650U Intel Core I7 5600U Intel Core I7 5557U Intel Core I7 5550U Intel Core I7 5500U Intel Core I7 2960Xm Intel Core I7 2920Xm Intel Core I7 990X Intel Core I7 980X Intel Core I7 975 Intel Core I7 965 Intel Core I7 940Xm Intel Core I7 920Xm Intel Core I7 3840Qm Intel Core I7 3820Qm Intel Core I7 3770T Intel Core I7 3770S Intel Core I7 3770K Intel Core I7 3770 Intel Core I7 3740Qm Intel Core I7 3720Qm Intel Core I7 3689Y Intel Core I7 3687U Intel Core I7 3667U Intel Core I7 3635Qm Intel Core I7 3632Qm Intel Core I7 3630Qm Intel Core I7 3615Qm Intel Core I7 3615Qe Intel Core I7 3612Qm Intel Core I7 3612Qe Intel Core I7 3610Qm Intel Core I7 3610Qe Intel Core I7 3555Le Intel Core I7 3540M Intel Core I7 3537U Intel Core I7 3520M Intel Core I7 3517Ue Intel Core I7 3517U Intel Core I7 2860Qm Intel Core I7 2820Qm Intel Core I7 2760Qm Intel Core I7 2720Qm Intel Core I7 2715Qe Intel Core I7 2710Qe Intel Core I7 2700K Intel Core I7 2677M Intel Core I7 2670Qm Intel Core I7 2675Qm Intel Core I7 2657M Intel Core I7 2655Le Intel Core I7 2649M Intel Core I7 2640M Intel Core I7 2637M Intel Core I7 2635Qm Intel Core I7 2630Qm Intel Core I7 2629M Intel Core I7 2620M Intel Core I7 2617M Intel Core I7 2610Ue Intel Core I7 2600S Intel Core I7 2600K Intel Core I7 2600 Intel Core I7 920 Intel Core I7 860 Intel Core I7 820Qm Intel Core I7 720Qm Intel Core I7 610E Intel Core I7 980 Intel Core I7 970 Intel Core I7 960 Intel Core I7 950 Intel Core I7 940 Intel Core I7 930 Intel Core I7 880 Intel Core I7 875K Intel Core I7 870S Intel Core I7 870 Intel Core I7 860S Intel Core I7 840Qm Intel Core I7 740Qm Intel Core I7 680Um Intel Core I7 660Um Intel Core I7 660Ue Intel Core I7 660Lm Intel Core I7 640Um Intel Core I7 640M Intel Core I7 640Lm Intel Core I7 620Um Intel Core I7 620Ue Intel Core I7 620M Intel Core I7 620Lm Intel Core I7 620Le Intel Core M 5Y71 Intel Core M 5Y70 Intel Core M 5Y51 Intel Core M 5Y31 Intel Core M 5Y10C Intel Core M 5Y10A Intel Core M 5Y10 Intel Core M3 7Y32 Intel Core M3 7Y30 Intel Core M3 6Y30 Intel Core M5 6Y54 Intel Core M5 6Y57 Intel Core M7 6Y75	462
Application	Citrix Citrix Xenserver 7.0 Citrix Xenserver 7.1 Citrix Xenserver 7.3 Citrix Xenserver 7.4 Citrix Xenserver 7.5	5
OS	Freebsd Freebsd Freebsd 11.0 Freebsd Freebsd 11.1 Freebsd Freebsd 11.2	3
OS	Redhat Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 6.0 Redhat Enterprise Linux Desktop 6.0 Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Workstation 6.0 Redhat Enterprise Linux Workstation 7.0	6
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 9.0	2
OS	Canonical Canonical Ubuntu Linux 16.04 Canonical Ubuntu Linux 14.04 Canonical Ubuntu Linux 12.04	3

Common Weakness Enumeration (CWE)

CWE-200 - Information Exposure

Common Attack Pattern Enumeration and Classification (CAPEC)

Subverting Environment Variable Values
The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
Footprinting
An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
Exploiting Trust in Client (aka Make the Client Invisible)
An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
Browser Fingerprinting
An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-1944.NASL
description	An update for kernel-rt is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	110618
published	2018-06-20
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110618
title	RHEL 7 : kernel-rt (RHSA-2018:1944)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-2164.NASL
description	From Red Hat Security Advisory 2018:2164 : An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	110996
published	2018-07-11
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110996
title	Oracle Linux 6 : kernel (ELSA-2018-2164) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2113-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_60 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111462
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111462
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2113-1)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-4144.NASL
description	Description of changes: [4.1.12-124.16.4.el7uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28135099] {CVE-2018-3665}
last seen	2020-06-01
modified	2020-06-02
plugin id	110584
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110584
title	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4144)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3698-1.NASL
description	It was discovered that the nested KVM implementation in the Linux kernel in some situations did not properly prevent second level guests from reading and writing the hardware CR8 register. A local attacker in a guest could use this to cause a denial of service (system crash). (CVE-2017-12154) Fan Wu, Haoran Qiu, and Shixiong Zhao discovered that the associative array implementation in the Linux kernel sometimes did not properly handle adding a new entry. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-12193) It was discovered that a race condition existed in the ALSA subsystem of the Linux kernel when creating and deleting a port via ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-15265) It was discovered that a NULL pointer dereference vulnerability existed in the DCCP protocol implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-1130) Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker could use this to expose sensitive information. (CVE-2018-3665) Wang Qize discovered that an information disclosure vulnerability existed in the SMBus driver for ACPI Embedded Controllers in the Linux kernel. A local attacker could use this to expose sensitive information (kernel pointer addresses). (CVE-2018-5750) It was discovered that the SCTP Protocol implementation in the Linux kernel did not properly validate userspace provided payload lengths in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-5803) It was discovered that an integer overflow error existed in the futex implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2018-6927) It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755) It was discovered that a memory leak existed in the SAS driver subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-7757). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	110900
published	2018-07-03
reporter	Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110900
title	Ubuntu 14.04 LTS : linux vulnerabilities (USN-3698-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2112-1.NASL
description	This update for the Linux Kernel 4.4.74-92_38 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111461
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111461
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2112-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2101-1.NASL
description	This update for the Linux Kernel 3.12.61-52_111 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111450
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111450
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2101-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2093-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_85 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111442
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111442
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2093-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1761-1.NASL
description	The SUSE Linux Enterprise 12 SP1 LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-01
modified	2020-06-02
plugin id	110636
published	2018-06-21
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110636
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1761-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1762-1.NASL
description	The SUSE Linux Enterprise 12 GA LTSS kernel was updated to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-01
modified	2020-06-02
plugin id	110637
published	2018-06-21
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110637
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1762-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1855-1.NASL
description	The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-01
modified	2020-06-02
plugin id	110838
published	2018-07-02
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110838
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1855-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-803.NASL
description	This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). Bug fixes : - bsc#1027519: Add upstream patches from January. - bsc#1087289: Fix xen scheduler crash. This update was imported from the SUSE:SLE-12-SP3:Update update project.
last seen	2020-06-05
modified	2018-08-07
plugin id	111565
published	2018-08-07
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111565
title	openSUSE Security Update : xen (openSUSE-2018-803)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-1852.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	110541
published	2018-06-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110541
title	RHEL 7 : kernel (RHSA-2018:1852)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20180710_KERNEL_ON_SL6_X.NASL
description	Security Fix(es) : - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-03-18
modified	2018-07-11
plugin id	111002
published	2018-07-11
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111002
title	Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20180710) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2106-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_88 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111455
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111455
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2106-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2099-1.NASL
description	This update for the Linux Kernel 4.4.74-92_29 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111448
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111448
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2099-1)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3696-2.NASL
description	USN-3696-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu 14.04 LTS. It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) Wei Fang discovered an integer overflow in the F2FS filesystem implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18257) It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204) It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10087) It was discovered that the kill() system call implementation in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10124) Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker could use this to expose sensitive information. (CVE-2018-3665) Jakub Jirasek discovered that multiple use-after-errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814) It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755) Seunghun Han discovered an information leak in the ACPI handling code in the Linux kernel when handling early termination of ACPI table loading. A local attacker could use this to expose sensitive informal (kernel address locations). (CVE-2017-13695) It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-10021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	110897
published	2018-07-03
reporter	Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110897
title	Ubuntu 14.04 LTS : linux-lts-xenial, linux-aws vulnerabilities (USN-3696-2)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1947-1.NASL
description	This update for the Linux Kernel 4.4.90-92_50 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111058
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111058
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1947-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2105-1.NASL
description	This update for the Linux Kernel 3.12.61-52_83 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111454
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111454
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2105-1)

NASL family	Windows : Microsoft Bulletins
NASL id	SMB_NT_MS18_AUG_4343900.NASL
description	The remote Windows host is missing security update 4343899 or cumulative update 4343900. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8403) - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the users system. (CVE-2018-8341, CVE-2018-8348) - An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. (CVE-2018-8342, CVE-2018-8343) - A remote code execution vulnerability exists when Internet Explorer improperly validates hyperlinks before loading executable libraries. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8316) - An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the users system. There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user to visit an untrusted webpage. The security update addresses the vulnerability by correcting how the Windows GDI component handles objects in memory. (CVE-2018-8394, CVE-2018-8396, CVE-2018-8398) - A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8355, CVE-2018-8372, CVE-2018-8385) - A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. (CVE-2018-8345, CVE-2018-8346) - A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. (CVE-2018-8353, CVE-2018-8371, CVE-2018-8373, CVE-2018-8389) - A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8397) - An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8404) - A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. (CVE-2018-8349) - An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation. (CVE-2018-8339) - An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments. The vulnerability is caused when .NET Framework is used in high-load/high-density network connections where content from one stream can blend into another stream. (CVE-2018-8360) - An information disclosure vulnerability exists when affected Microsoft browsers improperly allow cross-frame interaction. An attacker who successfully exploited this vulnerability could allow an attacker to obtain browser frame or window state from a different domain. For an attack to be successful, an attacker must persuade a user to open a malicious website from a secure website. This update addresses the vulnerability by denying permission to read the state of the object model, to which frames or windows on different domains should not have access. (CVE-2018-8351) - A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8344)
last seen	2020-06-01
modified	2020-06-02
plugin id	111689
published	2018-08-14
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111689
title	KB4343899: Windows 7 and Windows Server 2008 R2 August 2018 Security Update (Foreshadow)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2059-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). Bug fixes : - bsc#1027519: Add upstream patches from January. - bsc#1087289: Fix xen scheduler crash. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111348
published	2018-07-26
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111348
title	SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2018:2059-1)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1170.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * A flaw was found in the implementation of the
last seen	2020-06-01
modified	2020-06-02
plugin id	125039
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125039
title	RHEL 7 : kernel (RHSA-2019:1170) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2114-1.NASL
description	This update for the Linux Kernel 3.12.61-52_133 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111463
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111463
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2114-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2095-1.NASL
description	This update for the Linux Kernel 3.12.61-52_119 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111444
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111444
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2095-1)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-1A467757CE.NASL
description	preemption checks bypassed in x86 PV MM handling [XSA-264, CVE-2018-12891] x86: #DB exception safety check can be triggered by a guest [XSA-265, CVE-2018-12893] libxl fails to honour readonly flag on HVM emulated SCSI disks [XSA-266, CVE-2018-12892] ---- Speculative register leakage from lazy FPU context switching [XSA-267, CVE-2018-3665] fix for change in iasl output Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-07-24
plugin id	111236
published	2018-07-24
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111236
title	Fedora 27 : xen (2018-1a467757ce)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2081-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix #DB exception safety check that could be triggered by a guest (XSA-265) (bsc#1097522). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). - CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267) (bsc#1095242). Bug fixes : - bsc#1027519: Update to Xen 4.7.6 bug fix only release. - bsc#1087289: Xen BUG at sched_credit.c:1663. - bsc#1094725: `virsh blockresize` does not work with Xen qdisks. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111433
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111433
title	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2081-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2104-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_66 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111453
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111453
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2104-1)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_4E07D94F75A511E885D1A4BADB2F4699.NASL
description	A subset of Intel processors can allow a local thread to infer data from another thread through a speculative execution side channel when Lazy FPU state restore is used. Impact : Any local thread can potentially read FPU state information from other threads running on the host. This could include cryptographic keys when the AES-NI CPU feature is present.
last seen	2020-06-01
modified	2020-06-02
plugin id	110653
published	2018-06-22
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110653
title	FreeBSD : FreeBSD -- Lazy FPU State Restore Information Disclosure (4e07d94f-75a5-11e8-85d1-a4badb2f4699)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1514.NASL
description	According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.(CVE-2018-19985) - An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructions (a commonly used performance optimization). There are three primary variants of the issue which differ in the way the speculative execution can be exploited. Variant CVE-2017-5754 relies on the fact that, on impacted microprocessors, during speculative execution of instruction permission faults, exception generation triggered by a faulting access is suppressed until the retirement of the whole instruction block. In a combination with the fact that memory accesses may populate the cache even when the block is being dropped and never committed (executed), an unprivileged local attacker could use this flaw to read privileged (kernel space) memory by conducting targeted cache side-channel attacks. Note: CVE-2017-5754 affects Intel x86-64 microprocessors. AMD x86-64 microprocessors are not affected by this issue.(CVE-2017-5754) - A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary.(CVE-2017-15121) - A flaw was found in the Linux kernel when attempting to
last seen	2020-06-01
modified	2020-06-02
plugin id	124835
published	2019-05-13
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124835
title	EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1514)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-3696-1.NASL
description	It was discovered that an integer overflow existed in the perf subsystem of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18255) Wei Fang discovered an integer overflow in the F2FS filesystem implementation in the Linux kernel. A local attacker could use this to cause a denial of service. (CVE-2017-18257) It was discovered that an information leak existed in the generic SCSI driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-1000204) It was discovered that the wait4() system call in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10087) It was discovered that the kill() system call implementation in the Linux kernel did not properly validate its arguments in some situations. A local attacker could possibly use this to cause a denial of service. (CVE-2018-10124) Julian Stecklina and Thomas Prescher discovered that FPU register states (such as MMX, SSE, and AVX registers) which are lazily restored are potentially vulnerable to a side channel attack. A local attacker could use this to expose sensitive information. (CVE-2018-3665) Jakub Jirasek discovered that multiple use-after-errors existed in the USB/IP implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-5814) It was discovered that an information leak vulnerability existed in the floppy driver in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2018-7755) Seunghun Han discovered an information leak in the ACPI handling code in the Linux kernel when handling early termination of ACPI table loading. A local attacker could use this to expose sensitive informal (kernel address locations). (CVE-2017-13695) It was discovered that a memory leak existed in the Serial Attached SCSI (SAS) implementation in the Linux kernel. A physically proximate attacker could use this to cause a denial of service (memory exhaustion). (CVE-2018-10021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	110896
published	2018-07-03
reporter	Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110896
title	Ubuntu 16.04 LTS : linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities (USN-3696-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2069-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744). - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1079730: Fix failed
last seen	2020-06-01
modified	2020-06-02
plugin id	111371
published	2018-07-27
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111371
title	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2069-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2528-1.NASL
description	This update for xen fixes the following issues: These security issue were fixed : - CVE-2018-3646: Systems with microprocessors utilizing speculative execution and address translations may have allowed unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis (bsc#1091107, bsc#1027519). - CVE-2018-12617: An integer overflow that could cause a segmentation fault in qmp_guest_file_read() with g_malloc() in qemu-guest-agent was fixed (bsc#1098744) - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. (bsc#1095242) - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. (bsc#1092631) - CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5753: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. (bsc#1074562) - CVE-2017-5754: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. (bsc#1074562) - CVE-2018-12891: Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. (bsc#1097521) - CVE-2018-12893: One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfortunately, due to an oversight, at least one of these safety checks can be triggered by a guest. A malicious PV guest can crash Xen, leading to a Denial of Service. Only x86 PV guests can exploit the vulnerability. x86 HVM and PVH guests cannot exploit the vulnerability. An attacker needs to be able to control hardware debugging facilities to exploit the vulnerability, but such permissions are typically available to unprivileged users. (bsc#1097522) - CVE-2018-11806: m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams. (bsc#1096224) - CVE-2018-10982: An issue was discovered in Xen allowed x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection. (bsc#1090822) - CVE-2018-10981: An issue was discovered in Xen that allowed x86 HVM guest OS users to cause a denial of service (host OS infinite loop) in situations where a QEMU device model attempts to make invalid transitions between states of a request. (bsc#1090823) Following bugs were fixed : - After updating to kernel 3.0.101-0.47.106.32-xen system crashes in check_bugs() (bsc#1097206) - bsc#1079730 - in xen-kmp, unplug emulated devices after migration This is required since xen-4.10 and/or qemu-2.10 because the state of unplug is not propagated from one dom0 to another. Without this unplug qemu
last seen	2020-06-01
modified	2020-06-02
plugin id	112147
published	2018-08-28
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/112147
title	SUSE SLES11 Security Update : xen (SUSE-SU-2018:2528-1) (Foreshadow) (Meltdown) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2081-2.NASL
description	This update for xen fixes the following issues : Security issues fixed : CVE-2018-12891: Fix preemption checks bypass in x86 PV MM handling (XSA-264) (bsc#1097521). CVE-2018-12892: Fix libxl failure to honour readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). CVE-2018-12893: Fix #DB exception safety check that could be triggered by a guest (XSA-265) (bsc#1097522). CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). CVE-2018-3665: Fix lazy FP Save/Restore (XSA-267) (bsc#1095242). Bug fixes: bsc#1027519: Update to Xen 4.7.6 bug fix only release. bsc#1087289: Xen BUG at sched_credit.c:1663. bsc#1094725: `virsh blockresize` does not work with Xen qdisks. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	118277
published	2018-10-22
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118277
title	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2081-2)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20180614_KERNEL_ON_SL7_X.NASL
description	Security Fix(es) : - Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665)
last seen	2020-03-18
modified	2018-06-15
plugin id	110542
published	2018-06-15
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110542
title	Scientific Linux Security Update : kernel on SL7.x x86_64 (20180614)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-4164.NASL
description	Description of changes: kernel-uek kernel-uek [3.8.13-118.22.1.el7uek] - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao) {CVE-2017-18203} - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] {CVE-2018-8781} - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] {CVE-2018-10087} - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) {CVE-2018-10124} - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic) [Orabug: 28130293] {CVE-2015-8575} - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev) [Orabug: 28220402] {CVE-2017-8824} {CVE-2018-1130} - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev) [Orabug: 28240075] {CVE-2018-5803} - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] {CVE-2017-7616} - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] {CVE-2017-11600} {CVE-2017-11600} - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert
last seen	2020-06-01
modified	2020-06-02
plugin id	110998
published	2018-07-11
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110998
title	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4164)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0025_KERNEL.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - The xfrm_migrate() function in the net/xfrm/xfrm_policy.c file in the Linux kernel built with CONFIG_XFRM_MIGRATE does not verify if the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker to cause a denial of service (out-of- bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3. (CVE-2017-11600) - A flaw was found in the Linux kernel
last seen	2020-06-01
modified	2020-06-02
plugin id	127185
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127185
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0025)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1944-1.NASL
description	This update for the Linux Kernel 4.4.103-92_56 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111055
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111055
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1944-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2018-2164.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111077
published	2018-07-16
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111077
title	CentOS 6 : kernel (CESA-2018:2164) (Spectre)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2164.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-01
modified	2020-06-02
plugin id	111001
published	2018-07-11
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111001
title	RHEL 6 : kernel (RHSA-2018:2164) (Spectre)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-4145.NASL
description	Description of changes: [2.6.39-400.299.3.el6uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156175] {CVE-2018-3665} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 22876528] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 22876528] {CVE-2016-2384} - mlx4_ib: DREQ silently dropped by PF passive side (Venkat Venkatsubra) [Orabug: 25090540] - net: tcpdump fails with EFAULT (Venkat Venkatsubra) [Orabug: 25209691] - x86/spec: Remove rescan_spec_ctrl_feature as it
last seen	2020-06-01
modified	2020-06-02
plugin id	110585
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110585
title	Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2018-4145)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1942-1.NASL
description	This update for the Linux Kernel 4.4.90-92_45 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111053
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111053
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1942-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2086-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111436
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111436
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2086-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2018-1852.NASL
description	An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	110569
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110569
title	CentOS 7 : kernel (CESA-2018:1852)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2019-533.NASL
description	This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1027519: Add upstream patches from January. - bsc#1098403: Fix regression introduced by changes for bsc#1079730. A PV domU without qcow2 and/or vfb has no qemu attached. Ignore QMP errors for PV domUs to handle PV domUs with and without an attached qemu-xen. - bsc#1087289: Fix xen scheduler crash. This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	123224
published	2019-03-27
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/123224
title	openSUSE Security Update : xen (openSUSE-2019-533)

NASL family	Misc.
NASL id	CITRIX_XENSERVER_CTX235745.NASL
description	The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by an information disclosure vulnerability.
last seen	2020-06-01
modified	2020-06-02
plugin id	110779
published	2018-06-28
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110779
title	Citrix XenServer Information Disclosure Vulnerability (CTX235225)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2094-1.NASL
description	This update for the Linux Kernel 3.12.61-52_92 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111443
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111443
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2094-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1772-1.NASL
description	The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.136 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-01
modified	2020-06-02
plugin id	110660
published	2018-06-22
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110660
title	SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2018:1772-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1855-2.NASL
description	The SUSE Linux Enterprise 12 SP2 LTSS kernel was updated receive various security and bugfixes. The following security bugs were fixed : CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-01
modified	2020-06-02
plugin id	118272
published	2018-10-22
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118272
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1855-2)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2056-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744). - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1079730: Fix failed
last seen	2020-06-01
modified	2020-06-02
plugin id	111346
published	2018-07-26
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111346
title	SUSE SLES12 Security Update : xen (SUSE-SU-2018:2056-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0272.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0272 for details.
last seen	2020-06-01
modified	2020-06-02
plugin id	118963
published	2018-11-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118963
title	OracleVM 3.2 : xen (OVMSA-2018-0272) (Foreshadow) (Spectre)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2018-2165.NASL
description	Updated kernel-rt packages that fix two security issues and add one enhancement are now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * kernel: Buffer over-read in keyring subsystem allows exposing potentially sensitive information to local attacker (CVE-2017-13305) * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting CVE-2018-3665. Enhancement(s) : * The kernel-rt packages have been upgraded to version 3.10.0-693.35.1.rt56.623, which provides a number of bug fixes over the previous version. (BZ#1579972) Users of kernel-rt are advised to upgrade to these updated packages, which add this enhancement. The system must be rebooted for this update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	111029
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111029
title	RHEL 6 : MRG (RHSA-2018:2165)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1849-1.NASL
description	The SUSE Linux Enterprise 11 SP3 LTSS kernel was updated to receive various security and bugfixes. The following security bug was fixed : - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	110836
published	2018-07-02
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110836
title	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1849-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2107-1.NASL
description	This update for the Linux Kernel 3.12.61-52_125 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111456
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111456
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2107-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0231.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert
last seen	2020-06-01
modified	2020-06-02
plugin id	110581
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110581
title	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0231)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1946-1.NASL
description	This update for the Linux Kernel 4.4.121-92_80 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111057
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111057
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1946-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2048-1.NASL
description	This update for the Linux Kernel 4.4.74-92_32 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111328
published	2018-07-25
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111328
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2048-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2103-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_63 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111452
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111452
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2103-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0282.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0282 for details.
last seen	2020-06-01
modified	2020-06-02
plugin id	119277
published	2018-11-29
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119277
title	OracleVM 3.4 : xen (OVMSA-2018-0282) (Foreshadow) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2090-1.NASL
description	This update for the Linux Kernel 3.12.61-52_128 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111440
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111440
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2090-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0237.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - dm: fix race between dm_get_from_kobject and __dm_destroy (Hou Tao) (CVE-2017-18203) - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman) [Orabug: 27986407] (CVE-2018-8781) - kernel/exit.c: avoid undefined behaviour when calling wait4 wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry) [Orabug: 27875488] (CVE-2018-10087) - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry) (CVE-2018-10124) - bluetooth: Validate socket address length in sco_sock_bind. (mlevatic) [Orabug: 28130293] (CVE-2015-8575) - dccp: check sk for closed state in dccp_sendmsg (Alexey Kodanev) [Orabug: 28220402] (CVE-2017-8824) (CVE-2018-1130) - sctp: verify size of a new chunk in _sctp_make_chunk (Alexey Kodanev) [Orabug: 28240075] (CVE-2018-5803) - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls) [Orabug: 28242478] (CVE-2017-7616) - xfrm: policy: check policy direction value (Vladis Dronov) [Orabug: 28264121] (CVE-2017-11600) (CVE-2017-11600) - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] (CVE-2018-3665) - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] (CVE-2017-17741) (CVE-2017-17741) - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] (CVE-2018-10323) - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] (CVE-2017-1000410) (CVE-2017-1000410) - ALSA: hrtimer: Fix stall by hrtimer_cancel (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2549) - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2547) (CVE-2016-2548) - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2545) - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2543) - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] (CVE-2016-2544) - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] (CVE-2016-2384) - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] (CVE-2018-1000199) - Revert
last seen	2020-06-01
modified	2020-06-02
plugin id	111022
published	2018-07-12
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111022
title	OracleVM 3.3 : Unbreakable / etc (OVMSA-2018-0237)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0248.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0248 for details.
last seen	2020-06-01
modified	2020-06-02
plugin id	111992
published	2018-08-20
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111992
title	OracleVM 3.4 : xen (OVMSA-2018-0248) (Bunker Buster) (Foreshadow) (Meltdown) (POODLE) (Spectre)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-1422.NASL
description	The previous update to linux failed to build for the armhf (ARM EABI hard-float) architecture. This update corrects that. For all other architectures, there is no need to upgrade or reboot again. For reference, the relevant part of the original advisory text follows. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. CVE-2017-5715 Multiple researchers have discovered a vulnerability in various processors supporting speculative execution, enabling an attacker controlling an unprivileged process to read memory from arbitrary addresses, including from the kernel and all other processes running on the system. This specific attack has been named Spectre variant 2 (branch target injection) and is mitigated for the x86 architecture (amd64 and i386) by using new microcoded features. This mitigation requires an update to the processor
last seen	2020-06-01
modified	2020-06-02
plugin id	111082
published	2018-07-16
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111082
title	Debian DLA-1422-2 : linux security update (Spectre)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2018-D3CB6F113C.NASL
description	Speculative register leakage from lazy FPU context switching [XSA-267, CVE-2018-3665] fix for change in iasl output Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2019-01-03
plugin id	120822
published	2019-01-03
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120822
title	Fedora 28 : xen (2018-d3cb6f113c)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2087-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_93 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111437
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111437
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2087-1)

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_SECUPD2018-004.NASL
description	The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities.
last seen	2020-06-01
modified	2020-06-02
plugin id	111136
published	2018-07-17
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111136
title	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2110-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_96 fixes one issue. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111459
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111459
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2110-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1948-1.NASL
description	This update for the Linux Kernel 4.4.120-92_70 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111059
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111059
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1948-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2115-1.NASL
description	This update for the Linux Kernel 3.12.61-52_86 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111464
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111464
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2115-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1981-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1027519: Add upstream patches from January. - bsc#1098403: Fix regression introduced by changes for bsc#1079730. A PV domU without qcow2 and/or vfb has no qemu attached. Ignore QMP errors for PV domUs to handle PV domUs with and without an attached qemu-xen. - bsc#1087289: Fix xen scheduler crash. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-21
modified	2019-01-02
plugin id	120050
published	2019-01-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/120050
title	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2018:1981-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-656.NASL
description	The openSUSE Leap 42.3 was updated to 4.4.138 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2018-3639: Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4 (bsc#1085308 bsc#1087082) This update improves the previous Spectre Variant 4 fixes and also mitigates them on the ARM architecture. - CVE-2018-3665: The FPU state and registers of x86 CPUs were saved and restored in a lazy fashion, which opened its disclosure by speculative side channel attacks. This has been fixed by replacing the lazy save/restore by eager saving and restoring (bnc#1087086) - CVE-2018-5848: In the function wmi_set_ie(), the length validation code did not handle unsigned integer overflow properly. As a result, a large value of the
last seen	2020-06-05
modified	2018-06-22
plugin id	110658
published	2018-06-22
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110658
title	openSUSE Security Update : the Linux Kernel (openSUSE-2018-656) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2096-1.NASL
description	This update for the Linux Kernel 3.12.61-52_122 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111445
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111445
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2096-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2098-1.NASL
description	This update for the Linux Kernel 3.12.61-52_106 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111447
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111447
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2098-1)

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0028_KERNEL-RT.NASL
description	The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel-rt packages installed that are affected by multiple vulnerabilities: - net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. (CVE-2015-2041) - net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. (CVE-2015-2042) - The xfrm_migrate() function in the net/xfrm/xfrm_policy.c file in the Linux kernel built with CONFIG_XFRM_MIGRATE does not verify if the dir parameter is less than XFRM_POLICY_MAX. This allows a local attacker to cause a denial of service (out-of- bounds access) or possibly have unspecified other impact by sending a XFRM_MSG_MIGRATE netlink message. This flaw is present in the Linux kernel since an introduction of XFRM_MSG_MIGRATE in 2.6.21-rc1, up to 4.13-rc3. (CVE-2017-11600) - A flaw was found in the Linux kernel
last seen	2020-06-01
modified	2020-06-02
plugin id	127192
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127192
title	NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0028)

NASL family	Virtuozzo Local Security Checks
NASL id	VIRTUOZZO_VZA-2018-048.NASL
description	According to the versions of the parallels-server-bm-release / vzkernel / etc packages installed, the Virtuozzo installation on the remote host is affected by the following vulnerabilities : - [x86 AMD] An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor
last seen	2020-06-10
modified	2018-07-18
plugin id	111151
published	2018-07-18
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111151
title	Virtuozzo 6 : parallels-server-bm-release / vzkernel / etc (VZA-2018-048)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2102-1.NASL
description	This update for the Linux Kernel 3.12.61-52_89 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111451
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111451
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2102-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1943-1.NASL
description	This update for the Linux Kernel 4.4.114-92_67 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111054
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111054
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1943-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1949-1.NASL
description	This update for the Linux Kernel 4.4.121-92_73 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111101
published	2018-07-16
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111101
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1949-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2091-1.NASL
description	This update for the Linux Kernel 4.4.74-92_35 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111441
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111441
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2091-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2108-1.NASL
description	This update for the Linux Kernel 3.12.61-52_101 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111457
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111457
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2108-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2088-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111438
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111438
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2088-1)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-1852.NASL
description	From Red Hat Security Advisory 2018:1852 : An update for kernel is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es) : * Kernel: FPU state information leakage via lazy FPU restore (CVE-2018-3665) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Julian Stecklina (Amazon.de), Thomas Prescher (cyberus-technology.de), and Zdenek Sojka (sysgo.com) for reporting this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	110582
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110582
title	Oracle Linux 7 : kernel (ELSA-2018-1852)

NASL family	Junos Local Security Checks
NASL id	JUNIPER_SPACE_JSA10917_183R1.NASL
description	According to its self-reported version number, the remote Junos Space version is prior to 18.3R1. It is, therefore, affected by multiple vulnerabilities: - A use after free vulnerability exists in the do_get_mempolicy function. An local attacker can exploit this to cause a denial of service condition. (CVE-2018-10675) - A malicious authenticated user may be able to delete a device from the Junos Space database without the privileges through crafted Ajax interactions from another legitimate delete action performed by an administrative user. (CVE-2019-0016) - A flaw in validity checking of image files uploaded to Junos Space could allow an attacker to upload malicious scripts or images. (CVE-2019-0017) Additionally, Junos Space is affected by several other vulnerabilities exist as noted in the vendor advisory. Note that Nessus has not tested for these issues but has instead relied only on the application
last seen	2020-06-01
modified	2020-06-02
plugin id	121067
published	2019-01-10
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/121067
title	Juniper Junos Space < 18.3R1 Multiple Vulnerabilities (JSA10917)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0233.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: xen commit=67e64eec4bfe342ca6c2ff0858ae7f5c39041013 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee - x86/HVM: Restart ioreq processing state machine (Boris Ostrovsky) - BUILDINFO: xen commit=7e4f43226d60a48df300b32ce60ecff75ce2612d - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee - svm: fix incorrect TSC scaling (Haozhong Zhang) [Orabug: 28189188] - BUILDINFO: xen commit=ba8e4ae04e3594470f9ce1663135fbe8c25106af - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee - x86/spec-ctrl: Mitigations for LazyFPU (Ross Philipson) [Orabug: 28135217] (CVE-2018-3665) - x86: Support fully eager FPU context switching (Andrew Cooper) [Orabug: 28135217] (CVE-2018-3665) - BUILDINFO: xen commit=312880584fe084de632a6667254a5cc1c846179e - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee - [xenmicrocode] Fix error reporting on successful return from tool (Ross Philipson) [Orabug: 28128506] - x86: correct default_xen_spec_ctrl calculation (Jan Beulich) [Orabug: 28034172] - x86/msr: Virtualise MSR_SPEC_CTRL.SSBD for guests to use (Andrew Cooper) [Orabug: 28034172] (CVE-2018-3639) - x86/Intel: Mitigations for GPZ SP4 - Speculative Store Bypass (Andrew Cooper) [Orabug: 28034172] (CVE-2018-3639) - x86/AMD: Mitigations for GPZ SP4 - Speculative Store Bypass (Andrew Cooper) [Orabug: 28034172] (CVE-2018-3639) - x86/spec_ctrl: Introduce a new `spec-ctrl=` command line argument to replace `bti=` (Andrew Cooper) [Orabug: 28034172] (CVE-2018-3639) - x86/cpuid: Improvements to guest policies for speculative sidechannel features (Andrew Cooper) [Orabug: 28034172] (CVE-2018-3639) - x86/spec_ctrl: Explicitly set Xen
last seen	2020-06-01
modified	2020-06-02
plugin id	110792
published	2018-06-29
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110792
title	OracleVM 3.4 : xen (OVMSA-2018-0233) (Spectre)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2018-4134.NASL
description	Description of changes: kernel-uek [3.8.13-118.21.4.el7uek] - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28156176] {CVE-2018-3665} [3.8.13-118.21.3.el7uek] - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li) [Orabug: 27951287] {CVE-2017-17741} {CVE-2017-17741} - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen) [Orabug: 27989498] {CVE-2018-10323} - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri) [Orabug: 28030520] {CVE-2017-1000410} {CVE-2017-1000410} - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2549} - ALSA: timer: Harden slave timer list handling (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2547} {CVE-2016-2548} - ALSA: timer: Fix double unlink of active_list (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2545} - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2543} - ALSA: seq: Fix race at timer setup and close (Takashi Iwai) [Orabug: 28058229] {CVE-2016-2544} - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov) [Orabug: 28058229] {CVE-2016-2384} [3.8.13-118.21.2.el7uek] - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds) [Orabug: 27947608] {CVE-2018-1000199} - Revert
last seen	2020-06-01
modified	2020-06-02
plugin id	110583
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110583
title	Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2018-4134)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0230.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - x86/fpu: Make eager FPU default (Mihai Carabas) [Orabug: 28135099] (CVE-2018-3665)
last seen	2020-06-01
modified	2020-06-02
plugin id	110580
published	2018-06-18
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110580
title	OracleVM 3.4 : Unbreakable / etc (OVMSA-2018-0230)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0232.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: OVMF commit=173bf5c847e3ca8b42c11796ce048d8e2e916ff8 - BUILDINFO: xen commit=b059d1de3b211fe5582c63f64b4822b9f85eafd2 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional commit=346fdd7edd73f8287d0d0a2bab9c67b71bc6b8ba - BUILDINFO: IPXE commit=9a93db3f0947484e30e753bbd61a10b17336e20e - BUILDINFO: SeaBIOS commit=7d9cbe613694924921ed1a6f8947d711c5832eee - xend: fix memory leak of XendConfig.XendConfig object (Manjunath Patil) [Orabug: 28165871] - x86/HVM: Restart ioreq processing state machine (Boris Ostrovsky) - x86/spec-ctrl: Mitigations for LazyFPU (Andrew Cooper) [Orabug: 28135175] (CVE-2018-3665) - x86: Support fully eager FPU context switching (Andrew Cooper) [Orabug: 28135175] (CVE-2018-3665) - svm: fix incorrect TSC scaling (Haozhong Zhang) [Orabug: 27182906] - x86/AMD-ucode: correct multiple container handling (Jan Beulich) - x86, amd_ucode: fix coverity issues found in cpu_request_microcode (Aravind Gopalakrishnan) [Orabug: 28157269] - [xenmicrocode] Fix error reporting on successful return from tool (Ross Philipson) [Orabug: 28128754] - x86: correct default_xen_spec_ctrl calculation (Jan Beulich) [Orabug: 28035001] - x86/msr: Virtualise MSR_SPEC_CTRL.SSBD for guests to use (Andrew Cooper) [Orabug: 28035001] (CVE-2018-3639) - x86/Intel: Mitigations for GPZ SP4 - Speculative Store Bypass (Andrew Cooper) [Orabug: 28035001] (CVE-2018-3639) - x86/AMD: Mitigations for GPZ SP4 - Speculative Store Bypass (Andrew Cooper) [Orabug: 28035001] (CVE-2018-3639) - x86/spec_ctrl: Introduce a new `spec-ctrl=` command line argument to replace `bti=` (Andrew Cooper) [Orabug: 28035001] (CVE-2018-3639) - x86/cpuid: Improvements to guest policies for speculative sidechannel features (Andrew Cooper) [Orabug: 28035001] (CVE-2018-3639) - x86/spec_ctrl: Explicitly set Xen
last seen	2020-06-01
modified	2020-06-02
plugin id	110791
published	2018-06-29
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110791
title	OracleVM 3.4 : xen (OVMSA-2018-0232) (Spectre)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1821-1.NASL
description	The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes. This new feature was added : - Btrfs: Remove empty block groups in the background The following security bugs were fixed : - CVE-2018-3665: Prevent disclosure of FPU registers (including XMM and AVX registers) between processes. These registers might contain encryption keys when doing SSE accelerated AES enc/decryption (bsc#1087086) The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	110761
published	2018-06-28
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110761
title	SUSE SLES11 Security Update : kernel (SUSE-SU-2018:1821-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2111-1.NASL
description	This update for the Linux Kernel 3.12.61-52_136 fixes one issue. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111460
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111460
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2111-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1945-1.NASL
description	This update for the Linux Kernel 4.4.114-92_64 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111056
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111056
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1945-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2037-1.NASL
description	This update for xen fixes the following issues: Security issues fixed : - CVE-2018-12617: Fix integer overflow that causes segmentation fault in qmp_guest_file_read() with g_malloc() (bsc#1098744). - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-11806: Fix heap buffer overflow while reassembling fragmented datagrams (bsc#1096224). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1079730: Fix failed
last seen	2020-06-01
modified	2020-06-02
plugin id	111261
published	2018-07-24
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111261
title	SUSE SLES11 Security Update : xen (SUSE-SU-2018:2037-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2097-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_69 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111446
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111446
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2097-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2109-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_82 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111458
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111458
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2109-1)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-766.NASL
description	This update for xen fixes the following issues : Security issues fixed : - CVE-2018-3665: Fix Lazy FP Save/Restore issue (XSA-267) (bsc#1095242). - CVE-2018-12891: Fix possible Denial of Service (DoS) via certain PV MMU operations that affect the entire host (XSA-264) (bsc#1097521). - CVE-2018-12892: Fix libxl to honour the readonly flag on HVM emulated SCSI disks (XSA-266) (bsc#1097523). - CVE-2018-12893: Fix crash/Denial of Service (DoS) via safety check (XSA-265) (bsc#1097522). Bug fixes : - bsc#1027519: Add upstream patches from January. - bsc#1098403: Fix regression introduced by changes for bsc#1079730. A PV domU without qcow2 and/or vfb has no qemu attached. Ignore QMP errors for PV domUs to handle PV domUs with and without an attached qemu-xen. - bsc#1087289: Fix xen scheduler crash. This update was imported from the SUSE:SLE-15:Update update project.
last seen	2020-06-05
modified	2018-07-30
plugin id	111418
published	2018-07-30
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111418
title	openSUSE Security Update : xen (openSUSE-2018-766)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL21344224.NASL
description	System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data from another process through a speculative execution side channel. (CVE-2018-3665) A Floating-Point (FP) state information leakage flaw was found in the way the Linux kernel saves and restores the FP state during task switch. Linux kernels that follow the
last seen	2020-03-17
modified	2018-11-02
plugin id	118641
published	2018-11-02
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118641
title	F5 Networks BIG-IP : Lazy FP state restore vulnerability (K21344224)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-4232.NASL
description	This update provides mitigations for the
last seen	2020-06-01
modified	2020-06-02
plugin id	110624
published	2018-06-21
reporter	This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/110624
title	Debian DSA-4232-1 : xen - security update

NASL family	MacOS X Local Security Checks
NASL id	MACOS_10_13_6.NASL
description	The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
last seen	2020-06-01
modified	2020-06-02
plugin id	111137
published	2018-07-17
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111137
title	macOS 10.13.x < 10.13.6 Multiple Vulnerabilities

NASL family	NewStart CGSL Local Security Checks
NASL id	NEWSTART_CGSL_NS-SA-2019-0152_KERNEL.NASL
description	The remote NewStart CGSL host, running version MAIN 4.05, has kernel packages installed that are affected by multiple vulnerabilities: - It was found that AIO interface didn
last seen	2020-06-01
modified	2020-06-02
plugin id	127425
published	2019-08-12
reporter	This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/127425
title	NewStart CGSL MAIN 4.05 : kernel Multiple Vulnerabilities (NS-SA-2019-0152)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2019-1190.NASL
description	An update for kernel-rt is now available for Red Hat Enterprise MRG 2. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es) : * A flaw was found in the implementation of the
last seen	2020-06-01
modified	2020-06-02
plugin id	125192
published	2019-05-16
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/125192
title	RHEL 6 : MRG (RHSA-2019:1190) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-1940-1.NASL
description	This update for the Linux Kernel 4.4.103-92_53 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111052
published	2018-07-13
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111052
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:1940-1)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2018-2100-1.NASL
description	This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues. The following security issue was fixed : - CVE-2018-3665: System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially have allowed a local process to infer data from another process via a speculative execution side channel (bsc#1090338, bsc#1096740). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	111449
published	2018-07-30
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111449
title	SUSE SLES12 Security Update : kernel (SUSE-SU-2018:2100-1)

NASL family	OracleVM Local Security Checks
NASL id	ORACLEVM_OVMSA-2018-0271.NASL
description	The remote OracleVM system is missing necessary patches to address critical security updates : please see Oracle VM Security Advisory OVMSA-2018-0271 for details.
last seen	2020-06-01
modified	2020-06-02
plugin id	118962
published	2018-11-15
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/118962
title	OracleVM 3.3 : xen (OVMSA-2018-0271) (Foreshadow) (Spectre)

Redhat

advisories

bugzilla

id	1585011
title	CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

comment kernel earlier than 0:3.10.0-862.3.3.el7 is currently running
oval oval:com.redhat.rhsa:tst:20181852031
comment kernel earlier than 0:3.10.0-862.3.3.el7 is set to boot up on next boot
oval oval:com.redhat.rhsa:tst:20181852032

AND

comment kernel-tools-libs-devel is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852001
comment kernel-tools-libs-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20140678022

AND

comment kernel-abi-whitelists is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852003
comment kernel-abi-whitelists is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20131645022

AND
comment kernel-doc is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852005
comment kernel-doc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842002

AND

comment kernel-headers is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852007
comment kernel-headers is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842010

AND
comment kernel is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852009
comment kernel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842012
AND
comment kernel-tools is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852011
comment kernel-tools is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20140678012

AND

comment kernel-debug-devel is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852013
comment kernel-debug-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842008

AND

comment kernel-tools-libs is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852015
comment kernel-tools-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20140678016

AND
comment python-perf is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852017
comment python-perf is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111530024
AND
comment kernel-debug is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852019
comment kernel-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842014
AND
comment kernel-devel is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852021
comment kernel-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842016
AND
comment perf is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852023
comment perf is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842006

AND

comment kernel-bootwrapper is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852025
comment kernel-bootwrapper is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842018

AND
comment kernel-kdump is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852027
comment kernel-kdump is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842020

AND

comment kernel-kdump-devel is earlier than 0:3.10.0-862.3.3.el7
oval oval:com.redhat.rhsa:tst:20181852029
comment kernel-kdump-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842022

rhsa

id	RHSA-2018:1852
released	2018-06-14
severity	Moderate
title	RHSA-2018:1852: kernel security update (Moderate)

bugzilla

id	1585011
title	CVE-2018-3665 Kernel: FPU state information leakage via lazy FPU restore

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND

comment kernel-rt-doc is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944001
comment kernel-rt-doc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727002

AND

comment kernel-rt-devel is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944003
comment kernel-rt-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727012

AND

comment kernel-rt-trace is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944005
comment kernel-rt-trace is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727008

AND

comment kernel-rt-debug is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944007
comment kernel-rt-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727014

AND

comment kernel-rt-debug-devel is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944009
comment kernel-rt-debug-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727010

AND

comment kernel-rt is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944011
comment kernel-rt is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727006

AND

comment kernel-rt-trace-devel is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944013
comment kernel-rt-trace-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20150727004

AND

comment kernel-rt-trace-kvm is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944015
comment kernel-rt-trace-kvm is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20160212016

AND

comment kernel-rt-kvm is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944017
comment kernel-rt-kvm is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20160212018

AND

comment kernel-rt-debug-kvm is earlier than 0:3.10.0-862.3.3.rt56.809.el7
oval oval:com.redhat.rhsa:tst:20181944019
comment kernel-rt-debug-kvm is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20160212020

rhsa

id	RHSA-2018:1944
released	2018-06-19
severity	Moderate
title	RHSA-2018:1944: kernel-rt security update (Moderate)

bugzilla

id	1596094
title	CVE-2018-10872 kernel: error in exception handling leads to DoS (CVE-2018-8897 regression)

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

comment kernel earlier than 0:2.6.32-754.2.1.el6 is currently running
oval oval:com.redhat.rhsa:tst:20182164027
comment kernel earlier than 0:2.6.32-754.2.1.el6 is set to boot up on next boot
oval oval:com.redhat.rhsa:tst:20182164028

AND
comment python-perf is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164001
comment python-perf is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111530024

AND

comment kernel-debug-devel is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164003
comment kernel-debug-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842008

AND
comment perf is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164005
comment perf is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842006

AND

comment kernel-headers is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164007
comment kernel-headers is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842010

AND
comment kernel is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164009
comment kernel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842012
AND
comment kernel-devel is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164011
comment kernel-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842016

AND

comment kernel-firmware is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164013
comment kernel-firmware is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842004

AND
comment kernel-doc is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164015
comment kernel-doc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842002

AND

comment kernel-abi-whitelists is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164017
comment kernel-abi-whitelists is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20131645022

AND
comment kernel-debug is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164019
comment kernel-debug is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842014

AND

comment kernel-bootwrapper is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164021
comment kernel-bootwrapper is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842018

AND
comment kernel-kdump is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164023
comment kernel-kdump is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842020

AND

comment kernel-kdump-devel is earlier than 0:2.6.32-754.2.1.el6
oval oval:com.redhat.rhsa:tst:20182164025
comment kernel-kdump-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100842022

rhsa

id	RHSA-2018:2164
released	2018-07-10
severity	Important
title	RHSA-2018:2164: kernel security and bug fix update (Important)

rhsa
id RHSA-2018:2165
rhsa
id RHSA-2019:1170
rhsa
id RHSA-2019:1190

rpms

kernel-0:3.10.0-862.3.3.el7
kernel-abi-whitelists-0:3.10.0-862.3.3.el7
kernel-bootwrapper-0:3.10.0-862.3.3.el7
kernel-debug-0:3.10.0-862.3.3.el7
kernel-debug-debuginfo-0:3.10.0-862.3.3.el7
kernel-debug-devel-0:3.10.0-862.3.3.el7
kernel-debuginfo-0:3.10.0-862.3.3.el7
kernel-debuginfo-common-ppc64-0:3.10.0-862.3.3.el7
kernel-debuginfo-common-ppc64le-0:3.10.0-862.3.3.el7
kernel-debuginfo-common-s390x-0:3.10.0-862.3.3.el7
kernel-debuginfo-common-x86_64-0:3.10.0-862.3.3.el7
kernel-devel-0:3.10.0-862.3.3.el7
kernel-doc-0:3.10.0-862.3.3.el7
kernel-headers-0:3.10.0-862.3.3.el7
kernel-kdump-0:3.10.0-862.3.3.el7
kernel-kdump-debuginfo-0:3.10.0-862.3.3.el7
kernel-kdump-devel-0:3.10.0-862.3.3.el7
kernel-tools-0:3.10.0-862.3.3.el7
kernel-tools-debuginfo-0:3.10.0-862.3.3.el7
kernel-tools-libs-0:3.10.0-862.3.3.el7
kernel-tools-libs-devel-0:3.10.0-862.3.3.el7
perf-0:3.10.0-862.3.3.el7
perf-debuginfo-0:3.10.0-862.3.3.el7
python-perf-0:3.10.0-862.3.3.el7
python-perf-debuginfo-0:3.10.0-862.3.3.el7
kernel-rt-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debug-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debug-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debug-devel-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debug-kvm-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debug-kvm-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-debuginfo-common-x86_64-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-devel-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-doc-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-kvm-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-kvm-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-trace-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-trace-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-trace-devel-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-trace-kvm-0:3.10.0-862.3.3.rt56.809.el7
kernel-rt-trace-kvm-debuginfo-0:3.10.0-862.3.3.rt56.809.el7
kernel-0:2.6.32-754.2.1.el6
kernel-abi-whitelists-0:2.6.32-754.2.1.el6
kernel-bootwrapper-0:2.6.32-754.2.1.el6
kernel-debug-0:2.6.32-754.2.1.el6
kernel-debug-debuginfo-0:2.6.32-754.2.1.el6
kernel-debug-devel-0:2.6.32-754.2.1.el6
kernel-debuginfo-0:2.6.32-754.2.1.el6
kernel-debuginfo-common-i686-0:2.6.32-754.2.1.el6
kernel-debuginfo-common-ppc64-0:2.6.32-754.2.1.el6
kernel-debuginfo-common-s390x-0:2.6.32-754.2.1.el6
kernel-debuginfo-common-x86_64-0:2.6.32-754.2.1.el6
kernel-devel-0:2.6.32-754.2.1.el6
kernel-doc-0:2.6.32-754.2.1.el6
kernel-firmware-0:2.6.32-754.2.1.el6
kernel-headers-0:2.6.32-754.2.1.el6
kernel-kdump-0:2.6.32-754.2.1.el6
kernel-kdump-debuginfo-0:2.6.32-754.2.1.el6
kernel-kdump-devel-0:2.6.32-754.2.1.el6
perf-0:2.6.32-754.2.1.el6
perf-debuginfo-0:2.6.32-754.2.1.el6
python-perf-0:2.6.32-754.2.1.el6
python-perf-debuginfo-0:2.6.32-754.2.1.el6
kernel-rt-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-debug-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-debug-debuginfo-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-debug-devel-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-debuginfo-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-debuginfo-common-x86_64-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-devel-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-doc-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-firmware-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-trace-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-trace-debuginfo-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-trace-devel-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-vanilla-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-vanilla-debuginfo-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-rt-vanilla-devel-1:3.10.0-693.35.1.rt56.625.el6rt
kernel-0:3.10.0-693.47.2.el7
kernel-abi-whitelists-0:3.10.0-693.47.2.el7
kernel-bootwrapper-0:3.10.0-693.47.2.el7
kernel-debug-0:3.10.0-693.47.2.el7
kernel-debug-debuginfo-0:3.10.0-693.47.2.el7
kernel-debug-devel-0:3.10.0-693.47.2.el7
kernel-debuginfo-0:3.10.0-693.47.2.el7
kernel-debuginfo-common-ppc64-0:3.10.0-693.47.2.el7
kernel-debuginfo-common-ppc64le-0:3.10.0-693.47.2.el7
kernel-debuginfo-common-s390x-0:3.10.0-693.47.2.el7
kernel-debuginfo-common-x86_64-0:3.10.0-693.47.2.el7
kernel-devel-0:3.10.0-693.47.2.el7
kernel-doc-0:3.10.0-693.47.2.el7
kernel-headers-0:3.10.0-693.47.2.el7
kernel-kdump-0:3.10.0-693.47.2.el7
kernel-kdump-debuginfo-0:3.10.0-693.47.2.el7
kernel-kdump-devel-0:3.10.0-693.47.2.el7
kernel-tools-0:3.10.0-693.47.2.el7
kernel-tools-debuginfo-0:3.10.0-693.47.2.el7
kernel-tools-libs-0:3.10.0-693.47.2.el7
kernel-tools-libs-devel-0:3.10.0-693.47.2.el7
perf-0:3.10.0-693.47.2.el7
perf-debuginfo-0:3.10.0-693.47.2.el7
python-perf-0:3.10.0-693.47.2.el7
python-perf-debuginfo-0:3.10.0-693.47.2.el7
kernel-rt-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-debug-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-debug-debuginfo-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-debug-devel-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-debuginfo-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-debuginfo-common-x86_64-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-devel-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-doc-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-firmware-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-trace-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-trace-debuginfo-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-trace-devel-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-vanilla-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-vanilla-debuginfo-1:3.10.0-693.47.2.rt56.641.el6rt
kernel-rt-vanilla-devel-1:3.10.0-693.47.2.rt56.641.el6rt

The Hacker News

id	THN:8D2EBFFF49C28141AF4C4100C1A10301
last seen	2018-06-14
modified	2018-06-14
published	2018-06-14
reporter	Mohit Kumar
source	https://thehackernews.com/2018/06/intel-processor-vulnerability.html
title	New 'Lazy FP State Restore' Vulnerability Found in All Modern Intel CPUs

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

The Hacker News

Related news

References